1#!/usr/bin/python3 2 3from bcc import BPF 4 5source = r""" 6#include <linux/fs.h> 7 8BPF_INODE_STORAGE(inode_storage_map, int); 9 10LSM_PROBE(inode_rename, struct inode *old_dir, struct dentry *old_dentry, 11 struct inode *new_dir, struct dentry *new_dentry, unsigned int flags) 12{ 13 int *value; 14 15 value = inode_storage_map.inode_storage_get(old_dentry->d_inode, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); 16 if (!value) 17 return 0; 18 19 bpf_trace_printk("%d", *value); 20 return 0; 21} 22""" 23 24b = BPF(text=source) 25try: 26 b.trace_print() 27except KeyboardInterrupt: 28 pass 29