Fix PID detection via eBPF

safing · Jul 28, 2023 · b882b91 · b882b91
1 parent 8e9f96d
commit b882b91
Show file tree

Hide file tree

Showing 5 changed files with 3 additions and 5 deletions.
diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go b/firewall/interception/ebpf/connection_listener/bpf_bpfeb.go
diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o b/firewall/interception/ebpf/connection_listener/bpf_bpfeb.o
diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfel.go b/firewall/interception/ebpf/connection_listener/bpf_bpfel.go
diff --git a/firewall/interception/ebpf/connection_listener/bpf_bpfel.o b/firewall/interception/ebpf/connection_listener/bpf_bpfel.o
diff --git a/firewall/interception/ebpf/programs/monitor.c b/firewall/interception/ebpf/programs/monitor.c
@@ -46,8 +46,8 @@ int BPF_PROG(tcp_connect, struct sock *sk) {
 		return 0;
 	}
 
-  // Read PID
-	tcp_info->pid = __builtin_bswap32((u32)bpf_get_current_pid_tgid());
+  // Read PID (Careful: This is the Thread Group ID in kernel speak!)
+	tcp_info->pid = __builtin_bswap32((u32)(bpf_get_current_pid_tgid() >> 32));
 
 	// Set protocol
 	tcp_info->protocol = TCP;