kern: support uid/pid filter in ebpf TC hook. #606
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
remove uid/pid filter in kprobe/tcp_sendmsg. tcp_sendmsg hook all processes are monitored, so there is no need to filter pid and uid, otherwise pid\uid cannot be used in the TC capture_packets function to filter network packets Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
|
@xxxxxliil try it. |
|
Yes, there are three bugs in these two issues:
Among them, bug 1 involves incorrect character output but does not actually affect the program logic. bug 3 was fixed by removing related logs that had no value. The main focus was on fixing bug 2. |
|
|
此处的不能构建不是不知道构建命令，而是发行版不能提供对应的 aarch64 头文件（包 aarch64-linux-gnu-linux-api-headers 没有提供 |
|
我本地做了测试，是可以构建ANDROID的。 如果你在amd64上，也是可以编译x86_64的ANDROID程序。 如果你想交叉编译，那么你需要参考 https://github.com/gojue/ecapture/blob/master/.github/workflows/release.yml#L27 ，下载头文件源码，并构建生成相关头文件。 在makefile时引用。 sudo tar -xf linux-source-${kernel_ver}.tar.bz2
cd /usr/src/linux-source-${kernel_ver}
test -f .config || sudo make oldconfig
sudo make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- prepare V=0
ls -al /usr/src/linux-source-${kernel_ver}另外：因为你不是ubuntu，无法使用已经提供好的脚本。所以，你需要手动安装。 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
remove uid/pid filter in kprobe/tcp_sendmsg.
tcp_sendmsg hook all processes are monitored, so there is no need to filter pid and uid, otherwise pid\uid cannot be used in the TC capture_packets function to filter network packets