On Fri, Jun 12, 2015 at 2:40 PM, Alexei Starovoitov [off-list ref] wrote:
eBPF programs attached to kprobes need to filter based on
current->pid, uid and other fields, so introduce helper functions:
u64 bpf_get_current_pid_tgid(void)
Return: current->tgid << 32 | current->pid
u64 bpf_get_current_uid_gid(void)
Return: current_gid << 32 | current_uid
How does this work wrt namespaces, and why the weird packing?
--Andy