Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[tools/execsnoop] Try to get parent PID from current task's real parent. #1885

Merged
merged 4 commits into from
Jul 16, 2018
Merged

[tools/execsnoop] Try to get parent PID from current task's real parent. #1885

merged 4 commits into from
Jul 16, 2018

Commits on Jul 12, 2018

  1. Try to get parent PID from current task's real parent. 

    Fallback to read the PPid from /proc if the real parent's TGID is 0.

Signed-off-by: David Calavera <[email protected]>
    @calavera
    calavera committed Jul 12, 2018
    Configuration menu
    Copy the full SHA
    020bcd4 View commit details
    Browse the repository at this point in the history

  2. Update get_ppid comment. 

    Signed-off-by: David Calavera <[email protected]>
    @calavera
    calavera committed Jul 12, 2018
    Configuration menu
    Copy the full SHA
    dee18fe View commit details
    Browse the repository at this point in the history

Commits on Jul 13, 2018

  1. Add inline comment about issue in 4.13 kernels. 

    Signed-off-by: David Calavera <[email protected]>
    @calavera
    calavera committed Jul 13, 2018
    Configuration menu
    Copy the full SHA
    4fae497 View commit details
    Browse the repository at this point in the history

Commits on Jul 14, 2018

  1. Update preconditions for execsnoop. 

    bpf_get_current_task is only available in 4.8 and above.

Signed-off-by: David Calavera <[email protected]>
    @calavera
    calavera committed Jul 14, 2018
    Configuration menu
    Copy the full SHA
    d46f4f4 View commit details
    Browse the repository at this point in the history