Merge pull request #117 from intelops/bug-kernel-loop

feat: update self generated event find logic
intelops · Apr 9, 2024 · b85e985 · b85e985
2 parents a9ceb3f + a77c711
commit b85e985
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/tarian/c/utils/filters.h b/tarian/c/utils/filters.h
@@ -17,7 +17,15 @@ stain bool can_proceed() {
     return true;
 }
 
+// has_same_pid checks if the event has same pid as the current task.
 stain bool has_same_pid(uint32_t pid) {
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+    uint32_t c_pid = get_task_ns_tgid(task);
+
+    return (c_pid == pid);
+}
+
+stain bool has_same__host_pid(uint32_t pid) {
     u64 fpid = bpf_get_current_pid_tgid() >> 32;
 
     return (fpid == pid);