bpf: check the bitset in match_binaries

This commit adds a check in match_binaries that uses the bitset that is tracked from parent to children, allowing to track children of a given binary. Signed-off-by: Kornilios Kourtis <[email protected]>
cilium · Jul 23, 2024 · 72b1deb · 72b1deb
1 parent 5933836
commit 72b1deb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/bpf/process/types/basic.h b/bpf/process/types/basic.h
@@ -1578,6 +1578,8 @@ FUNC_INLINE int match_binaries(__u32 selidx)
 
 		switch (selector_options->op) {
 		case op_filter_in:
+			if (current->bin.mb_bitset & (1UL<<selector_options->mbset_id))
+				return 1;
 		case op_filter_notin:
 			path_map = map_lookup_elem(&tg_mb_paths, &selidx);
 			if (!path_map)