From 061641ddbe563cbf6e0af3b13fc3c5183051a472 Mon Sep 17 00:00:00 2001 From: Mostafa Moradian Date: Tue, 15 Sep 2026 10:11:46 +0200 Subject: [PATCH 1/5] feat(event): Add Linux syscall telemetry types and parameters Extend the Linux event catalog with openat, unlink, rename, connect, accept, mmap, process_vm_readv/writev, kill, ptrace, and prctl. Identifiers stay stable and Linux-native, and tests assert that Windows event names stay out of the catalog. --- pkg/event/metainfo_linux.go | 42 +++++++++++++++++---- pkg/event/params/names_linux.go | 32 ++++++++++++++++ pkg/event/types_linux.go | 65 ++++++++++++++++++++++++++++++++- pkg/event/types_linux_test.go | 60 ++++++++++++++++++++++++++++++ 4 files changed, 190 insertions(+), 9 deletions(-) create mode 100644 pkg/event/types_linux_test.go diff --git a/pkg/event/metainfo_linux.go b/pkg/event/metainfo_linux.go index 667f598a3..606b0f669 100644 --- a/pkg/event/metainfo_linux.go +++ b/pkg/event/metainfo_linux.go @@ -23,20 +23,48 @@ package event import "slices" var events = map[Type]Info{ - Execve: {Name: "execve", Category: Process, Description: "Executes a program"}, - Exit: {Name: "exit", Category: Process, Description: "Exit all threads in a process"}, - Clone: {Name: "clone", Category: Process, Description: "Creates a child process or a thread"}, + Execve: {Name: "execve", Category: Process, Description: "Executes a program"}, + Exit: {Name: "exit", Category: Process, Description: "Exit all threads in a process"}, + Clone: {Name: "clone", Category: Process, Description: "Creates a child process or a thread"}, + Openat: {Name: "openat", Category: File, Description: "Opens or creates a file"}, + Unlink: {Name: "unlink", Category: File, Description: "Removes a directory entry"}, + Rename: {Name: "rename", Category: File, Description: "Renames a file"}, + Connect: {Name: "connect", Category: Net, Description: "Initiates a socket connection"}, + Accept: {Name: "accept", Category: Net, Description: "Accepts a socket connection"}, + Mmap: {Name: "mmap", Category: Mem, Description: "Maps files or devices into memory"}, + ProcessVMRead: {Name: "process_vm_readv", Category: Mem, Description: "Reads memory from another process"}, + ProcessVMWrite: {Name: "process_vm_writev", Category: Mem, Description: "Writes memory into another process"}, + Kill: {Name: "kill", Category: Process, Description: "Sends a signal to a process"}, + Ptrace: {Name: "ptrace", Category: Process, Description: "Traces or controls another process"}, + Prctl: {Name: "prctl", Category: Process, Description: "Performs a process-control operation"}, } var types = map[string]Type{ - "execve": Execve, - "exit": Exit, - "clone": Clone, + "execve": Execve, + "exit": Exit, + "clone": Clone, + "openat": Openat, + "unlink": Unlink, + "rename": Rename, + "connect": Connect, + "accept": Accept, + "mmap": Mmap, + "process_vm_readv": ProcessVMRead, + "process_vm_writev": ProcessVMWrite, + "kill": Kill, + "ptrace": Ptrace, + "prctl": Prctl, } // All returns all Linux event types. func All() []Type { - return []Type{Execve, Exit, Clone} + return []Type{ + Execve, Exit, Clone, + Openat, Unlink, Rename, + Connect, Accept, + Mmap, ProcessVMRead, ProcessVMWrite, + Kill, Ptrace, Prctl, + } } // MaxTypeID returns the largest Linux event type identifier. diff --git a/pkg/event/params/names_linux.go b/pkg/event/params/names_linux.go index edf79f1f0..14b30b4a4 100644 --- a/pkg/event/params/names_linux.go +++ b/pkg/event/params/names_linux.go @@ -33,4 +33,36 @@ const ( Retval = "retval" // StartBootTime is the process start time measured from system boot, in nanoseconds. StartBootTime = "start_boot_time" + // DirFD is a directory file descriptor, including AT_FDCWD. + DirFD = "dirfd" + // NewDirFD is the destination directory file descriptor for renameat. + NewDirFD = "new_dirfd" + // FileNewPath is the destination path of a rename. + FileNewPath = "file_new_path" + // FileFlags is the raw openat, unlinkat, or renameat2 flags bitmask. + FileFlags = "file_flags" + // FileMode is the file creation mode supplied to openat. + FileMode = "file_mode" + // FD is a file descriptor. + FD = "fd" + // SockFamily is the socket address family (AF_INET, AF_INET6, AF_UNIX). + SockFamily = "sock_family" + // SockPath is the filesystem path of an AF_UNIX socket. + SockPath = "sock_path" + // MmapFlags is the raw mmap flags bitmask. + MmapFlags = "mmap_flags" + // MmapOffset is the file offset of a memory mapping. + MmapOffset = "mmap_offset" + // Signal is a POSIX signal number. + Signal = "signal" + // PtraceRequest is the ptrace request code. + PtraceRequest = "ptrace_request" + // PtraceAddr is the ptrace address argument. + PtraceAddr = "ptrace_addr" + // PtraceData is the ptrace data argument. + PtraceData = "ptrace_data" + // PrctlOption is the prctl option code. + PrctlOption = "prctl_option" + // Truncated is a bitmask of truncated variable-length fields. + Truncated = "truncated" ) diff --git a/pkg/event/types_linux.go b/pkg/event/types_linux.go index 8bb9b7140..883947e0b 100644 --- a/pkg/event/types_linux.go +++ b/pkg/event/types_linux.go @@ -41,6 +41,17 @@ const ( Execve Exit Clone + Openat + Unlink + Rename + Connect + Accept + Mmap + ProcessVMRead + ProcessVMWrite + Kill + Ptrace + Prctl ) // String returns the event type name. @@ -52,6 +63,28 @@ func (t Type) String() string { return "exit" case Clone: return "clone" + case Openat: + return "openat" + case Unlink: + return "unlink" + case Rename: + return "rename" + case Connect: + return "connect" + case Accept: + return "accept" + case Mmap: + return "mmap" + case ProcessVMRead: + return "process_vm_readv" + case ProcessVMWrite: + return "process_vm_writev" + case Kill: + return "kill" + case Ptrace: + return "ptrace" + case Prctl: + return "prctl" default: return "" } @@ -60,8 +93,14 @@ func (t Type) String() string { // Category returns the event type category. func (t Type) Category() Category { switch t { - case Execve, Exit, Clone: + case Execve, Exit, Clone, Kill, Ptrace, Prctl: return Process + case Openat, Unlink, Rename: + return File + case Connect, Accept: + return Net + case Mmap, ProcessVMRead, ProcessVMWrite: + return Mem default: return Unknown } @@ -79,6 +118,28 @@ func (t Type) Description() string { return "Exit all threads in a process" case Clone: return "Creates a child process or a thread" + case Openat: + return "Opens or creates a file" + case Unlink: + return "Removes a directory entry" + case Rename: + return "Renames a file" + case Connect: + return "Initiates a socket connection" + case Accept: + return "Accepts a socket connection" + case Mmap: + return "Maps files or devices into memory" + case ProcessVMRead: + return "Reads memory from another process" + case ProcessVMWrite: + return "Writes memory into another process" + case Kill: + return "Sends a signal to a process" + case Ptrace: + return "Traces or controls another process" + case Prctl: + return "Performs a process-control operation" default: return "" } @@ -95,7 +156,7 @@ func (t Type) Hash() uint32 { // Exists reports whether the event type is known. func (t Type) Exists() bool { switch t { - case Execve, Exit, Clone: + case Execve, Exit, Clone, Openat, Unlink, Rename, Connect, Accept, Mmap, ProcessVMRead, ProcessVMWrite, Kill, Ptrace, Prctl: return true default: return false diff --git a/pkg/event/types_linux_test.go b/pkg/event/types_linux_test.go new file mode 100644 index 000000000..9cee20881 --- /dev/null +++ b/pkg/event/types_linux_test.go @@ -0,0 +1,60 @@ +//go:build linux + +/* + * Copyright 2026 by Mostafa Moradian + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package event + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +func TestLinuxEventCatalog(t *testing.T) { + assert.Equal(t, uint16(1), uint16(Execve)) + assert.Equal(t, uint16(14), uint16(Prctl)) + assert.Equal(t, File, Openat.Category()) + assert.Equal(t, Net, Connect.Category()) + assert.Equal(t, Mem, Mmap.Category()) + assert.Equal(t, Process, Kill.Category()) + assert.Equal(t, "process_vm_readv", ProcessVMRead.String()) + assert.True(t, Openat.Exists()) + for _, typ := range All() { + assert.True(t, typ.Exists()) + assert.Equal(t, typ, NameToType(typ.String())) + assert.NotEmpty(t, typ.Description()) + assert.Equal(t, typ.Category(), TypeToEventInfo(typ).Category) + } + assert.Equal(t, uint16(Prctl), MaxTypeID()) +} + +func TestLinuxEventCatalogRejectsWindowsNames(t *testing.T) { + for _, name := range []string{ + "CreateProcess", + "TerminateProcess", + "ProcessRundown", + "CreateFile", + "CreateThread", + "LoadImage", + "RegOpenKey", + "RecvTCPv4", + } { + assert.Equal(t, UnknownType, NameToType(name), name) + } +} From 9b2fb7beadceef73bced2719302572afba797c6b Mon Sep 17 00:00:00 2001 From: Mostafa Moradian Date: Tue, 15 Sep 2026 10:15:49 +0200 Subject: [PATCH 2/5] feat(ebpf): Extend the shared syscall record and enabled-type map Grow the ring buffer record with extra arguments, a second path buffer, and truncation bits so later syscall families can share one header. Build scratch values in a per-CPU heap to stay under the BPF stack limit, and gate emission with an enabled-type array keyed by stable event IDs rather than architecture syscall numbers. --- internal/ebpf/c/clone.bpf.c | 44 +++++------ internal/ebpf/c/common/events.h | 136 +++++++++++++++++++++++++++++++- internal/ebpf/c/execve.bpf.c | 41 ++++------ internal/ebpf/c/exit.bpf.c | 2 + internal/ebpf/clone_bpfeb.go | 32 +++++--- internal/ebpf/clone_bpfeb.o | Bin 30208 -> 45216 bytes internal/ebpf/clone_bpfel.go | 32 +++++--- internal/ebpf/clone_bpfel.o | Bin 29824 -> 44832 bytes internal/ebpf/events.go | 31 +++++--- internal/ebpf/execve_bpfeb.go | 32 +++++--- internal/ebpf/execve_bpfeb.o | Bin 16456 -> 22792 bytes internal/ebpf/execve_bpfel.go | 32 +++++--- internal/ebpf/execve_bpfel.o | Bin 16264 -> 22600 bytes internal/ebpf/exit_bpfeb.go | 32 +++++--- internal/ebpf/exit_bpfeb.o | Bin 6632 -> 7880 bytes internal/ebpf/exit_bpfel.go | 32 +++++--- internal/ebpf/exit_bpfel.o | Bin 6632 -> 7880 bytes internal/ebpf/loader.go | 49 +++++++++++- internal/ebpf/loader_test.go | 22 ++++++ internal/ebpf/maps.go | 8 +- internal/ebpf/prociter_bpfeb.go | 32 +++++--- internal/ebpf/prociter_bpfeb.o | Bin 6280 -> 7136 bytes internal/ebpf/prociter_bpfel.go | 32 +++++--- internal/ebpf/prociter_bpfel.o | Bin 6280 -> 7136 bytes internal/ebpf/source.go | 5 ++ internal/ebpf/source_test.go | 3 + 26 files changed, 448 insertions(+), 149 deletions(-) diff --git a/internal/ebpf/c/clone.bpf.c b/internal/ebpf/c/clone.bpf.c index 3c452ff34..4e881d261 100644 --- a/internal/ebpf/c/clone.bpf.c +++ b/internal/ebpf/c/clone.bpf.c @@ -1,19 +1,20 @@ //go:build ignore #include "common/events.h" -#include "bpf_core_read.h" #include "bpf_tracing.h" char LICENSE[] SEC("license") = "Dual MIT/GPL"; static __always_inline int handle_clone_enter(u64 flags, u32 syscall_id) { - u64 key = bpf_get_current_pid_tgid(); - struct scratch_value val = {}; + struct scratch_value *val; - val.arg0 = flags; - val.arg1 = syscall_id; - bpf_map_update_elem(&scratch, &key, &val, BPF_ANY); + val = borrow_scratch(); + if (!val) + return 0; + val->flags = flags; + val->arg1 = syscall_id; + store_scratch(val); return 0; } @@ -22,9 +23,6 @@ static __always_inline int handle_clone_exit(long ret, u32 syscall_id) u64 key = bpf_get_current_pid_tgid(); struct scratch_value *val; struct syscall_event *e; - struct task_struct *task; - struct task_struct *parent; - const struct cred *cred; /* Successful clones are emitted from sched_process_fork with child identity. * Leave scratch in place so the fork handler can recover clone flags. @@ -32,29 +30,25 @@ static __always_inline int handle_clone_exit(long ret, u32 syscall_id) if (ret >= 0) return 0; + if (!type_enabled(EVT_TYPE_CLONE)) { + bpf_map_delete_elem(&scratch, &key); + return 0; + } + e = reserve_event(); - if (!e) + if (!e) { + bpf_map_delete_elem(&scratch, &key); return 0; + } e->type = EVT_TYPE_CLONE; e->syscall_id = syscall_id; e->retval = ret; - fill_current_ids(e); - - task = (struct task_struct *)bpf_get_current_task(); - e->start_boottime = BPF_CORE_READ(task, start_boottime); - parent = BPF_CORE_READ(task, real_parent); - if (parent) - e->ppid = BPF_CORE_READ(parent, tgid); - cred = BPF_CORE_READ(task, real_cred); - if (cred) { - e->uid = BPF_CORE_READ(cred, euid.val); - e->gid = BPF_CORE_READ(cred, egid.val); - } + fill_current_task(e); val = bpf_map_lookup_elem(&scratch, &key); if (val) { - e->flags = val->arg0; + copy_scratch(e, val); if (!e->syscall_id) e->syscall_id = (u32)val->arg1; } @@ -126,6 +120,8 @@ int BPF_PROG(handle_sched_process_fork, struct task_struct *parent, struct task_ if (!child || !parent) return 0; + if (!type_enabled(EVT_TYPE_CLONE)) + return 0; e = reserve_event(); if (!e) @@ -154,7 +150,7 @@ int BPF_PROG(handle_sched_process_fork, struct task_struct *parent, struct task_ key = ((u64)parent->tgid << 32) | (u32)parent->pid; val = bpf_map_lookup_elem(&scratch, &key); if (val) { - e->flags = val->arg0; + copy_scratch(e, val); e->syscall_id = (u32)val->arg1; bpf_map_delete_elem(&scratch, &key); } diff --git a/internal/ebpf/c/common/events.h b/internal/ebpf/c/common/events.h index 4328072f6..f44b374f8 100644 --- a/internal/ebpf/c/common/events.h +++ b/internal/ebpf/c/common/events.h @@ -4,12 +4,24 @@ #include "vmlinux.h" #include "bpf_helpers.h" +#include "bpf_core_read.h" #ifndef BPF_ANY #define BPF_ANY 0 #endif #define EVT_FILENAME_LEN 256 +#define EVT_TYPE_MAX 32 + +#define TRUNC_FILENAME (1u << 0) +#define TRUNC_FILENAME2 (1u << 1) + +/* UAPI openat2 argument; not a CO-RE kernel type. */ +struct open_how { + u64 flags; + u64 mode; + u64 resolve; +}; struct trace_event_raw_sys_enter { unsigned short common_type; @@ -37,6 +49,17 @@ struct trace_event_raw_sys_exit { #define EVT_TYPE_EXECVE 1 #define EVT_TYPE_EXIT 2 #define EVT_TYPE_CLONE 3 +#define EVT_TYPE_OPENAT 4 +#define EVT_TYPE_UNLINK 5 +#define EVT_TYPE_RENAME 6 +#define EVT_TYPE_CONNECT 7 +#define EVT_TYPE_ACCEPT 8 +#define EVT_TYPE_MMAP 9 +#define EVT_TYPE_PROCESS_VM_READ 10 +#define EVT_TYPE_PROCESS_VM_WRITE 11 +#define EVT_TYPE_KILL 12 +#define EVT_TYPE_PTRACE 13 +#define EVT_TYPE_PRCTL 14 struct syscall_event { u32 type; @@ -48,18 +71,31 @@ struct syscall_event { u32 gid; u32 syscall_id; s64 retval; - /* Interpreted per event type; clone stores the raw clone flags. */ + /* Interpreted per event type: clone flags, open flags, mmap flags, accept flags. */ u64 flags; + u64 arg0; + u64 arg1; + u64 arg2; + u64 arg3; u64 start_boottime; u64 timestamp_ns; + u32 truncated; + u32 pad; u8 comm[TASK_COMM_LEN]; u8 filename[EVT_FILENAME_LEN]; + u8 filename2[EVT_FILENAME_LEN]; }; struct scratch_value { u64 arg0; u64 arg1; + u64 arg2; + u64 arg3; + u64 flags; + u32 truncated; + u32 pad; u8 filename[EVT_FILENAME_LEN]; + u8 filename2[EVT_FILENAME_LEN]; }; struct { @@ -74,13 +110,32 @@ struct { __type(value, u64); } drop_count SEC(".maps"); +/* Correlates sys_enter state with the matching sys_exit. The task can + * migrate CPUs between entry and exit, so this must be a global hash, not + * a per-CPU one. LRU eviction reclaims entries whose exit never fired + * (e.g. the task was killed mid-syscall). + */ struct { - __uint(type, BPF_MAP_TYPE_PERCPU_HASH); - __uint(max_entries, 8192); + __uint(type, BPF_MAP_TYPE_LRU_HASH); + __uint(max_entries, 2048); __type(key, u64); __type(value, struct scratch_value); } scratch SEC(".maps"); +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __uint(max_entries, 1); + __type(key, u32); + __type(value, struct scratch_value); +} scratch_heap SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_ARRAY); + __uint(max_entries, EVT_TYPE_MAX); + __type(key, u32); + __type(value, u8); +} enabled SEC(".maps"); + static __always_inline void account_drop(void) { u32 key = 0; @@ -92,6 +147,16 @@ static __always_inline void account_drop(void) __sync_fetch_and_add(count, 1); } +static __always_inline int type_enabled(u32 type) +{ + u8 *on; + + if (type >= EVT_TYPE_MAX) + return 0; + on = bpf_map_lookup_elem(&enabled, &type); + return on && *on; +} + static __always_inline struct syscall_event *reserve_event(void) { struct syscall_event *e; @@ -118,3 +183,68 @@ static __always_inline void fill_current_ids(struct syscall_event *e) e->gid = uidgid >> 32; bpf_get_current_comm(&e->comm, sizeof(e->comm)); } + +static __always_inline void fill_current_task(struct syscall_event *e) +{ + struct task_struct *task; + struct task_struct *parent; + const struct cred *cred; + + fill_current_ids(e); + task = (struct task_struct *)bpf_get_current_task(); + e->start_boottime = BPF_CORE_READ(task, start_boottime); + parent = BPF_CORE_READ(task, real_parent); + if (parent) + e->ppid = BPF_CORE_READ(parent, tgid); + cred = BPF_CORE_READ(task, real_cred); + if (cred) { + e->uid = BPF_CORE_READ(cred, euid.val); + e->gid = BPF_CORE_READ(cred, egid.val); + } +} + +static __always_inline u32 read_user_str(void *dst, u32 size, const char *src) +{ + long n; + + if (!src) + return 0; + n = bpf_probe_read_user_str(dst, size, src); + if (n == size) + return 1; + return 0; +} + +static __always_inline void copy_scratch(struct syscall_event *e, struct scratch_value *val) +{ + if (!val) + return; + e->arg0 = val->arg0; + e->arg1 = val->arg1; + e->arg2 = val->arg2; + e->arg3 = val->arg3; + if (!e->flags) + e->flags = val->flags; + e->truncated = val->truncated; + __builtin_memcpy(&e->filename, val->filename, sizeof(e->filename)); + __builtin_memcpy(&e->filename2, val->filename2, sizeof(e->filename2)); +} + +static __always_inline struct scratch_value *borrow_scratch(void) +{ + u32 zero = 0; + struct scratch_value *val; + + val = bpf_map_lookup_elem(&scratch_heap, &zero); + if (!val) + return NULL; + __builtin_memset(val, 0, sizeof(*val)); + return val; +} + +static __always_inline int store_scratch(struct scratch_value *val) +{ + u64 key = bpf_get_current_pid_tgid(); + + return bpf_map_update_elem(&scratch, &key, val, BPF_ANY); +} diff --git a/internal/ebpf/c/execve.bpf.c b/internal/ebpf/c/execve.bpf.c index 32211a588..afffb5740 100644 --- a/internal/ebpf/c/execve.bpf.c +++ b/internal/ebpf/c/execve.bpf.c @@ -1,20 +1,20 @@ //go:build ignore #include "common/events.h" -#include "bpf_core_read.h" #include "bpf_tracing.h" char LICENSE[] SEC("license") = "Dual MIT/GPL"; static __always_inline int handle_exec_enter(const char *filename, u32 syscall_id) { - u64 key = bpf_get_current_pid_tgid(); - struct scratch_value val = {}; + struct scratch_value *val; - val.arg1 = syscall_id; - if (filename) - bpf_probe_read_user_str(&val.filename, sizeof(val.filename), filename); - bpf_map_update_elem(&scratch, &key, &val, BPF_ANY); + val = borrow_scratch(); + if (!val) + return 0; + val->arg1 = syscall_id; + val->truncated |= read_user_str(val->filename, sizeof(val->filename), filename); + store_scratch(val); return 0; } @@ -23,35 +23,28 @@ static __always_inline int handle_exec_exit(long ret, u32 syscall_id) u64 key = bpf_get_current_pid_tgid(); struct scratch_value *val; struct syscall_event *e; - struct task_struct *task; - struct task_struct *parent; - const struct cred *cred; + + if (!type_enabled(EVT_TYPE_EXECVE)) { + bpf_map_delete_elem(&scratch, &key); + return 0; + } e = reserve_event(); - if (!e) + if (!e) { + bpf_map_delete_elem(&scratch, &key); return 0; + } e->type = EVT_TYPE_EXECVE; e->syscall_id = syscall_id; e->retval = ret; - fill_current_ids(e); - - task = (struct task_struct *)bpf_get_current_task(); - e->start_boottime = BPF_CORE_READ(task, start_boottime); - parent = BPF_CORE_READ(task, real_parent); - if (parent) - e->ppid = BPF_CORE_READ(parent, tgid); - cred = BPF_CORE_READ(task, real_cred); - if (cred) { - e->uid = BPF_CORE_READ(cred, euid.val); - e->gid = BPF_CORE_READ(cred, egid.val); - } + fill_current_task(e); val = bpf_map_lookup_elem(&scratch, &key); if (val) { if (!e->syscall_id) e->syscall_id = (u32)val->arg1; - __builtin_memcpy(&e->filename, val->filename, sizeof(e->filename)); + copy_scratch(e, val); } bpf_map_delete_elem(&scratch, &key); diff --git a/internal/ebpf/c/exit.bpf.c b/internal/ebpf/c/exit.bpf.c index f5569f792..ead1dadfd 100644 --- a/internal/ebpf/c/exit.bpf.c +++ b/internal/ebpf/c/exit.bpf.c @@ -26,6 +26,8 @@ int BPF_PROG(handle_sched_process_exit, struct task_struct *task) */ if (task->pid != task->tgid) return 0; + if (!type_enabled(EVT_TYPE_EXIT)) + return 0; e = reserve_event(); if (!e) diff --git a/internal/ebpf/clone_bpfeb.go b/internal/ebpf/clone_bpfeb.go index 0c1de89c0..a99c432ca 100644 --- a/internal/ebpf/clone_bpfeb.go +++ b/internal/ebpf/clone_bpfeb.go @@ -14,10 +14,16 @@ import ( ) type cloneScratchValue struct { - _ structs.HostLayout - Arg0 uint64 - Arg1 uint64 - Filename [256]uint8 + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 } // loadClone returns the embedded CollectionSpec for clone. @@ -77,9 +83,11 @@ type cloneProgramSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type cloneMapSpecs struct { - DropCount *ebpf.MapSpec `ebpf:"drop_count"` - Events *ebpf.MapSpec `ebpf:"events"` - Scratch *ebpf.MapSpec `ebpf:"scratch"` + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` } // cloneVariableSpecs contains global variables before they are loaded into the kernel. @@ -108,16 +116,20 @@ func (o *cloneObjects) Close() error { // // It can be passed to loadCloneObjects or ebpf.CollectionSpec.LoadAndAssign. type cloneMaps struct { - DropCount *ebpf.Map `ebpf:"drop_count"` - Events *ebpf.Map `ebpf:"events"` - Scratch *ebpf.Map `ebpf:"scratch"` + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` } func (m *cloneMaps) Close() error { return _CloneClose( m.DropCount, + m.Enabled, m.Events, m.Scratch, + m.ScratchHeap, ) } diff --git a/internal/ebpf/clone_bpfeb.o b/internal/ebpf/clone_bpfeb.o index 40ba3e2869a1db31af38fa3c0306908130a6cd76..6e64435e0e43ef1428988face98b3da432c06ef1 100644 GIT binary patch literal 45216 zcmeI54RB-Ed7ck0ND$nWR#5a~*pa2HIF_;UYK7g^4=gJi=x1dpT1&LFQs`I-fF+>? zD=rC&7jBhzV@5(_E?&I&=V=?;n(W(W zT`=|}%N#c5l$g%ctRsAZdOjIs!~zYeX{yZ;c3VDF%!n7;p>9*RsGHOdb%VN2U8Am2 zSEz03GPOlrqBf}wYMol6R;eZGICYF#pysJLYL=RzhSW4QMNLvg(0;Q+-KK6)H>n-! z26dgfMqQ<@P}|gHYKyu=ZBiT5I<-cvQcKiv>KL^^%~NyKEHy(7scCA8nxu-D^CNCN zo==!i_(DnEjp2AZaDMsXj<6b^J9>OxxJzPTT<5L$^uZer%|E32@xSRbi6l0 zu?F=wvZCGo`i$?tCrf6Z*eAaH?&^P?x%gd4$M(nmJ!hCfR~p6bTQRA6h2d@{6$R5wnhf)qJP6+yY2C#GWC0o4QPG zQJ1JqYJ*y*)~Ho#i8@XlqZX)nYL1$vW~d=GO-)ggR1vhF^Td?dCT~$UsU7MDb)C9K zU8Sy2+tg)hi@HQ@QXAAdwMMN{OVn}d7_~snQ*+cTHA4-lX=;j^q>A|KdH8(ExN@p) zzL+>;ZV-R>dMyie;~%(SYm4jdJvrAaX#uOIOBU_G-J?sn;}I^y)g`+E6c`q^PVN#^t1 z;``ine7CcHt{)A~PnPV) zZ`tI?HU|88vMmQ}uam{=jlCYQPS|w=`Gpb>erqqMoTA@LVu#CHS#LCPF^E7$m`@Ld4s$}?vPvLP4Y5%i`*t}lUK+) zx}gk~hg2@)kKu-X`bBJLJ4$R}Yk5ASdY`Bd5sY z~^7kHg)>jhpTCq==lWD(&N$F5%BHhG)=W%3re zMcyPYk!`(@zDeGozd>Fn*U4+-8rjwh>8s=w`b*?Cd7QjV9wWEN1@aO(Pi~TP z-cOFiwj{^%Be6|thq^&sr>;>~sVmerb(z|tE>WA*2GyQNlvg8HsU_+-b&Oh|=BYVq zmYSi4)HF3kO;SbVxod~IP2HkyQajWQ>N<6ex=LN4wyDe17Ilf*q&BE^YK>Z@mZ;;@ zF=~ODr{<_xYK9t8)6^6-NfnXjZpVY?PTL>64;nmoPH~=?;yf{U?%c80%iy`w%}0ah zP8kk^=g!`9@Zh-<17h&p>7Mrn&z*zkPP<-~-E#z<6PL&x(ZO@4^n!`M)8|hAdCeOo zo6byp@vr&w$^@Sq6MSw=aQr6t+?e3~V1oC92|hO__}rM_b7O+fjS231B)H#^;66u! z`x^=FYb3azk>EZ?BDO3oJfDcQsBYXOxKELYHE6F>Yt$;WM0NKmiP#vqK+RKg)GRea z4XJ5ripu9CH^1R?x*caX+te-UCbdJ|psrKbsH@Z!YMZ)DZBdt~O=^Q$r`D)dYKb~d z9itYgd1{WDrDmuhHBC)XlT?wx=asfsY**N~!E+<$iNSNDyH2J!PYgbtf1%KMUXQwc}#&Jy+WegXhM<_grNlTvFQ_?%#-)(j8f4kRP+4;#s<&67X)|t@S z!+%LVf7;lP_fMR5@xb-~+wvm*E5xyw;qPfqn=xU2e?51>o=sz}Ix1Gg`+!T2a%z?{ z?)N?5D%qab>q27}=wbd|`of3Ai+pZ&TDHG>vftOY@fXvs-q)pA-D_?DF zJ@Ng1JATUcD#h;rKGfe2k1_xAzw_?CUyt80*`LVb`%Ct~{Z&>1V0V57zhhcwe>6qW zKO5vFa);a^Z<3eETjVx*o4i8aA+I{N!$>$F3fO-!ZxG2jTl$>~HsZ1(@frW64S`q5A~>Ie-!ZxVh}B(xaGtyL z@0ND`&fo7FzSHlIJ$SA>9e(`bQ@4L??4*?U|Jw20FWBoV?dmmxYfoMWzAx;)ac1HO z#@tnChM=MN#K=RU$#0Z@60cz&58)6mpGQK%It}AWV#y`Y0SL3yY*DTwPC9<#W_MBa! zT{dsF-QHvGj^k>|IP!bF7g0H+vws_*3Fh5_`BjGV(BELV0sT#e*PySuux;`0AdKq9 z^3bm`T!OCP6~f+t{!Ry#9=3%dg6#W#0z=3uG#7%flt( z{V-lQVlpn|T)<|Z5haW<7dsA>I)(^8480w%Ji;=+$zKy_Ap8kih>IubOXMU};#NE( zKDe*_S)jDj_BSpFiHh=K^Uy=k7jQv~?I>R2kmF9|Fv5079sdgLh=<5e+SI^HF34#4 zcm|LEG|R{HdEysQCaxP(Kv>2WtCKj(a0vSx!+C^XLii(iH4ttxyoRvc``+VK{?obp&ym7oe+)r*@*q;k@lanzhxfR*VE4+E}9|d zdE~bd@Zm4Qmd6Xn$XD=oKVBiizX#2`*T~nPVlTnIiiA=OWaI+$KD=;@_-hR{N3kdf13V>F5yS|{g2R(^K{AdU#9=(F5#E-9r{mR z!jCa=#eVu96@MUa#yvNwx{e|4y^Q+_i4?i+{dqu=18A@cce$VbkR9H*Q}cP73d3#&b*W)@7bc;DlX-}lMl6A%Bw ziQ=hGj-4nL&B9`>V$PQ9#mdaW+*D=WRGvp@-kdvj6!GQ#+|2ycnVHIDC|R7l>kcvF zy=$JHojDWAn|ZdfXr3=mpR1V3x!GEAV)h(T%umdf7bdDj=P1ve$r`*Jk+-ArcFa68 zT|P5!7Us^)Oq3TYlcrXlG|x;;S7yp*E8PITfc#mek6nOh~Aq=DK>9zj`ba&c zs}O^T^*U2Q|DT(i!x<~qrY4IEXQn1Ik}3Pd*Zo{=662=7?x;30IuzP^-9PqF@xDht ziKLet5cR1AgDm?_7HoT+tDehOr2pi=@6HYK+;v`TC&CdP$5}u}&d%(05;%s@5E-PA zW+TZhw}iLO&Y&mkDG@)$gdOsk6HlFTm-YiEAA9t~!Gqy>Gg@I8b5k>CPM>?GI9Hjk z%spSp+~NjD@2pi0;v`B@Hs6X(EW^f~6B#x3n%=9*y{q1Je>W$a$_|_P#hHoXGZmQ- zaA_3Flam?iJQN<0*t^D6rEgSK?3k+Dc6?##Y-N6-e707cnP+XD6?m_P zH#O<(GKQl$!cp|Y9H}wvk(k-IN+O0Y!{y@4E<5Jyi_*EvoPe`_+i?kWPdnN6?Lv9} zS;>AL)A7VYC|G3p)`L1b@k&=mVj0xfNSjT?UMI7Y60+%c*ReS>H;ZXzx>BCR zBy1fMbC{@S=4*4a^+khoI=4_fJv+M~XVcEo#!mCud+v7UuP*{>D%bV{k3D{(`1pzY z9?VEh(5}8ns9^Sn`I{H!T;vYofBW6^_PR*T-{t{iRL!q?UmUJgB5;W;@ z<%r*xV#BydZ8zZb8QXUfs7UBpgo+EYsu~x17FHPCd-k5A_hen=;N4ZEV#rh=E zDqNSoJvnx{`;%h^w}Jk41oe&HyBzCI8++Y%g}34s1#OcV)t@(6R-}rU0Zv!2HkBuf z=deCyZm|)%y=DpP6V{8F`GxTLSq$J?-5n2af~2jO==Zo?Vs7d_DcS?wh5Zs85b;Hm z$h~Conc2B#_vkX~x=f{T$Mi!gbm`2cI@YtRGS6Q+fvu?XMUzNAd!*>Oe1eH;Wm3-4 zL}h;7H@bLw;hEd#cY9=z$V55z_+uZ-?3sZ~)w|ajKc!yEH&LCMp2PsM6M=>BrI*5+ z{ao$rm%SmfQ%m>8z-HlAX^b9RnQo5nGiPPalnKR7nRFqZOTY!bFNM8w`xYV0L5$JA zILX?S+haO%i!_t%xnf6Fu3jM#BWfv~6|tcEWMxpX#e}$0b+?v?;kM&`^`Ofw8+37@ zfXm$=W-_?054v-~JD+>+#ZAw_@Fh3Qy~}l;?IrgZgl7U&XV?5@=LLB@x$FdY^5F+g zJo>~5a~Lt_&GghnWoBMB%(w?0x(8tM3KXyRKaJNmp5{LX#`Z+)*P#B{`52zuv0u~W zyRk=cIKn5eXCQk>KK{qR#J?*0Y8mI3boR)C#ecPluOhANXIXy0#Q#9zkE{4q z`X4p%H?iFjw46V90b4`Z-Uyb-OW4Z7{z9fYrLoN^qzX3Wzl*Y*SATb6bqj*Z_mrY@WZ zZ$tf2a2)?l6Vzmjq(uHh6D&x6wFt|3sDq_G-!bN8$q)GocMrBZ{sR*%iGRzbA3AJ; zSAPZ-2@Lx{4DviCOC6#j)$>r_j(GvNygY*LHTjkfB0S#tl@KvxSS`{ zfA};`ApOhT1m8mc3?Yv`KkGmI_f7Do_%q6%C4bEX-9-x@kN(9|=$~PuI7vQi;@9H*4QI$dYvO5KH^X_wg$PT2Rr0in-+=ZGHx)0D zUor7e@@M@=-g4X6!yEK_?nD^pcX%hl7!Sz8p1fZp zW8~AutRu6;IOETlcpab7BuWvM^lV@9WfOl%{5AT8#a}1?mWemS--xjI*&oRj6MtF! zOY{qizeWCri8qCpBP{i6lfPr)pSuRU5@BioD*1aRzJ&3SSc@>mb7I}`=v5~E3dUQ~ z^C=T=f%gf21s@^2YRm@C=e~^yW4_tfA^&4zzKzeA_H9NO<9**Y`QIAz7V_JlBLAf^ zZwqG}+xbz-lQjzCR1PV3-y+c`k&~RJ|MMo6lg|~Hk3_XcHsVLVCQtqo z6T9~|a3R7sfXBe7Yj^!AIX^t^sM7D(p9a~lKT9h9GW~x2*>L{u`on$;kj}0@Ta545 zAJoOxM;PsuU3lpaf5emYbNz{DoqwOSPx|$C#8m6gDX~d9t-57wW-`XlS_ zVEu8|)nNVk@mqgR$-G&{oXC$hWuDysl8NDCA~#QBPVTM`m^-8Mv0Z<}@7IUC8%Kd( zAI4Pt68(OCSaSaE`p_c7Zr6u4|YJ`uYTP3uU?mV^C_$k58;JFo)505nb@1MsmgtqEB?sD-p0PEzpw84 zxu4bb=iGHA`Pd`xxVz6kPWJo!)d*jO6g9AvkNu!OmHn~?{eEA6#c_9Ef0fLAeZ%Jm zq;$sy{oL2@elEa$efgWWvR^gi_w}W{!hT=BLH7Il%?M+kFx~>AzQZ@0Ah{3Rc6{Z2 z6I^i}crC)R?=SU3{3}0bf|R6}`gz7abG$>&o8VgUZ$?=BTjZxqkjB1g9Cfwng{6FH zkK{LFf*bJN_965_mt`M4B!AunAACkFm?mu@(3X4BWKljata}gGQp3Hso;X;I^eq&_rn-7mi7~^ZW zMCQJ^{~RMJjO%N-=KOx&e8e;N%}0g5g8uynCa7ZkjMgKJeg4sAfBvIO^#2nROk=Zm zwC#BGFY#ZPVtkFRIquFEDU4D1d{@p*1B&)1)}T1#+*$r#7HwY(kJ#_uyS7`d(%*vO z`}iZ@A#XZPB5yhDUhpEq8Z96&O1(UJjmQ*^Q%H}$XpXW|1!4-`|~ezNwhvP zmqhCW+T*}LmJcq}fi!3e^Z$|75 zZ^ho3wBP41ZQ~Kh=TNlA^4^Nt{Fk0x<`I9yf4^r>MCubv^z8e#d~B5arJh|rr|TW) zG<>$EkN6TS-Y#Jt@d^U8%jZD71NmUC*GF&+7TWvz?U#D?zJ7Z%Vs9YKBlt7|KK~VO zMZ4twhW5UG`;R?)U%&lc&)(N>pX%BB`t1un`>uY&XO#Mg{|YSLKGyTbf4*lAwtIFv z-lPrc2tEu0?S1_wdHVRZUZUV%MC^@-{l$oVC1S^%yGwa{U-N}>WKd`4Bjqn^d>RPz z2xNZn_DH|QF81tw{r0bW_P&1me9zw3Z;$lsef{?9J^QYHy9PdW1h}6vw2!X!oWVcp z*-f=)kI7ue__1Wq9{)zqJ`|lNzaFudBJpKhF&{f;(-l0>v&(&jKZ0j__TiGZ;y$A# zH_SbjkbK^34x#g}r`?Z-5b;k$>{G|O|6xi(@K zmLo)+Mv=dt53LclJm#N&1G}G>Xt(9cgMyz2e0)3Y|EzK z$UUlrJxg5KANTw;!g8&6o<>;aN6#-Id}D+^hp?Oz?|&6xS$92u72!K0yoRv!h4)K; zMR`;4c0b#0jKsIU%Z_rW;%61-6^|({DXuAQC|**$tXQshX)D_slj|kQaz3NHrC6^2 zh(AawPAm53g5?D{pdTvyyw+)~_DysCIzaYyl%;+=lB&yJDy52ckqqd2FypmIdVPH{o;xZpdTvyyw z+)~_DysCIzaYyl%;+=lppH!SyoKc)pTu?l&xT?6WxT(0MxUG0q@w(!U;w{BH{d`4I zaawUkaZYhT@wnou;=1Cd;+EpJ;#I}#iaUz86z}x&l}W{E#Tmsp#RbLVifiD=^UakF z#Y>8p6|X2>Q@o*gQ}K2`%TgDu&w-TUP;pjqUa_<{^1ODSs<^JWsko)Mt$0=Oy5f%F zEyX+id{t6$T5(2kPH{o;xZxw&yw-oR6^L0tZX~h}EImHFVx!F-TZ-F?R~4@-?kL_;ywlIuCl#j^ zXB6iY7Zi^xt}3o8ZYpjmZYy3@yso&TcuVn4KffobIITFNIH$OvcwBK+ab0m!aZ7Pq z@v7o=#T~_4ig)@som8AwoKc)pTu?l&xT?6WxT(0MxUG0q@w(!U;w{BH{rujf;8p?FjAc0a!l7|ri}DaE1Utm3@lF~udtHN_3Z zONy5juP9zqyrFng@peDUqgJ&2KbcY-D$Xj-D;`r^Qe0EqP`spgS@DYEHN_i>Hx+O9 z^9{gg`)^1o4i#q==M|4BE-9`lZYW+-ysUUd@tWcd#hZ$^`x#%Y>}&t~Q;I{yS;cw9 zV~R_PYl<6+mlQ86UQxWJcti1~;_ZHxNAc+SzflH6x4=KJ^@kzx`E1p*TGB~my zeB&#Me^;@59vzMUrs8ia{!?&df8oX-^z%(uD3tNl|Lanhd)r={kvb$ETw+#FD~y{edmrQvISixRmAWA&h%mYsk(*o zX>)jf@vK#zU*rEY*~$Cw&lPh9a<`K^og8y=#7VArgmIkSNj^qBLPfm0U0zNR&obg! zMLesBcbAKIr^uZ}E61E1adLO@2%S!mhh^kpHCMdDWntw`N5`BTfkb<*+ug_P2*2dW zv>kh_FIlfc_ed9wV7u^`ROzmwl{=l>;pCW;qfU-E$vQ!IFyT>2e@D^EQ72g^=niW| zms&-4SVebOMIJ{aF*NJ?#VO)jMtrM?pT!*T*KoxC9WseuI-}QSojv|%%5T4*Lz{#> z%Xej?M?MOX@K7%t`x?SOB)$DUNG}P#1mA<0e1Fq_uQ1=UOX!znU6&)oOXg_bPMUlpp^f?0b}dpaCC_c-~6y z&8HXN&3N0R{Lf^WB!o)&{(G4|J<1RMJM4RufAt!CI4;-z;J+fmUgeM3peEv5+{(H00@}Gcx zkMa*Q{bk$#7}D=m{uq36l<<=B<(^ZHX!(Bu-lP1FRBdb{-`DLse0ni{AFsX2Utub# zhm`NX2kg_QQ1qu@_vNdOejvy6{=5;p@r7ml?Ula31WQyezI;jgU3v44etn?h_&q_t z-S1nAHTEZX+oSz5H0)8ryR`p3miqf&u8BR$|An_){P0z#^AefA?VPe#`6Z?ok@DsL zACkkjU;6*!vlma=es5S;^zF40$&Xv_jMO*wpJ3Ge!+7WGE-)hJQPLcz!Z)^$DRhZAP?64iAJrE5V_6fJVr z4_2fSD)KNEO*>&rF=6Wf0Sy|Z>k_T#1{E!46$>DtD>iNQAL>>V+L~bk)&g1^4BF6Q z!eH3@o_o(F?>iFJZpk_n)rB9={oHeZoO|B=@!lon-#UBl(NM@!_28-hMBGWJYY-V( z(v;-ScPMWntJ;YsKBgihKS>`--7-0QW0N9Rv{tFfmu_qjL$0%2W4X$5h2=8KC6)^; z=UL9NoMkz~a+>87%Noln%M!~1%M8mtmc1-fER!q~EaNO=EPa+ymhCJfEJ>ih*EdNH z>eiM249m$^u5W1l%h%UQE*_;%rS|wr-MDdMbMcf$wI@z|eLdQ4*nVC~ni%^#bcGdv z$kN`AiI1E6BkxPTrap&uZd{o*1-8`hQ@YoC1?^Md@}F4DXjC7}sGBI3`xA3th5Z|{ zJ}&PaQtJ1p9FGg{yFAibm3p4iCySo(f6+@a8~+zQZ3* zo-8Wuf5;7!Uul1X*O*sXuCQEYxx{jTKrR`ljtXb_b^(L?Qn%lV^ zEAO^;u$}S62TZvG-9|3H%}A;T!+C@2iEuq1n|PZUpOaY?r<`0*`~SF}Q>LCnannDp zr{yQu(PHh$vK{cV?lG754}5IrepowgJrmEe9VPV^r#}&!?|)&BzCUcw{-0n^i*3i+ z*OMj`zs}C4eQS<*Vjl++;8qvaC}`~6XUBi@hLMNCVs<|W53k*zsXn3{eoPldLh?X zuCiQVxy*8jJ-oN+`6Bl#eh&DBe_z9U+Xf9B z$aRu~8T!ON#&YsyqnFPkyYFqg?`!lm!x%Z_T+Q0U^ad-dH?y&FuyXTHYRUnUGU&^rDeg9Hw_uR3``KdhT+dX%rS=0D_ z<_+&(eC~Uwq@JaE@jZ=R#}Cz1mH18gUgjFrBi>K0HL;u4M}2a_?|<(3)J3Xi_j{TD z+w&>*d;NPD=9X;Ce2+5d(_K*hU$dO-H|JnhpX)dIz&e2ScyjdnNih-Q^R#~cKE&7A z6N?Eg)qxX6PTXzEqn#9`pq$PDPBQD~k3+ulh+A={NpkUC`c&$`T}Ed0w-opu$bL^8 zHFh6rXM685?Z94r9+SOQX*-cWN;PEp`={)^K|egn^-q4@oUe;t~h2xL)o}>2P?C`@EwfnWtlxq8ux%MwmJNkRozk9-p$lH{QGcg!@$6Hd=6DkF_i_2SYPdejeI@%p$MHK6|0C`<37zb; z{SKs|8IuDM{L}T3KX|rke-I~ekw3@>HC*Hm8edDezRdo(3vpc;-{*V4Uqhud){?mX z9@o2YQTS(EWFPhKb&kV-dRS9&A8{HdM{p$(r!f%2RYUxsZp63?<-NO^BaoCgW*Pax zfpJc&8cfnQ(aoi-XwSPJ@@~jeXq3`AaFK#SCt@Gwe$YLB1N{h0=yEB7Pb1IIbGvQygDHoPJ8uZMxO^BH}%WCz1XN z;uu$64e>um{3PN_khY=YPW%ML_2gEHd}Z@IfwF(W{-&EJ$Jl+yif+(-ZhHw48-E#T z{0o4#FCzYKTt4#r8K)-^{|e%io))-U)e@a<^O>74{oEU@?U5D!`tYo{Eu0G zmh?Ob^d2j0eGGT#2u`oZ((AABnPfyY05Hhtl#-m~ens!WvfYB*a>=SM1I z#e7-ipGK^##(Pd6KYfmml#7ES`2nA*7{C8MO2%hBd1!QG(5DY|DL@(@|M43#@kEz_~@bKtJT6cis7l*QgWveKS<@3X(3Y)<>O2q+%f3N^uv>huKM#m~j zccGr9DOahgLUv?eDBox|or5Z`Dy8EvC6^rDC&hqPwCYpAw&7WBqfsB^2IiWmJD z6#kj_`tc40=j(xS+zjNdg4&yB7mgK22K&b^rpNN-{Mgg^*b$SZ(=QjF&5vG;9nE)i zq6#>Is=O=T;ZNc&^qkDR(;EKVBTF6i3p-`QdWD63fFN*FMUWKX#^49L|?3+2K-pq|DY_ zqBK29M#_3zARD}51_C0cU}FTJSOd6LtOZCu`=JYFb$IyPlTVz5iUwkFfZJ(04z*d7 zOOInc#3%{F6lwT4bH?vE!L^MS2TZyg*-)hIz(#2dbQI=ljFHG;+c345WK$j2Ynzg_ z)5ySGKX!&9b+?KKuODdN~jZlLjR@^_$cx7tgCu4L{;utk%r z)2BY`mQG@lpi4WoLwehaj$@u_H{kXu?K_I(DRv35bcJ>mWn!0*iUji+KXu|%+!zP# zmL{prPCpM-7b-A*u=!Czv;0tTep)+`%Pxz7$sSl1ZEvUtJuC}4dm{y9^c1oMyHU`ZFn~3A`<0nYpj>v5E06aNW7(ty1gh_5M6o;p{+q94m3`h|W--kD9O&V`UsE zSNx|(ajTA+jgj|C>MNGCCc7%vCbm=81NHr88wWT#w+KCQq%V$+U25Vot=hpTtl~ex zpzSLsbF^lQF;8z_KpSdwZV{@dNr{Ha7RVLy19X>i`EuEII^AEnc)Yw-LxY5tgx>Q{ zJ{D_Q0WC`UF~wOc{iAmA*iM%#6o&>dfb>?Z!M}Xjzss&lG{frKn^v2>1|x%(Dm}Xc z$#I(bP*q$N@|gm>O$AC&?%-02naMeV>9oQo#O|FdO*mT(7i+rjIO}ht5hoE=n#Y{_ zRsz@1`X+Ky67rJiW<{igV`uCd$SSk=v5J>FsLaD=EQUGTVf@Vd_vzEvx;y;KW(ZrA zah~>)c@oBR<#ub=Pq%oTd;HcV4HSq&9)`H^y7@!6ZtuQ8v2#B~_2REKBr z=Jh-n??>MIA?^FmQKWy`;VxvMGXkqWjrTV?Ke2oUOz%vVli)dr9|He_!;j#dZlA-C zf>EYk{&B?V41{c=dIp3V};&kp1 zao7htcJ~Rp`^awOA-h7~#qkGm9PuCEx~9D6i8F@7UCNs#hFzo&zgu~_eAO^CCe&E} znDPd0LedO#Re1#}Kgaw@<(1G6wZQzc@@A=DuwU2zP33*zAmXsU&hS+zYU~aFhf-fa ze?q?D793&BQeN0k{b{*NsTa_GD1i(1wwzYptMGFu#oVvFt2iSH^)ZhtZyB%Wp^VU% zn12UHJfyD*eU14m%3GoOrkMXqdEX|UX8tGTt&;sS4wHV?aM<>Lp7lRg-fQHKCDWhQ zdzG5M6TBhvZ?gUyN_`dQ4q^C@`rm4~-C_7MoCuZ=Cyl-hZ7sk*;aThBD+g?-ZD(-KK&w9%-hjD*fQVvso zwto-eE5rq(uXD*^Dqmy9+1zVryJeQSU#T^+XO4M9sqfteo_Cn)=l<>alv3;HZ_5(v ziE*scvdsJfj%#to+_K^@#zV^*^P*Be!aZnJ%->h)8gbNch~_s~uaWJ@#Q7p8^-@xw z=Ml`a6zsO^Q)CKD3!Tr!Og&Uihqz&_N4+Y^{4M2OI0jBROzUB<;rja5=PEO+>-mZU3h9hJj?A3dNSpSB^`ZwgGD)>sTyRc(-{lnbH zebwvX?)s?}xk}>G#Fm_e0fE`uSatuF||u zVm<1?g+R|oH+>lA2=r3P&qp_XO?lUD2J?Nd>-jyiu8*1bg!(xU-uLu5j6Da+Fxzt= z_>J`SfcHC{-<|_aGuv~ZS!R0i+GPE=VR}2x zQIJmUwS7i~E+D@>_u2Pv=nCo!BagO+81{vuhWGDPp^uQ>cbN1s=6ldp{N^bfcNqPr z=M<`MKk4!NHT&MA`JLdDqbGa%9H#m*hVh;e8j66c%>8gB<*zZ1s89v|4Np0Y`)ALY z_CEzz!@uDfqt|>Zc+SaB<>y&HsX~|Gtnf1HzmFq2_&>a6xIX^jFMXy;zF$#FVXtgm zftEXP7?jWPq0Ehq~m{@`vFb~##ki%KHPT-G?xSUF&2sK{iZWqoj(JK5W-jr@RH$H z9uG7(b$wJX0?kGD{_FAM+<%&Dx<0mt=9(_g;|bIx&_Lc!g+yB8MF@Ql37k&nh&F`I zHqzCCO+`O3k8S?&Y$M&f(MWG0UvUVxAj0*xtlCtPum@+KTLaRumdFso*{)3w*op6a zY>tUoqAVCQBd-L(^YSUvw1J8@>aHNZ~VBSi>(8ws2qu=9aNdcaPs`!;{T&VO&D z2kiWjlP>*v0J<#!c4F<5A#@cfoF1@~#+l8(&?pt6K5=@$&L1?=19radq)R)o_R0`? z6)Buf>#hx<4#aGJnqwS7ZHRDs$f@7^7bks6Cu3c#Rd=8 zxxt%3dIC;3%&Fun3O>?5g#2QDwbC5E)5%YHDYWA{=%f=<@G-wWfqKNe@K%t14(VcE zQ2kyQ>0*46ooWW@Vti_Q=ub_=IMMk#k;Wkw(m`@Py5F8R~7w@;bMP< zGl)C>qURWw+iGAcPirqi+w=IK@|J0QPeaP}T#3K%W1aTUh zRzHL|jWNrY5pQ>x?4dbi^)Dcf=gm5Q32{8X)p-eV>buRqB6v;kMv%4Jobn#o;<7I| zE;uQ;S8zr!-7m*q^u2t5$^Wi?PVj=@Wx=b0*9C6|ITR5b6&w?s5S$X+C%7QEDtJop zjNm!J3xbyguL@olycuNutmXJyKWn)h6ZsQ@Q-b>h7X()YPYIq8JSTWT@Uq}l!RvxI zgWM7k92FcBoDiH6+$XpoxGH!`@QmO&!3%@@A0RBZ8xXV}cWcQ-b>h7X()YPYIq8 zJSTWT@Uq}l!RvxIgM4d5a8z(ia6)iOaG&6U;Huy$!83yA1TP3)7Q8BWUGQd*-x3iV z6&w?s5S$X+C%7QEDtJopjNm!J3xbyguL@olycy)%B7&oWV}cWcQ-b>h7X()YPlKKF zsoQ1+&kJ4>ydro_@J5j7D+0H@gYANS!EwP!!M%brf=hyHf~N(~3Z56dBzQ&en&6Ef z>tkle-}qmV0{%GU3yup;3hou05nK{n6Fe<=R`9&wCBZ9#*930_nYK3f{vU1^>Yl>`s?O@L@@Q&)enK4`4hb? z_<6z9UpN1k1XF)q{Z+x#UswOS;A=sC>wdv^2<{Yo+HzOC=f0EoKahC$sqPcURaYfn zt*EZC{7~0J7ar{*X#778_J2b$f0Stdx|RMGy75P|RCLS#2GUTwg`B_5-L{mYcZ*SF z`j36LEmYUqB3u7P*OY7a7reGy{ZG7`x1|l#YX0+g)ipHq^f3KD7GwBdV(Ndk=~hYh zng27Tsrg3j7SavvP|DTguZJtye$`c;7}k<+rLuofdhVfz66u73c)*C0M)VlbZA2pd zfXQ+{iIZt9dW`5cB9T66vfO8~Xwj3_q8q~PK)u&JdTebwKy?3l0>v8rYEsV4pgY#x zL&hZ1-6xD~MxJEuVcFf#cN^oowS-E$ahnCu7oyyHQ?mDam`8K3LhLy#5}WvuHuji5$GoBVxZlPuf%?-%rnr6lhJR zwa50;mPfi*LVA<-y;bNC^!Mc^YCdgwkT-;nX6@7SDTO31YQGg11zR5Nhh79XY2W@_ zfPNl{v8y} z`aj2ol91GYdUm8>+eiQPZ;YC>-$T!z2yZ=SWc|}=U;n15S^MjzM06gK+NZfn!D-)1 qj@~$@{a({5_v6wG(+>Xk{uX&cZmCB6+_Z_eP(9Sgdst`NkN!7}!GaS2 diff --git a/internal/ebpf/clone_bpfel.go b/internal/ebpf/clone_bpfel.go index 36266195f..c6bf58999 100644 --- a/internal/ebpf/clone_bpfel.go +++ b/internal/ebpf/clone_bpfel.go @@ -14,10 +14,16 @@ import ( ) type cloneScratchValue struct { - _ structs.HostLayout - Arg0 uint64 - Arg1 uint64 - Filename [256]uint8 + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 } // loadClone returns the embedded CollectionSpec for clone. @@ -77,9 +83,11 @@ type cloneProgramSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type cloneMapSpecs struct { - DropCount *ebpf.MapSpec `ebpf:"drop_count"` - Events *ebpf.MapSpec `ebpf:"events"` - Scratch *ebpf.MapSpec `ebpf:"scratch"` + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` } // cloneVariableSpecs contains global variables before they are loaded into the kernel. @@ -108,16 +116,20 @@ func (o *cloneObjects) Close() error { // // It can be passed to loadCloneObjects or ebpf.CollectionSpec.LoadAndAssign. type cloneMaps struct { - DropCount *ebpf.Map `ebpf:"drop_count"` - Events *ebpf.Map `ebpf:"events"` - Scratch *ebpf.Map `ebpf:"scratch"` + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` } func (m *cloneMaps) Close() error { return _CloneClose( m.DropCount, + m.Enabled, m.Events, m.Scratch, + m.ScratchHeap, ) } diff --git a/internal/ebpf/clone_bpfel.o b/internal/ebpf/clone_bpfel.o index 9985e02c15cf0ad258cf5339cc58e33f6797ac08..f18f19b39a08bd07270e95c1fa797cf99351e0b2 100644 GIT binary patch literal 44832 zcmeI53vgrCecms@6&GBsB<@N}v9_FC#r6g(tyb7wJrGIRK#!H7Xf46g%7J4g02hQ7 zthgjXawSkur?4VtkXB7OsY7Et8k@Eo8_j4EPVHJ~;(9q_jf;*w4X5L}$W(3F8BNVL zZp`txDQ2pv`u)%O4tV${xR#n$Z9F)`i|_o-`*qK`_gq}?Z=XK%U}Rt*aAqL*@4*&1 z*C1H`@|HbmtjXYg2)QsiVrb#|sL@xg1o^-7DgGPOi4QghS{HBC)Xlhgz?PK{AR>KJu|8l?u*jx-nAYm>S`U8lCG zYt$BXmD;4PP#e@`YMr`Btx>DgGPOi4QghS{HBC)Xlhgz?PK{AR>KJu|8l@TuDkX9* zG!B=Bth1CWZ1GZxRdA8Z39+HmadqwcDiTUcVEw~*;)-Io~ zBKb0oS0ylv#QRMguKk`E+9%FI{xk2a{D*=+H|-$xmje7-+e|3WhH7Il@{q^?jK z)MaX&x=5{2tJE^JL@iQt)C@IEO;MB71T{{LQA6q&b%YwF2Gow}Pt>2fL0zY|scY00 zb(Pwru237)Won(eNUc$;)H1b1EmCvT3^h$nQIpgJHBOCDL+TiHgc_w9G2{CRSSv%! z=eI)Rk$>g}quuj$)SwA3^T#EuOJd~wxCTe%8Jn(Kukz2>2_rvrodgS>#S!Aj583iu z8VA7aMK2Vga^6V^B|WF_hu!5P<&YX)n!^XoHP>3b^m(h2j?7<@j+8{w`3)QkpSR~} zWi)L9N;;DMJ5J||Hl0I*ww{uX)bMiU5Pw&Wah4;`>jjA)O8o2b0kc~@Tsd7j3twhA z_8v6xBpoS{3-`{;WBW(a*^hKCS01U4%g2>xt6uEaFPLJP>z&=^VPq8?3VzoFTo8b% zj7smKzXojkRz?$K=`Hb38eJH$`BX+zmd9g8pBOOHAL56GE2GwZe86gcG-uow25df+ z(K6ZQQyHz2lSV6}HFAo)NKTXMXb z0yc{ALbmHJ#uqt9f3BOOb{)p}q<@ zE!V<8m2AtkFiMjY;=6w zu4`NKMbwPf{HS$*yVsF!{gU-YjLe5G;?UQ{m$+`e%Js7HoV^}i$d5?0ZS%g&m;U-y zg8xF%mT%!pHeUX@cXr*mP1V+3{2Z< zHmMubb!wZsMr~17sZHt%wLx8`)~SnB+pm>Um0YHls6}dynxUqtDQc3MpvI{&YDgWU zj!>i2fXex*#Cfc=f!4(OR9dHUJ}j+~Thvu*le$7}P?xE7>LRs9ty0U>617OpQ8Uyu zHAPKQ6Vy00Mh&TB)DdcwY6SPw>rI`^c{rgIDe)R7vIUn`! zD|_Fc_U|jreRTi6lI!(o-OL*c13Yg=m&rM!mC**dNM0eA$W3yYyh^T;TjUyfjl4*1 zlk4Pl@-lgY+#qj~SI8Z5lWeb>`uCN*t{%*W9D|KaD2Io=oMcwd;~_|0+L=6GM2<9%VSWABf0o74^JI<-w*qqeB4)FyR>+Mq5| z>(oVRjasFasU>QWnxkf@X=;j^q$a3wYK$6E$EYLJC^ewkd9RYQ^I;`t=gCTL-Ohu# zHg%2KqOMXoU*dgMDz!{4QH#_ZHA78PQ`96iL5)*m)Q~zx9ic|4 zM*7bi%_y*KA)j(T+<)GPeUbk2Mms+&ah_P}m_gFNFXVjGzc1|H7vhZQ_58E{yiuNq za=q@~7n*sr|Gbgc+x_Q_91pziA6+H$`hT=Z=6%5E3OQ#K`zYiLd6}Fh*U2gJA~{K} zkrU)9IZiGceYc-C_U{XAzf^LzKPoxf50zZW_Dilv%~3N{_Ir-~ont@e*uOdUYc9s{ zA$5#8LXA=bDzEqY_l4%VxBtAbe_tpAp?_b zEZ_f^=N13^?`7R=(sA!)9U3@d(|y;!5BHvKeZ;c$p4Iinz5kvS?}L|$Y!BWCFY!Kj ziTA-vDf;t1c!~GHOS}(WiqW6T5-!_iu@-#z|< zdLv+utj;tbe-&!}wLwKBSD z6z^@2TjUyfjl4*1lk4Pl@-lgY+#qj~SI8Z5lWYf0|NCJ5?}N#JsEn?giR7p4JtOxX zW3Ts$dc9}wzAy52zyI~X#qp`|!w;Rk^+V}1=EVB{?BjEPJ`jwtOr5=WHy6i` zko1x`Zo&a`HHzlSA{?=A_=|OWx=7ENh+VY|Zp)i>5|4;f_qYiXMCBdn+i90F-EHkV z>Lkltis9rHXLfE>R?Ek%yLm%4Y3*{&uqT9F>c~rNQ^za8NgM?nSK+AQn8a}a$108) z957cO!iQgG*Jp6vRxg(}+#~P72hFxH=0#-d5s|m)p2LB7d*Wy~SzWk<2Y-+DB=mP_ zuR=df`zrKh+NE$`fL+=$3HvLw=U|r=Cd5&N{hvBJGW;g&Fj492Zy9S4{aNU@t=;_E zOVrxs)70U8u$U_jq$S30SH7Zc+Ev;)i9^~|+Omp6+EvEsDvm$H0dw_@_+V1Pkq^kH zHQUg`Ta*5_UaEp{rqA~1F|i@aLYX+br$32?fO~r{&^fp9C{2L zf!ivMzrX==wVX$O-nW4N5(nzGCkd51f@4rIH^44^A?JYHA&Onb+$q>GOo9-{L$Kcp zP2xBMyPQK+93O!l#=Pk*@pEM9%OuL^@KZDh@Gz{_h7#ZDhYoM_IqGW!v1C0_?2R`PkMEvIe{^jfL~|aeN?t@CNt_+yaWDoI_%yzj#X;gs}e{4lyB)!(xF6aoj8x zm=MQ*K{^9W=d3uwNPaTrU~Df;PR|F~?7fdYcJIfsk3aOQr?Y22mOh=$2J;K0LU3Wc zoGnbx&rTNRg2FSf%>@@vo8z@!55rnwdTy%17{YVIg>C zeClE$n3$a@W%Dx^5o0btJ3gN;X06Bg?D;ruF3%sAj}!87GI(lg{QO)nKYMXHKR#cW z2ukAOYUJ4NP+!RuppB>K^vZhAa+3{zy za|?4)&%$hwpSf^hW;$zXPrEG!p)^}4Tqw=64$g6MBETOCjrMV^GFP0Loexa?yKaW^ z^W~s8K0Ps2*vdDXhgTt(FWriw(t z8$5>eZ#gAp`FQ--j)pOG)e++~IdSCf0I8T7-fFw^STPtzfbhA(>`eHJVf^l382teo za>-s8FJ-4@W}d!S$`+;y7h;E9mq}Y54G&8sBso0!R2aJv(T)Ve+3dNClT-7P)7cA! z3v-3}7@UuW@uT6~-g*=YDSmo^Gg!3>>4j-d%#JCDEh*+-k1+@Rg z*;({hwlq1Boj*T05tBsOCa&xkOA{D3+slq(BcY?ADc61J2ebD+@-am1IUvfD^8u3F z)>&}dt*^GcTtT*X4*YH3Ak7{9Vj2-1;VJY28ggcOw@%;~Mnz^MnH zGobqd({^Ghi0x_Evh%X42G;g8T;X6p<9D67D{c!1-yK;>nn%L|ypACO+YT-~64)&~ zycqs%EE3z#bjildIA+q1BL}!xyB(%juVg83uE)EsCp=dUez`dCTu&mbotJJoWflxf zDAFx%5ix1Hl?3kH3ksJ;*8vG_n`rW-1#?!oiw?7FAYopE_$P{UGbhVs6FH$$0dsMb zGBfEDCY^4zwk9O0+m89l%ol#sxfO5%>vr!IP==X=a#R1@#d8<1KFPESuilp@Cogw> zax%bWpt~GFdHrjblig`!x9hI(CS0PRZZcQ8ev@TIiijEDTmfs-_(b+1)~DEE6QJ8_ zhOjWYbem&+xlrmmCx7U(YQJsQCC^P|YMWcI0<*{64D zGUIibLg9+(Clsi6;!+&rv!gK2^p0Q(YW@5ulFlwMw!B<~e6cVgy_7G^&ACcv&&@w| z>)cKs86+}MrXPFsL$O^Gkg0m-I^(9)UVi!Fweh_BD0Ki zFAPi)cJamNkxAani`$&zGH1$!;(H;Sjlgw#TMTpNZd-&f2QkF<#Yxtt#4gj3U8EUp z*A?4axwbO#98pSXEYAhaCo6*rElvn4MYn5-INWl|tseBU%Lcu;P{7MxAjV=iuaDTi z;04V+_uyLQNcg-R=FZDDo@pg}8-#lT6lcf$X66OCJ-O@zcjlq{Pe1bb>EIYb&IMDG z`NH&^?3u|Pcqn(kFrVV_IyOd2*m!#hn>upO{X4jE#-A}K@p+fs2QqvoK9AWw3d5)I zd8^$sF#I8Wj(hwN_!}NS4E~|V9|qrO_X%JNf=6+D)Z@p%a{n)7GMfUh{{iex95!o~{{g9MbI|N-3*Rr{zdjgb;4kSpQ-nqQAAx`5 zwZWhc75`_U`;$SiOkRXuh0UxLsD%H0@qc|VXnH&ZZh`&u*XaKp=#f&ZKyQz_RAyR z)DZp<{P!gzK}ar3_y;0Eocu{}y7U1n*l3f(^#M2YlsfBE@&9fl7$bj6xQ+Ue{~h??>yaSl@h~_}cJ)h={~N+b)+0fh{PWn~`q}7UP*ve; zam?c@ z;h!Q;A^h+SgF#VoiTo)^9~;+o^6TLJ*r;An-1K-K{M#N&_;vDroJjj)IPVn82D_AB z{P)3s1T5p_4si4}{O&LL9C)aO@2@cYH26SyFi3j551b;uDE`k625FD?fivXKh<|l3 z$a%aETqLiE|BHh`$>V+CGWlEZ-&aHbdprb|J$R|l_uzl+OM}6p$NRx`@(C1c{%(D#lHK~U2$uAmS%yWzyY)rZ z1Mzq33#JCcm_p6^vH_LwZhhJGSk{*Se}4K=&QorEiPK-|6G44s?cTAzoK@=!*tKha zeL=hR*O&hK;;kqB_2s8*eZhPu_b~R+q@7Qn2OpWT^PoTfhnT9 z{qV!*=wSRwM*Teq(g&iO6ex!eYVcSFQH~!k)UtqqIJ*pk^|I0sR^FQh% zdv81D|F5d~AKah+`}4nC_w@Id?0!>!f61N?vfuPmx4(q>PM$$Lh--5(a=lyvU-8=3 zy!fZ!tKQg}7oGnY!#n>3Sk4<~lCTK7efA95?X$c6BVpNRFTr2(|32~?`oTa@W%xJY zFZ=2%WVf%5t!$IN+gERqA;zrXQ}TEF>KkOYuihcMeRa1F@2-2X6=~wT>t1Xvc3Jk- zu@z{_Yxd2fk)T1o5?{VNwBPQ-OMQg*gIo0fAo$=&q`MCHkjhM|W%Li(%@=ZACC~Vm_!r4#uzVl>d*oH} z5b7#M_Ilrqd}L4I-N;9-UEhs-WGz5<2FvItX>Zs5GPn6GbD7UFcM0EvxkHT1RldK> zO~R|}-zfX{GYlVBoK)kXOm_WW1N;47C%gW4H49qlHMsj+GX)vY9q?Gtp@?Pgv~LHH!*H{bkwrmx%W59zMk?c+>e zx7+9F-n-o}i74~iCjBeTGdSPtSLiN#o7xPTw?4MJ-fY5MwWHnACY`HxwA(*p`0Dm# zg6HV2+ii&My4~cv61ZwK^R}PVm*}qB?Qy1~+wIeI@7-?hTQXZYykOG5W=Fd{MEBn9 zc3>+3+TL&SJ+PzQ?lb8e*wJoZWB95{X^!r?-QF_e?7)uk_Ai;f9&eweyKc9KnZ9nf zzfbqx?Iv%wZa42W;jcAow(s*tbT9gjuy;)PuMO<4jBI&+%arrlAcOhVH{YPUtoy!s zj_xvF`$nE2;40T#Q~2&r(>WM7K4x~?@vlP&Wz9^&+EnAaY*-JlW7ZbLg>M`8t?{siYc?@*op%8LCD<7*)7|!hw^@JJ zOn=z#&?VuPVg&KO567a%N!Xhn-w(SRKN9`{9AjKpgp)YhTz?$9aVRY7zw2k`|9?CG z81fY3@^8J%_5XjJf6~<6)?fO!>aq0an#apZVr|HwUq7{_1b^}7U<_^TdE{O@?2 z1h+kw{(r+`DbJf8p8+4mAx6@dJn^+fV}#|9Fk-|m*S+}qpfSR-Doj~4{_@WE^B&7P z+An!5ee<%%H^csl$MQb&s>f0u*ItsJ@H!4LjyElK*#z?ZWquIj!iS3Eij#`digSuf zimQqj6)!7pdMssZDQ+v?P;A#3TR({(<@qLdImQ&n6ekp?6lW9{6_*v)6xS6u6gL&O z6t@*`DDEhB^If<8oZlVC6ekp?6lW9{6_*v)6xS6u6gL&O6t@*`DDEhh`$jRYzGI4G ziW7=cirsaJILlE~{$<5A#dXCE#ZAR6#cjnKiaUyBPfCn9%OQJEVjRn!lh3lpg%o-9LIS5;5eZ;r8uLwsJN`S zrns)Sp}47d&0|?_))j9m4!reD!jC8p6~`4P6{i*F6w98V7->Jruc~-a@v`C-#jA?f z6t64ZRBXQd@0Eu?n`z1?>vJrM4;U%0a6)lPaYk`baanOqab0mkaZ_li+D3tduLvd4a zOL1HAhT@Lm=zdjy#WBSR#VN%Z#YM$s#Wlrs#SO(x#Vy5c#T$w{ile;ocKto3IPS6B zpUAU9F%n)ltvIK+q`0bhQSq|k6~(KH*A%ZS-c)QB9k2XjvIvpoeoLM$ijn#WClsd? zXA~C|mlf9(*A+JuHx;)Ow-s+F?kF}tROi)ij9WRbzA?oK#VN%Z#YM$s#Wlrs#SO(x z#Vy5c#T$w{ilZZ_ykCFCF~teRDa9GZMa5;sHN|zs4aH5xEyZoc8;U!Mquh#i{XM2Q zrZ}NEr8uLwsJN`Srns)Sp}48IrMRtlLvcrORDKxE?|;QH#R?itCCSikpgCirb1e z6n7Ly`QxVD`YVnpPAE<(&L}P_E-S7nt}AXRZYpjmZY$nU+)*4I!$}U)t-s=!;)LRq z;*8>=; zRlKHnUGb*kfInU={VnwwQ5-6cD^4m-E6yn{DXuDBRJ^QsMe(ZQHO1?SHx-+kGWNHr zzucsG94d}0PAX0-&M7V_t}0$sysUUd@v7oA#p{YU72}6Yw$*n;ai}=1IH@?TIH$Oz zxT<(j@v`C-#jA?f6t64ZR2=X}pS$BC>qd;rud4WEk0s12iodS- zJBnXd`~$^%lA-L@okD9P<&SLl*eLyUhzwcUsn8z;;$?IuE%mc`i9~k zE8Zht2!WCMO8Dy(e?aj)9?N`iM)8x1rxZW0_$9?JD}F`s*A;(9@#~6zp!iM2`$JR$ z#*Mes!;hvv^4Q~NpZMs9ANl2n&IHHi3+4IX*lc0y*nMXoJSMR9tD)|$GX2#XMgIfXROQoK$`hQwVshAt8G8Sw)2P3Y`oomCT&Lv zch76r&!Lg~SXD-N3sLtXCn!CSy-u_^Gz} z@pHkkxrGZx*}sANX|6N(-IvHF0?3_KZntvM%5f`+>~V&%dOP_f^*9yb?zCxHML5F< zXB6R#BHSG|-0dQ_XN{b+a@@+D+2i!IiZl!(4Wo(dZ8ixbw_7@CNh#7DStGYwxy{N+D<`ZRw-UF4=3vAV692ZWkrP(pR?r;A z6-{as&0!SHVH9Z`m&nk#Z5OKuZy4c?B7EG=1b?;9e}nIX@GAh@68hm6E&he_GT& zF!)=$NMc9(<+yL{zQ4$1y73*~ zi1@wokH26;gbXP8%cEbN|9{2zUwY-g%zeY3RR8~s_`UK^Gyj~Izl78I--OJ2<=^CW zogSPnK9da&BXY0&S9;W6y3)mW{r?TP^~|5^?oX=!A0vLR{MUNaUmnHi{C|6w{MT-R zhZv4S3tRCWe-f5n`Nx0Lh6ou@no}MH==>jtTd(@B-C`sDr20RKV7>BBGyj}TCXoDP zNa_6l5^lZn-$>Yq?)$Qqw&FYf5iGs(Ut#`f29*3|YgFg|abzy}t7Z3MU3Xp9{{V+b*LTZOe$Ltx{Jx9CJB7pL&uyaMe*p?3xjX;> literal 29824 zcmeI4e{5UVb;qx0N1<#bmVZWdo%N+nRLZku%8C=#aa|^<6J_-hHBAepOF_{TZK~D} zPNW(1%JfiFt3EE=Sg&xoS+;e}N`{SMW-hHJ0_{7PFB6W4fhdT2=rb0f|nB+hx zZlg(aJ93WhX|gnWThz)=;qz7;V_R0QG2xO_Hnw-g^4Q*GkxL>MMP3oPAaY*hoXA;` zGa{!&PKlfpIU#afWJzRRWKLv{$ZnBcB0EJUMJ7bXMaD!1BAZ1viHwRgB3FOTaX53c zF#+V$BFCOtvFT$UU$*k{3(RHA%@Jc(uU)%#`76Skj9LEqwQJ34QZ8+FdX6`Wm`e`L z=SBMY7;Sd*qvs_X{enR=*Df`<0&D6=rCn(A653~A`A^`uTu(CQ!}VLN%zR|!UA&Dh1H$b`ta$e74Lq-$yHVv}%Gq^%zH ztV+ErB9}!jiCh$UMdX6Wd69D>XGPA4oEAAHa#E!4$GC7wWL{)WWRJ*hkzFD?MJ7ci zM8-wNL+SFDGYu%17}G5Te<{>JvOwDUKt|Cg@kE3Tg1n_NF>4|{k$JE-?|q{WVm z_(PTtSpGJAAgtF9Z>O(k^lM_r%{y#4)e-Y^~LqTKzl!l zL;JzYvaT=5dLDab$@<&T3|C3@yez@bhSygf`q7-TZ}df1j_ri6Z}8*J&p)#)a!KT( z$SWcjM9zzx6FDn#M&z`}DUp*RCq#~mEQ!pE%!%v~*)6h5WT(ia$b`ta$e74LWV6U7 zkx`LGq+Hi9JORe!X^~@px^Z3OlHa(lbz>BG9q$s^DKaTiu16Q+!ZDG7Nat^GT^Ggz zLm0bgg+1SIB5z#R?0~F$ecZUN+3WcKx9i&I9(O+I>k+T>48QHqTj;-gzS`@aug>6h zB*3^lEpqJRPOtAbHlDkZb_I=H+<5M?=h4RXY2&#I3t{8A%k2~VqR(9$*C%;y+AGgZ zd*!)luX}FVxIWRly61LYa5nY@b9Ow&F7}Arcz)tQ@P3w0i2nZldVZL9#JnHg*cWvB zu71C?_CDor_rBn$?91-H`5CMj?DI9d=c(P%lI1u5UgWCXCksDcTwP~B)A_$X*Diou z**`jM(>LCWbjmm+MZUHBNAxq{_aJ1RH|b~jiT8KdXAU6$PUKh%siM!cxP0knZL-O< zxb@`AXIi-Xj&=5|?02;|$^B;b-Xrh(%+V((?9F>#db%y zS`6NwIeB^5qS@wNADHwVj{SRy(LV`n!tOe;cZX{y)8hO=db_hTv!~hSOVgPmq=&1= z;W4RyZ2!udb$hScKluGeo;dVy*Gbo-xAyb-pVS#Q zV#a&}dkj40+)%Qi2yJyUWbDWXWwguAzQg4Rza0nnH4%J1N2mi;`oQYSWe~MhV<~Os zs(71EfczaCtS^aUKMsUj`6@(gAxGSsTt=&HL47_%DqX406RwBvMcQ47DBl?#kvMI- z&&AjDiOa~Xa1-S#Kbf2;SL5SShATAb;yfoe2Z*ze^6J|5aVt29Ba7n}9OF3XQMcom z$1#Kh;nv;w2;1!E49QhvDs#Xxk-hwMp(>9Fe6oq~?G>*i$gr7jq9+iSQ^b5$;z`Iq z!x7*Z$MHoR2vN?_mu%ET-vRj*7q{QaaA&7Yux;OtDA$SaM0h;pl4i$)TdLs42lU*lLDN`KHXU#yml*$ekhx@VxlRbx6!Hjeq zMt**d3>Ny%3}$-+RxxtV-Au-3Ik|sm@JzrDb2d9_&ZYZDvZi-Hhu#BhDt#We(XqZKv|5+cKtMI9nVU9t@-+t8&?6sQ=(` z+VThSj~xhN80}V@)Ysd3pJ~7-2N=@ey#XppoynprBg4b!dkb#+a>893IIO zgQ{^3Fxn_L_D9eo+QtzFi^ZwF-b#8L>2}o4Pz1-{8^l`; z2H!4>LvA6rqv; zZ4JgS3mu1L7UEFYH7(U~r22=3&W_||q$;c44OY1(TdLJGq_B(zGpW;Ao)B19sdR5| z%qkBA?aZA@of_%uFZK-?l6AzUOVyC8DJ?-#0MXH{6y;U z6ZgMAMoZAIs#;)R{Ah=1a2BjnBxECpf$QJpZ$;sD)4)ZSce7F5qRVw4V4rPEM{ts$ zOV?|Mdf$qT<2=?;1b{4TzkyjPtVrP+x1os&~diZGE83*l}CRyi!APZF+ zDsbcA^P__G@*VP^#IYPaUODyP7HsxP z3d-0s!xwBvL2p7Yd~$8iOcR*PJGsKhsR6i6IuNL8U&T7EcNy#8J%hh$!MgAzuA_W{ ztao`1_Tx&1zR@fAk>Ci>M6C5wS$N@eZ)yadIM!k_l+Q;?@Wk+pgN0&nZU|Gg-(48x zTFJh`rLA*SmD<$hG&}<3>rIUT2lg(ueglJQS59-RW{olD zY8SAEI$gL3>shBnMdb@*a@k(aQYKp{_)e!z6;B^3tkrOl&?R&|{@BB@bt|A#vbQNA zUm5K8&ZCwtlk4m6#R9UIVhh3f^T8e7EAb2~U*4?RT|%%j=&J15U6mZ?nGaPltU^9l zK(0PjC78R~mEz2l9M$RcunBeb&g4f!ml`Ry?sX^Re=CiI5@Dsg%_(0>Ff{aUDmRmm zm!><9$b^H(y$=+XbAF-{cL$Zb*^I?-&bGR7mdo<7W4I!>2It)p_9{1cc9h(mFzzdB z`L18gd7XUZ!4r>u=!9v*ZB@ba_hqt!g{tHV3(vII^W9+PC4UP?BQ`d;pW(S4925Q*=x>XIA-$d(A^au} z`G0Y2Mdy;jJ1_=Y@lej+c~I{|PWUe9BT4K_2-Cg@?BUq?=W3Rl0UyH8GrZm809<8v zx3U`?7}xF(kiUN1?SuRn@vGzub*2Y;avL6W>nH0>PWV0K?mANvhOl8ApUnR-^jmuC z%#?76`O&Ev;ZK1h`8qQv{33Z8_MS`Z~Q9k7v=^>(=_ZC zz5~4FIgGoMKL+0Va-HcEJ_X)3UuU|6KLc)fwa#=4e~J19^k4W})L%jWh5wfPTAj%Y z|0{UMBE}=c4d8KM-@i%WpCNzb^*S>RW`Ev|J%D%2V$Vh8Uljc-(C>K(ze7^I65?IZ zH)C8le!jf`%=)=;y%mEUSDX-TgTDS{W4eXk2fk(An7m@nBkQAnEA&&s{osaIu-~M3 zUifpYe*yLjzYcDE6_bx~V11sWA>IOgEX2$o7jDFEN#hmlTPyAg@fPTNgzrKA=}r&Kua{3Goi_yfA-b6Zxqz zOTs@QU&Zgtgl8~k5uC5|fjnm!I4(!PbQVk_m%#O%?mY*20(@UrUD^Mz977z3*GHgF z3V#pz4?cnOAjJE?UBceKb%&V#tw-4Vw;r_3`k9~pEidf-TS?gaH}AhtjSbVH_x^2O znD#|r4}Jd{|JJYk8`zJFwHrn^qjqmsJvb2F@NXObZNtC)n*AHjSKh zten^0|AfzL`kw$LnBV&oxXSW*PXCh>_WlPh&+1)E#^Bb&viCRMAF=%i+ULFG8h`U# z#V-2i035cfal_wi+)v53}-=KXyo38OU zc>cickM&d5-+(v#jeDNicz)Y>e*2Aoe#807Jtlrngn|C%qu`tHobS);Z-Z~SS~;)1 z-aof^eGKLK9PjsGaI0b2@5A&6`+bye1`X7CWZO@&V86^VZRSEEA00T4B8Iw z!$dR$Y{XoR-yLjFOo)&#C^pSYP%nLsczAX_k3&P(4 z*B^_N_gOG3Hmr*NHRzkV0CJtT`x;L~OjP(kSsyyn6yh!5X5ofL=%0$1AjDh1G2uI* zZ%1eSJ`K46?C&ecZwDts`QHid3~@cUJH)K7N7(Lz^kck)?LG(wb6nW&gA^lXBE*g0 zN#Q5a{_UkmdEbY;9Xu1tzZ3aqg~y=ZbROd?Z1+7TB4$b0uYX?WxTlG2Au|if?@-OV z@5Pu^;hzh$@6_MN%m}odoD*hS{I1pag`2R)LaxW23j_BSeiiNTnc`Q`4(}y?746Ws z@%v&pU8}}FrnplvmcPv(!MVYJ&Y6q&c`N$%r(L$Ba1Vn`yuS)H-EXu7Y-*ReJ-4c_&X(?>p2{* z!LPBNZdK1_o9`wwr_z~wlYE_w@o?Bwz8kKjzHZxXSYzjLN!ND1UDCCktJcnjHFjS0 z_0+UeCb?pcjcu~ujH^z3&DL|v8awZmbZzG@N!ND%m$mbjHFo~g*HhEZZPmsIZL;6& ztyaBi>)F1>&bXv&JMEV$QIEFs$JWm6YwUc(*HhEZoz=#GUbgvnTAv$Mwn{p${oznA z>5EoYH2-exK|LzH(XPXt_8L~nZOkiD5B+gCdj0Mu<85;xC=i2cY!-hWxiHqNPd8Jx8v8CKJYuD4BW$FptuW%A1Cs= zag5_&AoKn)C+oxKUr;pH$2} z+pxYzaVf+cuL;Hee53u;&nW$z;swQvikB6yDvq)d1m9k>;+W!u;!efgigSufiYF9L zDV|Y0r+7i}qT*%6tBQG_Rn>pRyw3{j`3w{0PQ`p?3F~u;`OFg5Pbi*JJfnC{@q*$- z#mkCU6-PPo2<7=#98;W7+^N{#-!Yj(om2Xf;t9o5if0thDPB;#sCZfNs$zc~V>0b+ zmg}bHnBs)ut`O7T^(f9O9#=f6cv|tS;(5ha6fY@WQEVTwU?=-Wdz(W3og65RD^4oz z4l(_^e|};8@tooX#fyrU6|X9ea*`3s{Z|}QoKW1UxLa{fF~92(Zf`>Il;Ro1bBY%fFDhPE zys9|LMTSuBzv7tUgyK%c-HLOHONu8HPbr>JJg0a;@uK2o#jA>=*#D^Nzv6g^d4IW^ikB6yDvrvd59gcZn-#|tClq%o?pB;rTv9xt zcuMh%;yJ|&iWe0xD_&I`ZA7OL%KcXyQ=CxTskmElPH{=`gyJd1Gm7UFFDPDAysUUt zaa0~W%l%gzQ=CxTskmElPH{=`gyJd1Gm7UFFDPDAysUUtvHfvuc>cNh8RD4YgyK%c z-HLOHONu8HPluS#ce9G;6<<-jq(I@2tN`wlX;Xy);!efgigSufiYF9LDV|Y0r+7i} zqT*%6tBRwtMOE&<;+W!u;!efgigSufiYF9LDV|Y0r+7i}qT*%6tBRxY&mzkGR~%EE zP~54wTX9ZtN%4f@DaA92=M*m}UR1oScvW$eY(=vF+#d=Q#}y|PcPZ{soL4-qcvA7S z;#tM>imxbMQoN$rZWN=RzQ0Y}I1X{3IIcLUxJz-5;=JN<#gmGs70)W3SA0eBlHwJ` zev7%>f7x>O94L+}PAcwF+@mJVe_`Ko^il0;bQi%B|@`~cu6#r21PZe+GMGb-dWqtcX%uB%m#m5w%RQ#0U ze#M^*F{7VT{8hy-DSk!qYl`0pG5yt5#f{BKMDX*wPw@f8#}uDb{FLH;#pe}YQ2dABB>-~b&mn;9odHuGmfmSU) z|2A#?{pSYwe;kJKUsB3HTMSo8``rHwS=W504i~ZwU8hu7k6+Ig)2B>ZVRXPsnM&h- zQF-!#2NJ1-fwQiTp+f89aY6D{aUA7ID_q2dk2k4q}mTV+nhWi+##~PqHlM`w_6FlmC##>dgAWv ze)FH-!FwIq+OMkYu8%w1rIhj-sGOI~L$*uH>B(}eIzoRG4lknc^~(GATE2{I%Xu^} zpfLS;vYg@~u`Va&Hs9<6vMav4PtUK@zJDL)_xW9ImGYkPvyPhWC#3zPWMuo?QrGQ2 zkBeum{x8XZUZFA+e0iVrMU=1A|5A`sKSHEd`?(tJ^AX6G_v7*?8fW{;&6#EXQ$z&W7IT14<_(7y zK&|qtQeKupxrlGyCwyPp_v~dSzu<##UY^?=x%)XEr~F5huhsvV8vW-jqHo{#pXY?` z6YG8DFh7lXRqo3it!+*+M471u5u&{NVh6R{56qt$?gEn-SfOdnh6|Mg0 z=6!$Xd=Gi~v*flbunmO{eEB_}-|xK7x%b?Ab^YPdvyVrk5z`70^L@lahL#7B^BGHN z{=UjY=AJWsLUW%sanY;u@@q_C`TBQ7ubq%zV-5wzT)%$(yZtt`HQAq!xoG5C&PATd zxw^ZJ`Jh-XEm(W-0`*EMnh*;#p!QR3$*|jYK*fx7kzMKzb(^|H-K1_%*QsmNRq6_L znYu(>q%KgK)Ol)yTA`MxIqEodjGCdQsVQobnxF>Merg{zP8C7_%`SC^x=r1pZc;a> z>(n*sDs_drOkJWbQWvOA>O8eUtx!wU9Ce&JM$J&u)D$&IO;7`BKedkWw$Qx zteC^X*Iq5ZSdTWfNnQo$?6Y&#a@*BG77jc>GZHR=4!_sgO4-Ofwl4}QG% z-)XLYTT1l(|9f7sy3O@%v0o`iE7TG-M|JD1933NPsA;NOZ{?_MG0I8M9#GwSD@Xgt zajFRF<@Kf<*&%OJx2T)c4eB~|jk-!*p)OOGsEgDEYLhxoZBQ%J5;aF1r;brG)HF3k zO;QuofZ9*(qsFNsa=z_Scc|OcE$Sw9gSt*#qpng{sLRwP>LPW4+N91?8`KK5M9oph zsbka(HBC)Xlhgz?p!QSysBx-@zkYOI$r)Eq$pm6ATr#f{_3O2e7iy(Hdd;>L=iO_Z z{gN%+1TQ#yaP1S$?yoyMk8Z>D-PVutyCg*+XYLSvL4J%03OQrjtFC(`cV3!4mgDu! zz8!35(q9*E8?xn@Yp-=G*H7%{yDTTpa-N%etvipe&)vKqzMa0Dxfj`vin%@1pSVx=KWLAgAGYU~AJU#KUypB3 zs9$bgJMXXdyH3kK_GxMVT%Q}y{4uv4p9!$}Az+;B`kV`da31GP%IXD^6h%Hej_#0$bU*61<)1vS<$+jNw0(p%7 zMe;a#iJT)ZlS||ka)rD~Zjjf=^W=4Mle|G*Aa9Zv$y?+l@-}&yyhC0g?~+#?+v$+; zStG~kUnlpGH^}|uO>#iqA}7e(@=G$TmuSYN=RTZ|rpY^^@TbVz zxd)z1Y+jNs_b>gKl;Nt07lH;<)A zf*ero_@n$ja-1r1@Em&Z9BS8r|Ka`2!E@-rbEv!Cl-+#>o}bgQMxgF`Q;xXnO_|r5 zawMSNU2n>~-jpNmdQ;|o%fWM~4Aa4L=)rTStb@Itiw~YdF)#F58q@a^BT=XJkp*CDh~jw6?a-5V4WLp0*fe$xdF#3x1uNha@_e-1~tPltGb!nBEaGTxBn^F;@f>soM*#ag^h++@EAc<$n8`SNjqx`k z{#P775o-?h;q|bgxh@4F_$OuCwZp%b*m0F{PUDbqm9d=1A>%6RbPdNhIIedgZVTgh zyal}1da-L*)%Rvei*U1f^!5EC>w7EGhwDp70ipg$Gkl-?T9ZDD(cASJx*P5^4!wqs z!?uRw-&nW&bs${#z2NVmQ0ZG5E?Mt`I1nPTE@UoXi%2;V$C`_rf=U|$#Gizo#F0iE z*9|j-V;=E$+e%zI$)6*~p^~=f8R@|t{Z9g=pLV=)LP%277pXx9pfBKr7TYimaY(oy zCHxNiA#MB#`VsqMlqY?f#~~+Vxc>W4&zD*M18CyEpw3<-%OL(AP&TLM`-}&$|A6r{ zE??58x8ayaT+T6xuOTjD`;e>Zkc{=)5l_P|5eLg*cwCIM+bNn7ed|c)sjRPT$ew))c0>q`xv^(OGSL`|1Pa~sL z1BuJJcoYXh{GGN!dtHb>tg^u%YG;zZnm2{w$3pRY+VLX=lq3C?ApMqr`VJkJ&B})I zblqgLkDfdC=zFtIKl$uv_WXOtMzdK{pQ{wjRKAfdPS>mDV$BqvN33RMM~0DJerKm^ zPoHNhoCufUhqB>K_7G`FVqgJTq>xEL*Ir7y@ zNrRsu`5Bg<5p!`ef2n5b)!FGnzFwR#mHdRcSe`6S=ckIT2-=a7np5qH3#EM37wwbD$rZfyTsHcN$i!<6#V6O+Yuz1d=;Sa`l@>XnmdOCdiwS(Ausly??R zx>SP~Di;R}rng$G&sL`cmL)!yK9MNQOxNmxj6-nZIO@Cil(g-A$qx(!2~3?cl_!or zYzik`A5OaI9W0q%BnVzCR%e1og5<-d7xRM{s?1L1E7{4Jnai`4Y;m$Ul{n_7P{wv3 zI3}4;WN-Omkhlxkj+@?W_QGs=vRS?7cD7cmW^47Tlzs0hzd%}5bXboM1U`Y(I?bL{ zsxudg+0N1?YIRozeo;M}f*fcd8jtp1wFg+*EaOrUt75iV#X8DX$`jf8rSe2VvT>UH z2+md}u$ntZ5QB$;1_HEoAUHktc=pk!-ixezF4IQ2Zct>$5`xVyk{eb~$mg5Vv0~s) z*d>BOZ&)6^Gk%C}n0%f~Xu6y%p^hTUv17rBnQ1?J;>XIgr(R<8J?GseW^{b?%zH+U z9}ljW-Xh1aTAsdiVfG?s0(1I&F>%bT%GO+-C}IMWelG4R+RU$v7PZewR z{8S}7U1Mu5i!Ce5WV&V-29jaSG3Q8t2ug>gz4&2mgLBGA!mP#+K3R(830Ac4O0?~g zRQ4iZPcJcHp~8lrQ>TKFVU{*qo^WC)wDglWI`ltfzdPPT(v&(|(X@i^mW3-v%y&VGrXIIfEmuZ(pll|hS*^w|{U)F{kM z6mdS~C$p8joV(^ybp{u>NnBa59au-9iY;ThhKodF&R|lj_3VY2nYv7;-7k#YaFP!_ z=q9iu0a_~O^O<*@8_k{@ee|(}v;_U?NQ4F^9~v>et_AyK3ANELTbKSgG7p(vSv(at z8=W<}R0DzZ+17MF&JuL#X7z~Q*J9&1OYJaV`ivbri4-Mv8L@0#_IKlAmtlp${U#q8 zekkc02k#A4N|^&e5w1ZL;KsqHM*;h#hl}Zdgzc&GRF`VxlH+zMj9L2}!})JVv28*9 z_EbS8w>!C&jLkF&m$%Ag2L-_@yO*~PwXDM-tDIgg?MTQv0;}CM;j*_I(i9)}>8!(L zZ*PLEuVsM0;}TV<%-Pe)?|OER*<+WK%6MyK&$62qGOS7gb3YFiGi=N8yWRxu81~-v zWSL1Sf9dv`Q+hP5dS(3-0Mev73%NVNASe(Hz9ry z&l_J3@hF}ZU~8p+0&zSm*)rsv3_|2(9DicWwmiE@`JNvI<9Rd+iQaBvFU#{E+9Cc{ zz;l-M-(_N}$SdDTT7KHZz9Q*!Dt(3i51QClkubXC{LxR~u@R3!(PjFVOe}-^(G~jt z5RYwlgV*T)PZJvx|CZy}JtlS@^+$I?>G9qqy6gOgL7uLp{ZT0o{+Q%}E%va9eG~P^ z`a+EIV}VMap#Or2eXAG#G3U4Ahl1=}yxUbK^~C-aBQNhHP*02fdkOL5x%d63*S?$Z zEaQgf)Q)jZyL!9cXrh%v@Q;&!!9?qlzZ7CT(wU0O-}OObCZ)W2Ro)8If6PP|#J@$p zYN9U*ZOkk5xkR( z?U27?q8pf}F4S%7ziy(hV0^mb%Fp)q++m_$6@Q@o>`%`lCi-MOU zGSP3M{atDLg~gv?dF+4JIQ<{S5=O(iO5`tKNn(9;EvocOjt@O$Vz=NKzl-D7;?ki0&X=43&AJCmroDMO{>&}tCXJW5If4k=u zHyy{{U}Axk&-TYJn%G+~zuoKfd)^2!=C^w%#FC!vkN<{=CBQv>^n30PG4l5$+iHw|uLu2;^D!=r^RK7mxEHTwRx#f_6<1&Hkcl;L zUFm6%pD?ixN&OrT>lbd){{a)5m-GuE7XKo-W?~-||5Av>zfArW6Ke{ugjo8sO8!j~ z`y}4)_pF6j#%rDYMH5@Vdg|E-G1h<2Ci!no>?N$vIQj5vOl%Q+c+2(waMl>Pj$?@I z_#FP2F|P>sJGR$9NiTa+Xumo94O}vg!xm>g;e-7KCx;u4*8Y@m^AJ<}jU7K3XW84; zev?%DP4ZyBIoNN;-8$+y*l!N@o1gOiCW-5!Jmc7VaqNX%4R8v7)A)HPLf0C8gquRR zm%tum`Ohty?hN_g$=I9aZ&L9bd6O)51bYqsU#Q2`w%;$FY~m+Zn-gjJJ1;{})5{c5-9?zYfd4Vf=BwtwR*|gsty1LgOEizvue&;qm{6 zkUc#9&$sOzR$(j`9C&+ukw$xG(qR$i1}>ku}6vzTCsM!hhi= z+^=&QV>v`VhY7&_t_^;j2cR#6>`CV~V*d-2_1D?lhkaoWbN5o+a?KE$0vq>ZV)(|%l z5BpcZGB3<;`{m&t;SipCjkMo$fVi~Z^8n&9UY_N; zA>-qD4Dl0fmhUy}*wAnAU4!Wf`OhMb>GAo^`w^GFzx(tR#AQ%D&nsR~yrg(V@tWcd z#aoJZI@!)|s6CNB)<@W%Q9Q1=q`0BDsd!QGvf@?6>xwrOZ!6yI~c_QruA7RJ^EoS@Ejkb;X;C zw-xVpvc1m@t>^B3K*DcIH5SDIHP!6aY=DQaZ~Z4;$_9Fiq{oyD&AJS+sU`a756JnC{8Ip4-VZg+&ZDS zuK1&hUsC)z#a{u3uD7?oqWGJNzoYmEoqY5b&-V-tkKC6Wx_98D8LSr@bu(BkP7a@GAK{N={nyB5aB}kb zDfzgtif^bpDr>iM@0vpXecHHpzEBHWU!?fYp$GB(Ts?om4A$nRta3b!|B&VE>C+?G zw;9NglacID%AwPd?1O^CPKKN$ogl4s4pE1*4@lai6L>AcYjrq#zw=rd$=>Ixv4XTj zrz6=B=e07D9TpmPGUO!b1UZLXQs_?}B2S=<*xu!w!>b+%(FdHie(eJ~N#dU691Mqa z7(#LXo&lza{NJe`l0TM1nsAWo1w%y6OaDG9?X6Bv%XLRWfJ6G?`|0z`ebztW*r)#3 z5_|~qeybz+{9+8hk4$%@GG~0c9PCoRe_!YAQhx)-KJ_16hYul^!%sN){9==9+dln2 zQ(~q7D)rkNZK%&L^}ij*KK0+8fDhrO{g-R;e)TtPc4Kl-so$py)gK9e^X2D<*-;%MfUw}C_3P`0A@V-?X?Z##uitTa`(JmM+waL>j{G8ie81A2 z>CSAEb5QBO?}x8n#@~LB0No=b*PQX_>y$He{@6L)r~bz>F5j(Ej?|CuC2R=S|D~Dh qXYIJn)7h4DKApUy4~NirMcxHRH0*50Pi?uleV-wD?xN3^+yCE@1YDv3 literal 16456 zcmeI2ZER%MS;x;EkL~divTojROWNEt?J{1x-tjswlTB-8H|x|6=BT!F)DIC3MYK~8c&ec( z!_Rw_v*@dSqQzHLg5>Avq14?=Yq$3)a8su$we;27d&H0}mbX~$vfN?0&9cdIljR1> zb(U)^S6QyGY_MErS!Y>hnP-`0In8p4ZXLP571Mo-hQQS-+pKRrc30gt;b2W`?<1p+HkK+dbjtt z&NHWUzSaQphuzJLAs(mLO-}qRmUbK$UpM1=U_4ih;(>Bqig%`NqF!>G?^m|68r6$g zb%H{1uqqp8LxucGx|!87vgU*@3P!sxy`c4a+Bo-%XOA(ELT~suxzkg zW?5%hW|?Q1WjW1qisb~$49hgj6w4$_m*oJt0w-r*Nx=yJ-L)O`v%I7Q%WwY?jw1F9#|i_tkU*w zJ)l{y2ZSj{(Z%SmuKuP%PT%+DoX>Hgz#`v1q} zoHym%pEB*^a^mk|N8H-svmNMX-IJW(J^AXL+hOgr%v3t&=HOTO73 zpuf+o=QntdS&uik#jMv2_!hHE61>Z-?Fa8L>u~~aGwXE)ZZeag{F{c29pDY-Jx*U| zZZWSh-(p^6)^;HO3iA%9H<-7XmzkT)b!Ke`@|T%6I6cq2&YWdlW1ePSWu9VQVV+=a zFlU&TnbXX5<`i?8Imw)7cA2xx1I*LR{mfG&#d~G{i22lI_Y+?KcHjHlf%lh9z7O;&fq@%g5p)~F|NPFiKT!cy-8h+k&b>mIDvJEUIckXcUG>l&=r zGvoxvXIQ3LrdTFfx-17+_Onc|Bw^S2@%iTXd_&XWu=CdO`34<>^O9aiI3Mg#M}hTv z0&g?xbp>uRlQ=%#^z*&RS9R_WvrqYEze9hS{mM7{9@r&4+&8i$!Dj#R)ikr&$9%IN zzSrlQOACI{{rP8KIQxmINviL?cK`Cb`uwfiq*M=zC*OCG>d^;yrMeJw%qd;PAzezN zNOq(~cf+5C@3wjfyYRLQD)c}e)}_o;2KD3n;cfJX5blQ0z@NSw54c`N_9}jB^9ef zzZ<*;=v+LF8!gy=-6L&-`~+W(B~NQ#0~EA zr>I0RCom?7|KjwIQ+gLYjI(V+mcAig13!l(*xC0eCahKE>h)ZIfb+VLAMS+v&O@Kt zM=qnE+LZ1VZLr!E=4;CHE?mBR;U(|+XI~!oUU+G0-1Agzu^gy5zwQO|wMrqVs^B_8 zRkbjB4*K+5n6DOQ=YtuSidcC3QHsX19bGKV&${$b*MdcL-7hW#YNk>ud%4mAa#V8_ zzn05;Cc&@FrW76{>T01F%=>eJT1Zog=}v*UykD`|RITFY0#6&|Rs0)Xb+JmO1{IYn z&CQkOJ>38fUoHBxRhv+*1i@Un#%8caxiF*f2Mf?d+pucBRH-T5gm#>!T&=G1{`^ca z=+x^4^&odWP_^<|*pl;$#VQ4iQ8qDm)@Ti1DPJAVslG~3Td2&tTo$Dn{bVv%ny=Pe zYO;HJ5cQoIBinu<^@~Gp61{Jt3NwRGsXp|&i!OFQ?xIw0HbB!BDiw5whgNyD*}_bc z)T*`0LaydU`rSqEBj3_zkdELmjR2S%;1y;NU%2Wf?Vt>*zCNm?Tq#`%yh`BDcnj5_ z;-T#1DJsA!4!PCBYeDI1G8{QLMlp22f90V)=ZhRWG7vOJ&rV*!G#&F=*S7I?IJC`0QB6XD9mrf;W0Mmj-KPv778;aUM>kFcy>h~ zH&zHTb1}wBXxKVTDJI$!$K~3pWa%_DFzjc>DA4X#=0WP*nqR#}#q(+;q}4+!^YoxB zj#8V#Y+m{IdpEZO>^!k|`a z-j!0RM#HJMM5XuD)cGg$$VU}mDXqPypSwKnT^_%1DM^-~U6E2?VCwv+>N6G`ktJj! zbptH`qd$nuBiL4GFwAH~YcyIzF11wQSbY?5ls=MJpEg}+*_|-5+9Nxm zZ4FgJy9VzdXT~~fjP_>g#ZC-L)=LGM^y^~;9Ut8Sa^*!mUG26!L@$IhV;$sO9L3r= zJ&UcuGuX5b-@3_Q(z1JEb>Ye!wpH41kaWb$)34p}^@-#|_iK9XANj@{Irzp5*WP&- z99DTGb@JJ#$3OM_xEjXBTvf$FE|{;<<%RFot~pStOOWt=RM|<4K9GrXG>9`NjH#_1Oj^=6HTb(IpoGm|w{LVBp&i@$~;e3d3K6M(*OXvzJ zuW4A@3)XGd=Ux*}Ssp|m*mh{n@OwZk5#oEm z{ic0!+!EtX_1DAhpyu@vY3ymH<|zsEAnUsukzac7H7G5>{fwoih& zy>Xk4anSaB7hO*2Ws#rT8~>4VcBs5%liqz&Id2nV+$ewdDdp^v{VO4+^i{)Mw*Bjz zKBk<1p#Io2?de9nzk~6MwG1nEu|2~*xZAAZ&Vq5)^Q_H@5Tif4QqlZfX-@y7Qg5Jt zx+VlqG2c*X9pl#pJ81s&G?e-V>g z4%!o64>7KMac*DlTiBNHn@)U_(}^+O@h0=0Qo9(Oo^8Vk+|6%ce0y5VuPD_5(=C$v zQ?FOB-owxiaulD~P|l-+0NC2*ALIQ=+lzMSy;tl{lVX3GJl>yFEQ7Jfe$n24rkIcS zr{nzzYyQV+f11R)rgM=#dtk4OVQ*7sv8Q35C)b5E&7aVyx~7>w$BeyJr+<_A79{q? zUfKuX;z>M+pVMgekpG8zOl^lfu`AOHRyc>+!}0VRZO0+9yF)hQTt~>pZ`fGu=U?i? z(|f==ItyC;F6uLO&dUgJIq|ZMMLA#V#P>8q@qg5bkB8#5@!<+Ni}M)-IQ~Gpc#K(9 z3wj^5zt4o*^=qB@a5awKiI24F`A&SKU0?3R_cRe^=ips!>y5PQ-|+$#_v}RZy)Li&ZIn;;#Npw(Z{b1q zSpEURWDj!>N&2?NOy6v@?Ur#*(_?0N5={39%Qz?Lv9nwTJE8Pt!7GB-1aAm#3a0)G zmw!v}UX)2Stnc&-b_J)wG)K8TbWe=%v|!o`!umA+VQvUs6}&EZQ}DLnUBNBE`%$L* zTG$@CpG7z+I4yWW@U-B(;JV<3;8nrvf;RVMsf~N#$1(yXc3tkbtCU`?|Q!urc-i^E;byIu8OzjPEPeSm3;H2QR z;0eLgg7bpwf*XQY1+NR<6ud2XS8z-4ew6h$?ofa94v6%m;I!Zg!PA2Cg6o1Cf>#Bv z3*HpGEqGUOOYnY_6A8fsf|G*Nf+qw|3(gC!3vLKr6}&EZQ}DLnUBNBE`%&&o2p$le z6r2`3A$VGFUT|G-L-4BLZ-GPSgTB8KOy{?7`u7C?XOvISz7Wzs@gO)f|4$4Frt@4l zeNwPE&z&gR^bbDt;YU8=KKvmyTnp+oHCzdb!xvw8W|*M!**5asBl2y5GTh-iHNH)R zKU&ZS5B|E1ltc4IRrsGb%$E!Pu%w2I#p`qQiMWD)f)T1+;z%+ZkfDzanyT4L5vtN>OE#ii&1aXkQV2>b3`d4M!gY@BP_uq zM%hSkiaCXmd{3Nn4#m)%JH$P?Z6Y1||EjRl2XT&|ux0#y5OJ9Zb%5W06yeZa>|OHf z`&}ou{(aV>Lw7!V@5|U&BZr&J{gAjGw%eHq#s3|`N7PT>L&)iSstKB>%}?|l_@nCI zG3qJ8)1Grg{e3Rd;O^9ZRfED2^`B+?^?jP^xA*37{j`T1QU8fOq`}>> z{b?v1RliHQ;WF@4zts!X@0>=wtzXPT%Ay_L*Dbd7DdH>eN9DKepK9kc0b4(1eI}G& zsNIt_5hv-lps)+i--}4F?aG9e@bg=inc}H2wjH*9vX6e7u=XPub`QU4=)^CDV-XJ3 zugCPL`qwzW3rY2#G)&(&w4?gJQMx^;`+eEOg`Q6~8LYld3)$=7TcL{Cgs2>%xdBJt O>2w?K)!13T1OE;B7_8s` diff --git a/internal/ebpf/execve_bpfel.go b/internal/ebpf/execve_bpfel.go index 7b1d8a45e..bbedc2e6d 100644 --- a/internal/ebpf/execve_bpfel.go +++ b/internal/ebpf/execve_bpfel.go @@ -14,10 +14,16 @@ import ( ) type execveScratchValue struct { - _ structs.HostLayout - Arg0 uint64 - Arg1 uint64 - Filename [256]uint8 + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 } // loadExecve returns the embedded CollectionSpec for execve. @@ -72,9 +78,11 @@ type execveProgramSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type execveMapSpecs struct { - DropCount *ebpf.MapSpec `ebpf:"drop_count"` - Events *ebpf.MapSpec `ebpf:"events"` - Scratch *ebpf.MapSpec `ebpf:"scratch"` + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` } // execveVariableSpecs contains global variables before they are loaded into the kernel. @@ -103,16 +111,20 @@ func (o *execveObjects) Close() error { // // It can be passed to loadExecveObjects or ebpf.CollectionSpec.LoadAndAssign. type execveMaps struct { - DropCount *ebpf.Map `ebpf:"drop_count"` - Events *ebpf.Map `ebpf:"events"` - Scratch *ebpf.Map `ebpf:"scratch"` + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` } func (m *execveMaps) Close() error { return _ExecveClose( m.DropCount, + m.Enabled, m.Events, m.Scratch, + m.ScratchHeap, ) } diff --git a/internal/ebpf/execve_bpfel.o b/internal/ebpf/execve_bpfel.o index cc808bde2073750857c398eb7310f1aa9ab1372b..249deb439058a6c1e71712c69cd4f3f8d8032551 100644 GIT binary patch literal 22600 zcmeI3eQaD=dB)F-6K9+ai8o|t4W;BRA7PU9I%7NRn%!=gWY@d1G_YnjOAQpplkp^D z#UI1WI6K3j)>6TpR-n2Sb={V>W{Xsd?jHtKT|<%9YAJP9q`DPSjf#+4wW=j(Wwi+W z2krKG&w0-H&TA)tkoqC{$mc%icfP;Ry?3sEe(=f@(MZI26EWX2yX1Y1X*|2@PFZKl zyc#iU_jX#Uy(VV$B_}5L%inoLJYIgmdYdCrW4`msE3b5^%s+-;@p`%4#e1&ZML29e zXgzLp7!$ztJheWXKu*TgX9H>%wUZj78tRVCus*v@-J)(%H>m5>HR>vLg}O{#qApSw zsB_c?b%t7{7O4g52z8h`L`_pu)B$RenxF>ME@~$=Mm5wO=`QrwHg$`-N!_5XQ`e}g z)D`M7b&0x2U7*fU8`K$Um0F}0s3X*2>JT+eO;HD^Nos-`P`jv|)EL!@sn0vU=g3j( z@p9JrA3^U(jxWh9f&1mM^OyNp5`XyN&)g$d{0WQ67F_vHyJAgl*0H2J4qHFEvuED# z>@)9Q&Pi^__mERbFI9QTq4{-c?Os>^T9<3zZaLew9AD4eYk#vnse`b$1-u!qe%Y|59gKE=4%=-hIZ{;k5kB#~hx-7moIu6H*sx!?NH z>VJ>Kb*GxRb$3)DGkgE~X4Qj63Ab%Z)h9ipbGDe3?< zNlj1#Y8SPW8lxKOj&wWveVe*P-K1_%*QsmNRq6_LnYu(>q%KhBs1522wMs2g3)B(n zFm;HUrlzO^)Fd@Q4X9nzPHK#5#m?`;aMs&d&TL=B{-@p)XWf4i$scwZ|ZOxB&$P}ZB*H^S}9k$OlA{l0hN)d1m7 zJC*%W_ASXrY9jf32)6cVw@&NvAsbQhk^Fz;e16~Mb5EOVr{p6oyi+|S+}9(^dgS6# zI@*i$0rbSZLbq>+ucyza_6MxTk&`x^37)9Zn`c)gT7IFQVz2@fIb5RM!{E0iR*t|#ZU|b`vAM5cH z*_B_9ryXY#R-cQw3~G_Uay{<+vk|Ac_=xqdMO?o1c$LiZ;xpuw)q1=^PLt=zL*xbW zFnN(YLS7;l$jjs+d4*ghuaalTYvcxbojgb0ATN+N$&2JI@)CKQyiDF9uaMn7S&OWa z-TqmNxO&v%ZeOiMTs`V>x8K$xt{(MxU2dI!Iq%M``n)@@>htcLs?WRgsXp({rTW2hrrS^Ex!=rl zznSNLGtd2Ip8L(gbEe&I@IKV)!E>g1UOjluw9nNC&zTLoK5CJ)TQBiB@(_7}JWO6B zkC2zh1@bbvNM0dV$*bfU@*258UMJ6yH^>X*P4Xgni@ZeMCNGnB$SY*GPaZsHy63t2 z!E>fPR}Y>u?ee(obLQjI+410=PhCC#V`80_7!tFTkB zFvst~C0u7eX7Fxlm(Lsi(bwWa(-OzNkahu4d5imDSfo27PY!aLxHs3ve1h&2^w;Q~ zf&K>FtI$u;EtPu#Zt2Su+%M8S0=Jwf0qhLiU+``e_-Am##AK|$Vx1;-8v0kxZNDOj zIk#MG8-5ZFJ9m(mm~g-HRlV(3>E{%z^sDsc46O94%+poaufxI|zYiB?B^-T|T%Bp@ zGe3vJ<-L&+rT(`YM_=AQxVXpP3=Nl;U>=Z`@`7FesI*y3xNJYpQubS5Q?PmtorT{j z?7zXn9G7(zF8cxScVW@CLn){{8TCNLybf*|3t0na>6STn5pGNq6Tm(N_jzav_6ppx zhGt;j4L6K^voGmK$TF5G_~%<0zSh|GC*edprB2o$>Z_!@G92B|=b`vJ*5`ud8kP0> zJ4h|M7=XbO&&MpY9ag z?byKH2AzRDN%tz;r{R7WDjA=J`={Vc!QBhDti>6)Q*d8|dlhb)=zw>jXzo+ubM);Y zf7zD?kru|UC!d4u??(|J{Vn5kKL!YHyB8lJK=_j$-eNciu0HaGUk1uIO2tTTE=`48$JAvJsXp00S;2mBe;1n_@@1i}QcXT$*$z}_zom;g5C%C`AD zC7v)+o{S@myN*p(OeS;bnP)D&H}mXM?;Ffqeecj{r8Jf=oBS=f z%4WL15Ao$XJy{;RF_|9?B#Y?>FNim;P4Drk$s2)O%*}kw+{%tm=gnwos+h@5O(R7) zSISm$g^UZxmTn{sF1>Q;lS{w3KAyc%HkH!!WG-9DkD6k3)Lb7M&rfD2@=XWoF(4%m z>=v9WWJ^AKubDzVTQo>|Z5%mOO4(dKV_TFdWuMQKYh`I?zGQM!6BARD8QXfgT{Q^B zQa(RXtgsEZo4 z{CIvMamEj!^lf)=MiL>*j2uO#5z9VEMh^4N#- zQ`ZycB$}jw+Di7KEcQTVY}98~F6EG!jnkYC!ABkqO8M+)X1bg&Wy+P3JCuX?%?v!6PZizdM}dhJ58%&6@x5WrV#x6 zB-t~ALSeotEi(q;2|GoQ>7MD)G3C2x&){<{q3W_&LJdWdGiQQxQJEA(_MQoyZ<)?{ zJDKwjT&#>uvD zq^>mQ?NYORpM$K5aD8Pr!mvMZQ5?;2C)>`gWXm@td#w2BTqO{c)i3UIXLWWGDt#S_ zWl&=yO)+^{8o8;_Jl0coJX6fd+BG*yQ`q3fv9sVfumQOej*Q7NHi>G@U{Fhy%(bbh ziVUYcFN{5Kk`F)R2CyXpYAWmbv8SII%sexA>G6cr1np{xgbF4f?l&E-2DeEPs-vH_ zF8*00?lm1Ud5Uf{T1#}Xx&vvmE$OXTC1}!}%8_tiigja^+HSz`8QXW_$cyVHT$zfT z@5Z@q!WSOyntZtL;iRh^LiZFYd3FbR1oa>T*AG5EGPqrQ1Tp>(aXhsybty)+9Cu2g z&vw@s*1zq=T_2QhR{#>Z)5*RlRlLTnCE#Y zn?9S5KlMg&$FTpYC(}$~`Mtk9eQg3qlI*Jpy3LJJwsOZ?B?Rw#*2yj2ZSRhH_ud_a zOW!?5_ba?5^vY9@4ZiEyLDPc+sBFf^a{0+J9)RV2R$y=)hhhUG!=bNBd`pTt$3l_U>&CnM%Xxc>z9?3T;l^Chr- zPlE@;ld$bCwwVOu+l08t^R7HN-Ul07X){CQXC?lZ+RO-8^7E!B4upLWHu~i@vj~;& zUxXgRgX0oZ!o|Nm-DZ}d68?wKx1{j=2$k^vgl!*cGn?f5(Fd`sZDt$nu1mHV0ktc_9i6`)blhRP>&R&W|;ib;A54jDTMe0So&Gge-PpA92xMVbC#kntT$x3YPlT5q@mZm^Jbzz@48mW`q1$ z@X-ZhHktk_;Ja3%W}EzN@QE*@{^Wb`KBHqD1*6_legb^rt5FjpKPus0i<(aIknjfD zN4^0*`HiRvLfipPkbV0G$Ul$x(aoqylRpPOjY(Hk@n^{I!V`D=Seuzsyb$732wzp{ z*T^47`nxcRHxzG@R}kKQ3Y~#|k@o*3_*GqPrb}@U;=2%@B7Yb0J6?x%t++sbJtlfP z7R?;_I{4U|+RT#TCR{FiG4K-k^9Ya6 zVIK|g3GfQ}ZxJ5-BpCf5?YkFeM|1)63o8AW5&kmP7x`ntU&X#kmi;Y?{Y=iB@Okoe z@L7DaBH2nl!k55Z()%dq;5@;&r!Y^sFX{6{`YVe5lCyiyd6L}iSLy%L;DhtT&8vg+ z1oH;x>%n>A=7T?f4$c$TAOA1T6YghnFD=K^Fz#IjpzpxFhnPijgSi^xI$Cj2s57<}}Vq`8jB$)!Y0w&Q$RqQc1o*f1TCe z(O;gAv}rSPGu3L`S3-x~b44hq&89zWsv$pd{huvt?6KSzJLUkIB|(%(K8gaW4M zFJl-sJuKG_R4CxHjK8At{|^1_eOoC08vX74QOIAMZTz__?0vT__sE|9|Afuw$e#ZH zJpFb5uhW13{>M$2GDmH>9eeu!`!=7BJ^lYp`s@C`MStD@v-H>fU!cG4|1+$Q?*A7U zU-$pF>96~LmHxW_{|oIu8S1nV&g;*>|8D%};1K&Kpni`2N#*|+;FF>G9K+fc^LCUg z`4k-A0_4#toVBl#1rOyuqQ+F#Me{4H8|P)G6v5eEO*3~OF$g?ZB>k~ zw{*uFVC{V%RQQdsDOfSWZ-#9M!1(ZGhnCOy0EWK>+9?|vjE}#@_2Kz{yZjjUW^CQ| zx9L+Mmih-Fmj37tvGmtKh^2pqLVQl*!-|porOkM?WR0+N%@v0>T)wZtD;H}dTz*3@ zI&7w&Q9P%3QL!H%U;e5JUst@Tcw4b;1pIt{ozkcf2a0iowuGk?4=El|TvR-xcuw)6 z;$_8d-*xqu{@)0N3vVgjQ5>`T&u)5mKJ9Wsg%2oBD;`!{P+V2qP`sdcN%4x}HN_i> zw-oOvj&VQq^B1pVn&T_|=l2gEKA^(WiiZ^!6jv2D6fY=VQoN#gP4R}}EyX*EW704f z-@Y!z3B?17(~9MuGMryQaaD0c@q*$d#Vd-}6mKZrQoN%$#`_`hmhtXV?9Xc-KA^(W ziiZ^!6jv2D6fY=VQoN#gP4R}}EyX*EW723C-@Y!z3B?17(~5@`7Zg_&Hxw@@UQ)ao zVmV*d6>louR_t#vq`i{9GjzTQhtEghqzX?d4xf(_e?)~B70)Q1Q@p5nS@Ejkb;X;C zw-wtLhp4A-e;1$CgynorD3w-oOvj`4oA*?z?d#RH1diiZ^!6jv2D z6fY=VQoN#gP4R}}EyX*E{qsY!{d|P*oKQTVIIVbCaY1oaaYONf;w8l^iq{lxDBe=M zqd3M#GT+`V#RVka^>>n{>x>_Bw zPQ&K4NPMUC{=Jb;!{gthi6gNbiK(WKa}+K+4d^fbUm@-E={xEFkI?0R}g2v^0)SBzuY?N^5uQce&xrc z!Z1Im{qp<4e&xp=v&qef6TI_t@pSnQp>Qdm-ObpzkLN!_al35#OWd&eUBG_n1E!w~ zM~2&%@4es8@;!T9X8ONoKX`vVe}4w)_iKM)pY}^zeEEL<$@J1~lCox!ay8}~ssnWS zGN${LzsB-sm|mJ8|Gc8hm;cjiyYk8uWCpfr(p>+%-D>*lx;_n$Xft%zF(UuO1QTP0 OCEb0(;tA8`#QZmnbvV2L literal 16264 zcmeI2YiwM{b;oBZidyPP%QDTVj&*G(>QbesrRWE%BwzeUWtVG z*zPXrU9)Le)CmYQMcJ21G)2qAMoYl?z_e+_HUUJS4=_LsD5wh%Xxj2affA|FvM7r1 zgAw)rpE<+5d$?2(!~yz21I|73o98+6x-)zEx!%jqH6#+oyM+0^sgjR1X7yY(oUy@- zc@Q}(tu2-+4=1hsJf4T)r}uB&WyCG1Z2I`7<>})aBG*N(iM%6nRpg4uWsyrF7ey|J zoEJGKa#rMw$g;@1$YGI#A_qkFi|iAb5!oX$EixrC5ZNZOMPyQ>5xMmP_52Z#94szMXUN?B@df?XNiAhxDzxckkYQ zLwJud8z|R?GI4jS(GknD%3G57dm{ZfR@&US?ikNzmvKkEsH`7t-9o!`Eca{hx0^`D zywtSc%G@7p+J1@ay$QW_eJoGaA2Q#vGg$lOk>PsAo&+-4wYYa$V$_$U7oeMXrck7P%yHQRITid69D>XGPA4EQ`#G z92Pk!azJFi$Uc!7kv$^QB2yv*k!>PdL?%UAVaIJRg40b>&ldulkehnMN*u85%}pTSFfMnxhXgCa!tpW&AbX9z~`ErKDV;~IL`MBB#6*y=&|ppEysGOk*L0U^&CV!_tJ;<_;$QL zRl8(dzhc!get+71onNvUvspLKUP@r#;3^5%zqwWy4~Ax#U#)K4R}!*rTQfGklGtK0 z(%n8#No)$c{h*TA5O(`QC9y6XNclBkr)ec|N7(HbmBgyB)1#7D5q5f163fC)k4j=m z*y&M8EDAe4Dv1T*bt@~0d10qVB{3)L^r$3eg`FOi#EkHYm6b$Ucv(0vyd*p< zydXRvJTKfYJSW^IJS&_Lo)PX5E(@oH^TH|NVc|e{P`FKaK)6M?-^%!VgYUa~^NFt@ zzn|FmCYbZ{b@(0cyH?kpfA2Bh{qqaf&++@`m;2`z%!8YYSP_&9BIiZUiFEtG^vxOJ zvPieyr*FD-K7Dgg;@!HQzUkI8&TkT*5!oX$EixrC5ZNZOMPyQ>6?UEPMezRl#q|fz zQ+3Zl_s=i(ymtTmvSKI7bnE@|3p=8cko~8%Z2P5>kbS5%FD&~}>#%TO<#g+yuLE>n_s+ovQfEH-V2f4ZL-|29FGlyaCN3>~5OI{Dy=xkiQKdz|X*c2_7y<{r|`YP4Wcf8!l{r zZA`i_pSJA}BEWg#jfnS$T#4<{+A3_SaT^J@kEYw&P~AHxIcde`tFg#HR1 zbFDE0`48|PhNt^ic>u@SkAfU|u%%A^c|uQ%}0TlyHFXHzb@v`0o%-L(af|N5U%z{|mx) zEurEKgu4-!L3k5k&Z`-O?;^}Kwt}#@hBH2drq5Qx`=73c8=ghD(RHSuW4;F4-%m0f zp5ydAb|C&3{x5`|fu#E%gnt$?fd9V4XApi*;s+5d z8q5}g3clhVv-vY%I@Zhaf^!y(jF(IpUbu4Q!pq?c&%e?ezW8!~ zZy1_VB_ElwY&nd^ONEiBXrd{Eie|F=Eb{X?IbIyOJ{}DPtYY%%CmD_BcJ%1P`1ODf zb0eylsqE-vWQGb8`7k#zi4w(JAzR7~hb|#oxSlq6beU@-qtSSFEHaZltg)wBVQx5E z@Wo82kj+J*RVplGUk!_uB2|qFCO0uQHZdMr10;NHG<&`16Y_;98q1eN4at!o88Y~T z1~AbZRvexvl#DfDJI+$BR5rue@uAVE+HM$?quf+vO8GO;C6^r?Ei&Mg@`<@KE?4K( z{I$-UX)Z*i$-;ObburE5Po;7b+3Xz%oS>h=riU+f4{=zSM8GSvPN(~MpZ z(8a;W0@NB_k6_wlp@7Z^VO3bVJ~EVIwqmI;nJWb~{T`tAQEvLPNJp@fBLEfy!jU1w zk6a5`Cu@cTalX@cj7Ti4 z?g$_~WxE`e?&$8^88>ClxCPNUY?>qK`ohTg^{bQD&@bqdsVH^QW!dhFQxSR~P1D(@ zk45dlG)Axctc+e733hErb?lqbiHRGNdFh+#>T%t(U6U<^u?aC9$8+JehzkqzGt3SR zVJ2a@bp&0^9fnsYM@CB{u`n?5BH?#u+>^Bn|C4fthP^WC-)Q zPEI6*ex_Rkn8~gbJBbNSVXvI`rO%bX{Q`gcQna5JAw#F zov6U|gU^o&cFT_>$ozVJNQC4eZGpai=$c}XJ@fjcnF(z{jHk{Gnd~Ji<4K!u&r{xLDDWS z&urgDI3?fv8ny`~czbJ2{BypNrWJ54D|-RP7+20N2>@8D$5U zcAQ1tOYlu!Oqc=TDe_#x3=01$8A|7cA*?Io$@0GmzkeuU=7d+6A4V+*zYT84C(M%Y zf07qyj4S^jE)d7wg#Ix;3T^?@zH>-Fh|1f9FN0gY2>pde!24%$&yw<=2Os!m!eoTs z0v|yq_6ffOZvJ+{^b7wx(^p}?@OwZ$UrW@pr{doA4)4{=l2) zAH`|mSCQVdhDe=`PiN%6AqKePU?Lx159ZOn}DE%1RmSZ6Wb z2c8pt8|jZ?fB(6^ z|NO-FA6bt)J78Nfi;(;+v6%q3Dg1Ha9_(36e_gmN{54^|J8XM5w}%^%a<5}w<$-C&%G$&|_Df1_+?36?*PdPCDZeA}+~ebpXE}b6VSmNl zD-z$2eu}#{Bz{5F^XEQZ*LJ-i z@!GC0NxZh}Eg!G!`fq4+G&Wv1ep&Y>o)6%ynRaLbk$(+&G&WwF(tp2?c;@$x?;yHk z@Qn8yFcR(+_@lA@^zHIH$kFXDP*@*Q|0kf=1NLhaOS|8LDS4cwqhMQnx6zUL`*N88 zN9K2&L9yTGUy}Mgzu)z}gEJ=`o25SMF{VE6#+drc_XC^%IJg6zj^(N2M+tCbPW8(K zI5NLC;`MGFnWK?+xLtlm@tooX#Y>7;6yH(2u6R?iH3D(oo)#Jv<3MpwjA?J5VqA}` z^ZnuWfolJhRr;*rdBuy0mldxnUQ@iGcuR2-`#qi4mv^f;rxf=n?o&LVcvx{+@vP!` z#fyrU6|X8@Q@o*gOL0>6=WY8H^X?Sy555oM+^2XzG4E3G{C?l`?aiw6dBuy0mldxn zUQ@iGcuO(g*Kz&Y6sHvTDDG1{pm+75}c{Hx++f@!u-`Zj8Bp-&Opc;)8b6tIqdF6n7~8;EBhd z_)zfJqo%VIl}o0x5RG>oQX6maWYq z|2*No9LR?q(>XdiHO5c01^gpLP5o8X>Q^31-$kwZz5Mx++Mv;BWWp1*@Yz4rU1{fuN}`+P;~ z_IXdN*S^1s{xJJXC||GrxjOdq6`|Yby{=yScVxf#VfOdz(*8mn`>CgH{}dW$`+5$p zJb*|z{{L0nF>l=Q|19g3za!=QYiwLc6+Zi-F?~60(}Wi24U}L9$KE{JnxqZeP`8d`z)Dj{5pZ|CzP49h?{0V3 zk=+!rh(}!sgvF}?Rn(wLSRxXZsFWa8iczZ)sZnKwgj!J{0}@1Ph5Q52s8odSn>n+- z9+L8hAB-~hJKvczbIzQZxp&t2(!kLD$z(#>B_VG@jw#wL5N@3_ET_+FB{BPmk!4Fw zzC)?7Rni7OZ1tbtF7uR5cN(57{`k^GN@sT(E>{I2mo8npxXrd(C7xfiQsNUTvj}zxTLtKxS)7aab9swv86bpSW}!(%qt#K99A4u z%qjLOW)-^>1I2BMor;?j3GTdPPUOY-X`i=(Y38{!_T#3v1iw~1QILQZ?%Wm&dVaUs ze&D8Gto<6c%x)DMXF-O^)nETvJ@?mdrxtcM*#7WSGkmMqc@|_sxrqelIZ0mFZ2iNp z(Zf$bJ=*PiWxE}(I3hPu4|@|2>`i{o-b^jx2@JTreD$=Y@;$}-rVHiZ6NiuXJup0^ zs{bo^{pkebF>?~htZDr+l_pUlDToPUC6WdPY@<>O&6u-WQ8UgCa)9c_co${AkJ_>` z$KX1=2i2+H4;imJ$)WDN4iA*8P))nWX5Ov-xUezJYGc;zGB)vXIQ(w20Y$Ede22=6 z>3{~rIR>b1PB%atRJ$7?52?)kazy)3l|$tmU4PE8gE|z>@oLl@YJ_?%Y74c5x*2sD zwW@Q+Ct<_f&6-_iUS@2a`z`46A9)wMwcR}43zJ6?9Qq}*kmpc2Ht!_CR95$8;$)BAgfZ^Im_zlXY^TSonx`sQsY?%TZEu<59y z-+!R?puUAeL)|XG6L88sH3*rnHBD3E2Py~9|48K=m+vN`l3cgFM|L!ZBLWE8%u{5`V|dgc!2IsGaG zC;tJuyHHWm^!-uP0P1k+ftOLnba#i=z9;qT!&v15+D>^#O#aBaoSDTqjGN_d3w+lk zUg8VYlv1TBVR-M6BlkWWK6v=E1L4t!hX=w?nzOY?rV2A*RB6^rQA48RkQy?*cMt6O zoUSxVa3VZ79^o zvx3KNKKAgjSH{YP@rE?()0JYO8I4M&Gcr-AjFzLYQJjcI!&<#sj2ewFnkhAqOc)UgIKUawBq!g5p?jq0|cSjVI)4a{O@RvOJhy%~;FtIcK!i7Hm7ro^NqyMMQJ zNng7T!b`CI9uwEDgLKy|+5K55_OVB`(q|XEcS1UIaxbx30A(WpAswKMAO39|HK293Id6Vidr7+{NGh%6e+?z&RE>-!HO zqfdJz(+h!wVPm#Z496mFP3(}cFgn_08he7>v<}0O=~B5_s)SR~R3mD3MF=P!AB`d; z6uHMrOx40lL!+6bE*y`VP<1&oqy^0z5^@0Ru*VF7Wa4I(1kU2*bB1)5x!Y1EFVx>uF zp|DTn9VfuJM=N}AlwAiSkY02#^Kb^}v2Flj4LW#C+%9fRk4%;94nYov4u5>$lMfC^ zFHTWI%B5mdY4E!(dKVAO`&i8H4t$@J=TTRodjl1pkOXw?cX=;leAA4M-))oxbP0Sv z?&f!c_T*m_Im-JBZOPX}%DhA14%z1THnhge~B#O zo{pP^Z6`-O>A>0#x#$32JN6X|0yel>Vr`7cCX z!1|>pl%E$l$Nn|TGw^*LckT2{j3eH3OF8avD{O~f&L>08_Ic%q<2A;+XnA|Tc7kJU zxegVw^nt$tWZ8xao@5&e*M>axeM8M!#O;~;4fYo-cjGa)rvF>Ee|nSUY2KMp(pfw( zew*i%j{{Md%eX)0&e;DPh{9a)j+)VU(=Fu~^PNiyle&z>i_oc_d25%m>w5dQ4{bTK zuID*um*1`HP0X(0<(PinDS@|fW5zhdG{^oHHW>DVDV!@yfclx3o;nu#zbU47@dVH> zLC<$pyx?vskHqY=+86*wWBTEkp5h=X*U{Z|=OFX9i{soA*oTg1PH8(27D|TmV!Pun zK*l+5^A*U9&9%PR7d*b?@nw&%czo64Ya2OUSsT_X z+3E4X<5`dAJU;C4yvJ)EZ+U#);|m^N^7yjHS3JJz@wJUS#j_Aw?-agC8+eb$@AmkR z$3N%svd16u_%}TMl*dnb{5g-G_xNj$ciwcvjazQsEWOQWrYXJksN8$#=>5GU>%SG= z;kP1tT>1B+{${o}KKFyy{1R0nz2)-pDgMZ))C1P|T& zlj?g=|4V=KeTomkceE?~TMoYoEIIRRKW@&e$Xs26>gMVCcS83#s`KyKp<+p2v}nE& zDjIP1Bws*v-0Pole&$WD^@r0_^D|V}f8D}JnUhv=^%Gu0JbzrHE6v~e&BKQCzY3Mb z`RDxkeY=AH&9~DSX?w$B`x*DoF|Xu*&Gtww0qNh_#r@A#FAbTzwXAXMdCP(l7q@GR c$NMyt=0)xr*Af5wV@hHez&>sq=YQM30cF&%8UO$Q delta 2201 zcmZ9NU1(fI6vxlZz1w6r&BsPJo6WAtO^ivbwXO}uD79{D!8`;_QK4XEvu>gZjcI5b zj5WB6^dYE}jiVB5DS<`|MR3cCMvSlzKI9<}6(Sa`5Ckzo9^#7%7V&@P&P{GJFmwLD zbLP&+nVH>{CpNkZ2V}$IY%(6p5=tgYwzi$z61~()gR{$RQVh(lKNmaBuCMC2CGoS+ zmI6f2l+MYt5WQ;6IxUjwnB5ufSg<8hEi(UzNO{@H6eR}NY`IW#lSa01k_kX zTa&~6Na~gnFz2xj3)9r8#fp|z2cA6YrAjm?&8Sz5Zh^k4l9k!u^%{;5wW^t5OYUo^ zdr`mLi(z2fVfry@5E{!9Ct%Hl;-t|I{28ND(5Ij|6?y2_jV?o9fbN2Y5f{-NLwNd0 z_zt+8?58M4lms}4KWzdj=zeJS4?-Wumpl)T!P$5S6~#VjGK+NDFYoH}u<0|p(?=ha z>n8FRSKWw@SIvPOL=+R*YqjXB4pr@IvVVf)xw&+^hN|JZsOG9Z?s#Q%YMB(cCmLSin%5sJyx#QN1bd zgGRoz&)jYL6Z{|1A>3fyAIyjN{2nm(WiAno#h|g9ZN_~f$H&|sDb0x=@WJmS-ebog zG+4$+6qrX0x8ve5Pq_@`mb{4{Br(KyV$N`u#0d9aG(16Kg73+a;aL*%U|ER+*Asq8 zV&QH$u!C*Jm6Q%X!j9xGL^GH`b{YPcsKEVGKE@7ZpUW0@|3Mf$;A1=?dBQL*%^b%E zap8CZiyhnnJJx)R=rS*0!pFP-WI)H$MDuv@GVfzv(7a*1uLa&=+3+gSXFTDG;XjCq z$dJt4Fpj^7zKFna)5lfdb(d`nzKq)^Hw@$Lm3e?I!;?hcMZy307z?(5ykHxTdE^4VS$I>g-`Wn-`9vvxUsrr(L%66Jkd}g#+zs zeSIgZ~wF7^d99QU{YjnigkL-rz?U}>}AU3p{~lE*cD zC9dind}|kP?&8~ODK;0Vt*;B;r9N#srCQ=qbvWKp`xx~fJ(^5E>Y7K?bo|-C+xXT( zsvAO)-ype^)mHp1&do%kCsglfACaSqiMTkgRufIqno=8y!y#+N#0Jnc9^ij1p@*_= zx`E&ol|ZERde6&-I9$97%Ec5OE;0bZa4J2>mjM_ZFLVH@f+kqoTT6jB5{ub-domDjuL z-M5k5fLH{iE&^czfq*J%Rh1fvNLZp$j8rK`txBXul@St3MO1|%L8Mm5KM;*dML1{X zzTLOeB!BqBmG3+E-1)dOcV^zl`kO<;hhhy4DwGEGuBx%ntJM65YIahaNp&Y`&fRVN z-5Y}*W)sp4eBY~ zU`Fb7H?W3M=bJPryZw3eI}1I(&XlwEx1kpr4S&3`MH}At-v7XO-oMRwy44BYj`QJA z{@iZ*+n`F?IC-jos7jqYH7PhEcw8_gcvvtgI4GD9>=kqbHw(54HVNvqBHneKnUkm1 z1g{BR6}&9CDtJ+FMQ~YgN${-TqTm_91;Kg2ir}nZL2y!VMDVy^O7O5?QgBc(A=oSE z2yPZ^7ioMi&8B>1(*>d3ez2M0nGNr-EU_ozZUP^_X_G@>X3iHzVWhG4o+O&ftQa`%Rsu{oGa=XHP-e$vk@|g`4?wH|XuG z(j6wg*JJ#1Gmfs;-5}%YH2rzoy0kytVaDV2nEYHwYq#S0r!X(yfu1LUoHn2yDW|i} z=Z+j3cr-OEuKz1|_U#5`W~9^_7MA)gF0hdpZ)-?7MQ6sTQl;;BoIW$g+qN_d>%pTX zCbvS8x;EgtYxJ?6t8h=~0Dc6@{*ut`P)OTGTx2ZdF>`07S>LZL3H>p%YBcNXMEhw& z;Z9veHEjakFE+=t&)6TB6Sv)AsdpDp7PpDJ<*4yDa0exg%^aD5PyGF47fw>^@$N z)a5MP!_jyjmx{Mr$1vVsOx?Cm0Hg7Gr4K+|Jg4T5an6)z>~NhK`;*Wl)ZRmV@U1}q z0fn^j97SWBJDc|1iKSQng7!n-Gxb_`0G~z!#9DtC_G#FxNBOzf4(wlworHZBb^=&| zz9{wz?BBuGXAJlnbT@oS;2)vfZx!HMP@cUNph#>Wv=Dk%&2D+1X2(7Q`|qYrxM#v1 zbWZo69Jy0G&u=h^_@n(Mj0b^~w_tx7=s^D_{v_Q>LL`v57BkRRW~-C{V7wYjrSZ*pahOT-jb?EmgAO3tsd*gSO{^T+h{-> z=%;8v9OxW6X^?&%q7%Y+Tn7kmt2i9FK)LS2M~^=Ig!|Z$FAurLo=6S3t_tP~zM4+Y zx_&MwX8e-!Prxdv^6p)z&uckX%1q?^F^650AJ{`Tu2pw7pPO)aQB(e$I+4zneKl6h z7hEr2MvIbHOb6biYYNiEiG;#sCoj8r*{#O2>4}mGishV_4*W4yNRO%UOxDk(r~Rsd zaSSr@U@fpWnJ$Lihv-iF>4HMj(JXrMf>|}0&W&Y#x8zOwV{W0C_xw`H^=C7I3JUIM zFg|dT5^sPN;-iJ}xW~*n2UCaK)X^_I+I!31`kfMH-~~>QE={>&Zzt(f&6#nhcdM}@ z#j21QQ^5o-jD~cL`Ksurvu+_>#2ToHV!m8(vwnKaFPZ|ch)Ly2n8oazDh26c;Ev|= zL6AYBy!`aE(kV&o-DyHH){X;+;%wco$F<`C!}Y1e-h}c7*dm`BFbf`^RL%LEv){p_ z-RU&q=JQhs?`Qq#-ffc5erFr^OW!`#T=au-G3TJkwr$S#d=4%%OO#_T>HPN&eesyt zXG6!29P2|Odb++!uC3vR9?qnV=5o$v#=dc$f+3ySL!vJdO9OLu}~;&`Ck ztXOqBm=IjRu!!py2CjKgL!2nK>L&I+sAJS`mujVYH-|K6P2MZaVSRQS;CAVk5gJ<- zOUn8%)x_T2s@ZJcYJ|v^#vr+#rUF)h2`rfD8K2pp?B{;0Fm`)=FZ4(sG`TDEktpK~ z>2pNGr!@u34R|+F#+rf`4s%7`aRPLBlp+Ru*>S)JiKB_0M_2(ZY860Cg=QX;a2J=# zqth9)Ly&{vBcC1m{9{8Zj#E@p*^KAsN40UK=^E?Ucv+SD)b%Ld>87%J=@&2 zm5PJ&c|aeZ+mtx$eb5cK(X&4JH=vEjOkMId=sj7b-}^(}3hqdKmN$YY!8;K<6utwH z-v`}Th^Z0bDe%@HrV0_h349iu{d*{H4CLJs_9^m(m|B+l%j7?a>30?O|1$ZWm|B%` zfR@X+viuLwmSjw=3Fk*j<0Eh)7Rxt*$A)8yU-0A!^5_#NOQ z!hZwY^omlG!Y=_EFDg|K-i7yxyD#B)uLy4euL!@Nj3l*Unp9)+rfOr2JKFuhTh;xYY&m7otws zSZ>HVeFn5Cmp^G-r`I~_e_i}sqp0wEtTQs6Whwt5{2i)MpLy1Ic!7KgN`EL^M@koz z{*XI#LYAN%;V%cU`CdwyfwF!=vs(XS;!jzA-kT`gE=|yR5(qiJl`fM&$oad$Iavoz zhvmx=&hl3xycK*k!a2q(5zcu3jBtL__d_Y{pD~kAO31_UhkQhr*2)VOuULG+;)@nv zviOR{S1o?k;%gSylYlQAulaSf#vM*FQl7AQ(&8zLk6655@ruP4EWT**C5x|EeAVJt zExu-PCHI}`{4MTSoWG?+^O3YTpPA9}5sMcrUa>eHpLOjQExu&&6^pN0{Hn#*EZ!=& zq;URQEZ%SNhb%s9@vm4sYjHk>b$GFr$fa9e>PC@ zqMwZ)Ja#BfQu|i8&9@?3-1>V_zM0J%U--eRzeI(ocs6@tnjaZOd`wqg3d8TzIKCHy z^r(uL=B72u_^R)c!v_y0+(D&bkAa=L1$PN1Oh*5=D}Vcw)YWzLg8bO{W}VmE`=Tx$ zD{ActVM>z*K5*swM`b_A?b?UWr?3t0%~9cRJiOm0qfXc(@}o+aB;NBm&#-;F)aQQ( z8Q;#qbs1>*{F3UrZfFy~2EAE(`F%(&L@UD%_-hh>N!l|$>)G+=;9EC*BM+!R ktFkEjkNro*9_zCxlv`W0nri0{?2wc+AVlZS_fN`y0sN%4#{d8T delta 2202 zcmZ9NUrbwd6vxlK?JeyEp=B*lsHH>%#)e~CWXvem%|v2|VaXmy+=N=t;wCUQBDy7Q zbPr@Pr1;y&61Pb*R7Q-B)cAKMJovx^4;p7&)R|?8aU?U*7d3HFzvtdl_e)QD?)iSs z@7&-0-SfNmcI}Z{JM(SkQq5d@BAO<))Df>6C!IhCtB2-3Z!-Ihxu5pe?{jh=8$|fg z4?(xYqNk{E%zVZ$y45$Haidf1^|pq3oxzunbUX2QO;R2AURP(W3VRV(V87`tyl;JG z7?v6>YmO$|$#67dIJ^S)5P5@!dZ#SjlmO=7Z^B{zI1U#aN&ZH}i>kw)HdfS}zgC?N z1hbzacOU!!8t6ygCy zw!P4uhza-;l21bSNqz`=A2b%>MW6v3wjr_|-~?J(iNmucHQNcdz&5HCISFT1h>DB5 z2g!A}rg8@~-|bbfN9``(68+wtwu;Z($p;vpF{{p$pKp0?^zg`7>ctV7>ZZX#9Hz#O zjy^v&GMq?fQj>HvJ()U|&J@m6bQ*=$$~&fN4u!KPuxokvZA{~be+MtN_zR`{!MES7WiEiDhl%Q-i(COtXzT-{(^>i!#lP?buNyRk0_G?dT^WAa$W$l4W1Sr1jiQeZfG0^F9^?K++4)#BD@X`y+^bryaD!IM*qK(#2-jRJ|w!P zaXI*ga2StX)fJ*!!X04WD$#GkQ{dV!iT={q2J=UUZ(yFs*YM0}Y_DPegOXT5fq4}z z7A`(yL7dDFAiq|u`KA8=Tf|leXZ~8a4Hswr6OpY~xLD8a*XuL9|N4a7UgoE<2(}sF zQ^J=^nA^+sYckH=)aT>wF$ZyTY}_sWI*kic04H)H?^PkIMQx3Q)kMVqBsW2~6$d=d z1FYwlCC}H~ao82CDGtw31k9~-&{|ouk!8WY6*VG>DbisN1%b;@_`=O_0 z%^Z0Aq{cj+*VqOxX&fm0TJxIu*cDkOkMNeQm++4ze7l72sFmnjR#kN{v`M{Ne@Hbp z)T*9_ma5&Qbz+ zp8p+rK_zXcX*4d@W6wywpKxy6n&)bs+P)?O7Xqq17H@h31NcXzBwV+oTr80~?ZmfE)I_#<~M-KGp&!eX_Ak&2zkU7f|vCf&%g zm1Lu9;ckX%j z-23i%cWC8Q`|xs|7#m3^7nBK>Kg3U9oLt7IUZqz?dYiT0KQi=KX%C0ag!xJ8CuNZW zM7x0d{JxXQG<9dbaHV5_6M*GH# zaq6%cc`BH*`m)J69q^DDb>=n%+lbiR=~Ls*=StO^fk5-Z5a*M&Pr4QG5)P~$k+i7< zno9E!DZ}4}Gq1wm^|(E^_rd4l6f?k+!gE0W0x87Hz)wA1&-|QMk8T71T6h!qH_`o%2^B9MXi!RNrs@P7E6@GAUInXwhTcE-D*|HeYN0A^NbVOkD{sRle& zz%y{a+5}8Bd?g-Nw?N}`)cn~tNNK>6m>g$8UEl>E7lNq)Jea4zpA((|KLE}} z%i#P6GOvOk1+E4H)G<8n0cPMQz~@oBJtlP;q8-61(66+HId27KJ4;sZAo4ylxw>R& zEk>|P-oKj$@i|J+IylT_ybqoN-vDHt0mm#ho&(>67kPa=#iPJ`;V^frGzpHt&EAx= z-fxGVBcb?We+?s+*eu7+9Ni}<<$(-CUzq$PGt`p{LN7FA@@-9_Z^m)m8tOW7f}EQc{ah#IL>*oZE?G&0cYZl`3pzfcJ$jVs$rB zF(|n_evas69>;HD$G=A-U{jP5{X5Y?&gahh2S+@I^f2ojI?x90Cw-IyXf>-JCcTFB zeoupWR+jNB=?pi=sOUFHKg9VJ(QlF7tf41FpCNr5+VK}~nRF!r-BFSR4&at?GSJwO zgG=Bf3OHS&kzB$5;9%!=yoKmE>#S(>_!#HsL~p}IggedQ4e@-ex!{oKgG8V3f=aw% zPWX!GY$I@7^w0Qzup@_ez~fhl&PRdO8a)g8f~Q>+=T>tjMPq@J{Qf1;yNSMwLr>Lc zyi;U`r~QKbHF(_RUV!oL`Sx)6eueR7t$y7~Jj`|{ zVFttT4IlBa7v(L^*az{|3r-+Kfk^ zP@BxfXtQ=xCLK!#HX>YarlK(&DVsv9MeQ<&V+*yLGnH6pgUhGSHf)pM1XFfO|9j19 zGgqU@z#$CSSsEf^plmr)jIY(L{7%c#GO@W+xUl#HVZmz6_R=44~gg+eznl Mc>}7$6cdU60U3WpRR910 delta 2119 zcmZ8hU1(fY5T0}HO*h#l?XLOR-E1}6q-}m0leB7#p@aoR(-N@YgVCa9HI-JXMjxbq zvRkb-h+vX~5EM1o777N8q+msneGrLYAxP1JKIEaOi29%)K??eP_s&h049w3rGv}N+ zGw0rwyC?Td_1MPY>Aq~{kbny3D4|p0Q$Kb_MyJPHtvNV7`A}v*U7sc>#r$XjEmb1- zFK)9>7&G8bd%dR5&3o<1VFpj6WPtiqLGtc~_tQ+(mbkwn67WZh>8j679hQq&3Xx`4 zu4-z|1-81j0h~lB9!^ZSM66{y!zJ*$)exZD!0)Tw0{gt1jXh;PaW`Yx;%8XNjac#$ zcqf>26}$_a2S|3Bq;N!4+pv%xv!8}yr6e2t{^528JmxJLr z6K^WsjtEL+54^u&MD{9tePEDx6Jjqo7ls3W9yW(V{}}8z7IIf^k%Zm@2KkNJ`z^4u z8*=Ut;jP7QT~7*TNhc{P4!!ozVFwa>hJ*aKwj$MCi+Anv--a372%)=}1LBhRVxbLb z3U1%#cdDO0dhGCXg=Y`DO|>nHgSCHoZg--+C@aj++zx0yh!t=vnDl2DKE@JQDsjEY z#3tCxC4ODxG~;Q-vlu1nlAPjsk+aN4Q_Yv)Wif9Ok4Z6bSSx0Vjw4}$trIg!jNx*@ z8kIDj6*JEH;vmNDh?pbHzohsPF%x{SR}`NVGY4#Ofgt|_F&7$u6U7P#UX)E^5pHC^ z7MaHZHmCRp?2RXFI~4yca)Fr7g!%u7%rSo;#2)rpzz1sc6_^K(DSklYG7Bn})bX0g z7kE2%Qt^i(W!%V4DgIdGt48423cMM3PVrTdZ_#p#4zM5(1uk>_LWunyk!va7D-{?8 z7j0P`4~kr8!cqn1jg}QZBXWZk|Ed@T|IT-l0Iz^iOh7vze^Z;WPIUMc#pnug6i2tv ze>gm}hGd5!i0=)c*oh6er1*@+r$W58;he_5(f9&%FTREj#bw3&LoDJ>_-Qv@pDMDi zUg!<37$r=v`}vyI=#6!MFoP)YYK4C}azc0Gb?N?**RH~9!O$@$_iugY&Qq}YU#TQ~ z%W_|s6S(`_@rItg{w07I7=IO#e;J~h1`$*l0@GW=*B4hC{;=+sRJY5e``zQ|vsF(b z?70{Grg+0en4~#ZojGI%-HuG_U{GD?4kfpbs2@g+f_&r*b#ly=Gi|p%3dH9@+Hh}g zV5WJf%Nq`Za!_@oD$jWdPQw}xcpMO@=6tBvq~18dFET+RdDW_tB{lMHskz_Q?VHIC y*<{(}vu$-F&;K_P)W{sS(45-7aSG8*xCcH2v8<^zF-nXISu#^F$bh0Nr2hv~Y~NP^ diff --git a/internal/ebpf/prociter_bpfel.go b/internal/ebpf/prociter_bpfel.go index 7871faf59..4a2d9ae32 100644 --- a/internal/ebpf/prociter_bpfel.go +++ b/internal/ebpf/prociter_bpfel.go @@ -14,10 +14,16 @@ import ( ) type prociterScratchValue struct { - _ structs.HostLayout - Arg0 uint64 - Arg1 uint64 - Filename [256]uint8 + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 } // loadProciter returns the embedded CollectionSpec for prociter. @@ -69,9 +75,11 @@ type prociterProgramSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type prociterMapSpecs struct { - DropCount *ebpf.MapSpec `ebpf:"drop_count"` - Events *ebpf.MapSpec `ebpf:"events"` - Scratch *ebpf.MapSpec `ebpf:"scratch"` + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` } // prociterVariableSpecs contains global variables before they are loaded into the kernel. @@ -100,16 +108,20 @@ func (o *prociterObjects) Close() error { // // It can be passed to loadProciterObjects or ebpf.CollectionSpec.LoadAndAssign. type prociterMaps struct { - DropCount *ebpf.Map `ebpf:"drop_count"` - Events *ebpf.Map `ebpf:"events"` - Scratch *ebpf.Map `ebpf:"scratch"` + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` } func (m *prociterMaps) Close() error { return _ProciterClose( m.DropCount, + m.Enabled, m.Events, m.Scratch, + m.ScratchHeap, ) } diff --git a/internal/ebpf/prociter_bpfel.o b/internal/ebpf/prociter_bpfel.o index 1be845f7dccce2791d7e254033f6297c0310c045..61b46d42608293c8bb833ed9ab123a233cab4864 100644 GIT binary patch delta 2657 zcmZuyZA_b06h6KEpzZi5&{Eh36hT11t&A~1$E>(yXr_TV6EsfRK?h_w3!8C@rj5>R zMt?x=g8a~lWFjUmL2(&6qs_LM8TW%2O;Be9S|;d7(irRtCxJ+dpl-$17VZ>o7j6>{2{#D`g{y=E!i6Ts$2^j73X|{+9uGczRd`8wQFuXk zUihMLQg}{yMtE9yLU`QZZNp9gv49kwMA0un$!a2t>Weg_cQ)p(@$cRTza0M3n#kFOn#>%kmu z=ndcy8#C11DTP-yibh#H3ms4nR4q6kjK9nv^rH~G4{gwV2)K@8Ky(0lP;>}-7@9wt z0FH`ILLY~&2Xn_KfCk7AcnZj)MstTw!$49JETJ}~6eeUIDI=j;K_BVe8EfL3p|BIg z^AGZt$XYZ&G$Y5+41Fg!0JKOx1l=n6F!Xk4eAot}2k^K9%(0UbI1YTiI#<+eAuUZ{Y>=wd@vXp3fzCyKZpSv{b-x1b`YAhyd`V*?A88t^7c6Pv4q7Ww1Y? zUv$16j12W|Bs}VA??9yY03959a({Q^V6=x~ksjLHKM>s?c|7``*r=;rCEf$wLy?2s zeO-OgNQ_XhXCT@$+vd7v)myU4Kr4A!Z?9O;x0}cSJWp3_p#rkh%a$|Ar%P- z_Iwe$LyE@5zr^+16itgCgI7Bg&51w5{-mOy)qMXlymwkrlQq7a$U`E80-li-?8b%C zCf*Bnq4#$2W$aI4AmZ!6?g^r>_=mu2XYkWW^IrI4;tzw>2Sn3xNt^@cevFGt{10G9 zl4wr+6|nCDej;gp75qi%JO+xMP~5LR4H5Lf#%!hQ}Ko3Q|(x-xKYr7k8s4m{6a$f z_zFKQ{u62E)#3V7hrAl>9T*%3&%Oy970;7pe?&Zye#EoB=oHtI)tH+hh#ue$@2=O2j4w;=q(iioBqqQ*)pQ*a{bL6$mZhi2uf=}xK{G*EAmfBKBhZz zH|)G@H=B9*d@U@cc_;k!H1Fn8^O7>IN#3B$G@l7y?wEZ)_nJ~(pMJ|*o0)!7=y`8r zhTIm~;d|aePvHft?y%;&e(^&hPV0AkU6$?ob6<(VEUOEOSKos){%=qSNRNb9??#%u&SL2Ibm&~hnmHy3FTzVAw|NF>7*0Zy1q0f{Gnd{-z zshrmet8T|~2pS*?MwMx*Tba)ROVAIXkjP3bAG$6@vaqMk@wz?gqWQZn<6Hr2-U|CQ zv;)d=4cZAUKt;57Hkb5T3F2mr*iYX8f}Mo+!mq)K=ZnuJRSR0rw{*T0C4Mf^T~@O&j6!@!tan%yqlFo6eYPb_H-O&zb9(i{luw76d#XNKsl;uxeP|$P`_YiIc zhsV8I&L8FcYeY%OSHR6BqMYzKu7ArL-52oZnBP@AI)^x*@qmP<745?YW`3~3qlzYl zVO%L;<$MNt`*}qb;T>GRPtlCQ z@JHZqjc8i|-13)FiNz3vS?3 z;A0y+Cwu^T{VUP$!biaBkEQ3Oo;+C%b6flG|&NY$v+vueoXQ`!8&vV(C)zYLgDse~Sj znNL%l>M3&*Fc>iRQp47WoPL*iIGt6mm|{Aywj#09mcNJlN&H{nWpqtOVqUCZuBJEX qhZ@bj^suhQ%uuFN?J&hm!m7%FLpX3&9WbX58|4QE5;0dZ+5Z5W+U8*Z diff --git a/internal/ebpf/source.go b/internal/ebpf/source.go index e335732cd..69583b889 100644 --- a/internal/ebpf/source.go +++ b/internal/ebpf/source.go @@ -109,6 +109,11 @@ func (e *EventSource) Open(cfg *config.Config) error { } e.loader = ldr + if err := ldr.setEnabledTypes(&e.config.EventSource); err != nil { + _ = ldr.Close() + return err + } + rd, err := newRingReader(ldr.eventsMap()) if err != nil { _ = ldr.Close() diff --git a/internal/ebpf/source_test.go b/internal/ebpf/source_test.go index c57fbaf18..7d01d2d1a 100644 --- a/internal/ebpf/source_test.go +++ b/internal/ebpf/source_test.go @@ -32,6 +32,9 @@ import ( func testConfig() *config.Config { cfg := &config.Config{ForwardMode: true} + cfg.EventSource.EnableFileIOEvents = true + cfg.EventSource.EnableNetEvents = true + cfg.EventSource.EnableMemEvents = true cfg.EventSource.Init() return cfg } From 561d6d6960459c4bf984f22248369338088d6d37 Mon Sep 17 00:00:00 2001 From: Mostafa Moradian Date: Tue, 15 Sep 2026 10:33:32 +0200 Subject: [PATCH 3/5] feat(ebpf): Capture file, network, memory, and process-control syscalls Add one CO-RE program per family for openat/unlink/rename, connect/accept, mmap/process_vm_readv/writev, and kill/ptrace/prctl. Optional families follow the existing enable-fileio, enable-net, and enable-mem switches, process-control events stay on, and accept reads the peer address on syscall exit because the kernel fills it then. --- internal/ebpf/c/common/events.h | 29 +++++ internal/ebpf/c/ctl.bpf.c | 106 +++++++++++++++++ internal/ebpf/c/file.bpf.c | 158 +++++++++++++++++++++++++ internal/ebpf/c/mem.bpf.c | 81 +++++++++++++ internal/ebpf/c/net.bpf.c | 103 ++++++++++++++++ internal/ebpf/consumer.go | 21 ++++ internal/ebpf/ctl_bpfeb.go | 186 +++++++++++++++++++++++++++++ internal/ebpf/ctl_bpfeb.o | Bin 0 -> 47768 bytes internal/ebpf/ctl_bpfel.go | 186 +++++++++++++++++++++++++++++ internal/ebpf/ctl_bpfel.o | Bin 0 -> 47288 bytes internal/ebpf/doc.go | 9 +- internal/ebpf/events.go | 62 ++++++++-- internal/ebpf/file_bpfeb.go | 204 ++++++++++++++++++++++++++++++++ internal/ebpf/file_bpfeb.o | Bin 0 -> 77952 bytes internal/ebpf/file_bpfel.go | 204 ++++++++++++++++++++++++++++++++ internal/ebpf/file_bpfel.o | Bin 0 -> 77184 bytes internal/ebpf/generate.sh | 6 +- internal/ebpf/loader.go | 142 +++++++++++++++++++++- internal/ebpf/mem_bpfeb.go | 174 +++++++++++++++++++++++++++ internal/ebpf/mem_bpfeb.o | Bin 0 -> 32240 bytes internal/ebpf/mem_bpfel.go | 174 +++++++++++++++++++++++++++ internal/ebpf/mem_bpfel.o | Bin 0 -> 31952 bytes internal/ebpf/net.go | 85 +++++++++++++ internal/ebpf/net_bpfeb.go | 174 +++++++++++++++++++++++++++ internal/ebpf/net_bpfeb.o | Bin 0 -> 33648 bytes internal/ebpf/net_bpfel.go | 174 +++++++++++++++++++++++++++ internal/ebpf/net_bpfel.o | Bin 0 -> 33360 bytes internal/ebpf/source.go | 2 +- pkg/event/metainfo_linux.go | 41 ++----- pkg/event/params/names_linux.go | 4 + 30 files changed, 2278 insertions(+), 47 deletions(-) create mode 100644 internal/ebpf/c/ctl.bpf.c create mode 100644 internal/ebpf/c/file.bpf.c create mode 100644 internal/ebpf/c/mem.bpf.c create mode 100644 internal/ebpf/c/net.bpf.c create mode 100644 internal/ebpf/ctl_bpfeb.go create mode 100644 internal/ebpf/ctl_bpfeb.o create mode 100644 internal/ebpf/ctl_bpfel.go create mode 100644 internal/ebpf/ctl_bpfel.o create mode 100644 internal/ebpf/file_bpfeb.go create mode 100644 internal/ebpf/file_bpfeb.o create mode 100644 internal/ebpf/file_bpfel.go create mode 100644 internal/ebpf/file_bpfel.o create mode 100644 internal/ebpf/mem_bpfeb.go create mode 100644 internal/ebpf/mem_bpfeb.o create mode 100644 internal/ebpf/mem_bpfel.go create mode 100644 internal/ebpf/mem_bpfel.o create mode 100644 internal/ebpf/net.go create mode 100644 internal/ebpf/net_bpfeb.go create mode 100644 internal/ebpf/net_bpfeb.o create mode 100644 internal/ebpf/net_bpfel.go create mode 100644 internal/ebpf/net_bpfel.o diff --git a/internal/ebpf/c/common/events.h b/internal/ebpf/c/common/events.h index f44b374f8..912371a90 100644 --- a/internal/ebpf/c/common/events.h +++ b/internal/ebpf/c/common/events.h @@ -248,3 +248,32 @@ static __always_inline int store_scratch(struct scratch_value *val) return bpf_map_update_elem(&scratch, &key, val, BPF_ANY); } + +static __always_inline int submit_from_scratch(u32 type, long ret, u32 syscall_id) +{ + u64 key = bpf_get_current_pid_tgid(); + struct scratch_value *val; + struct syscall_event *e; + + if (!type_enabled(type)) { + bpf_map_delete_elem(&scratch, &key); + return 0; + } + + e = reserve_event(); + if (!e) { + bpf_map_delete_elem(&scratch, &key); + return 0; + } + + e->type = type; + e->syscall_id = syscall_id; + e->retval = ret; + fill_current_task(e); + val = bpf_map_lookup_elem(&scratch, &key); + if (val) + copy_scratch(e, val); + bpf_map_delete_elem(&scratch, &key); + bpf_ringbuf_submit(e, 0); + return 0; +} diff --git a/internal/ebpf/c/ctl.bpf.c b/internal/ebpf/c/ctl.bpf.c new file mode 100644 index 000000000..a237c8360 --- /dev/null +++ b/internal/ebpf/c/ctl.bpf.c @@ -0,0 +1,106 @@ +//go:build ignore + +#include "common/events.h" +#include "bpf_tracing.h" + +char LICENSE[] SEC("license") = "Dual MIT/GPL"; + +static __always_inline int handle_kill_enter(u64 pid, u64 sig) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_KILL)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = pid; + val->arg1 = sig; + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_enter_kill") +int handle_sys_enter_kill(struct trace_event_raw_sys_enter *ctx) +{ + return handle_kill_enter(ctx->args[0], ctx->args[1]); +} + +SEC("tp/syscalls/sys_exit_kill") +int handle_sys_exit_kill(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_tkill") +int handle_sys_enter_tkill(struct trace_event_raw_sys_enter *ctx) +{ + return handle_kill_enter(ctx->args[0], ctx->args[1]); +} + +SEC("tp/syscalls/sys_exit_tkill") +int handle_sys_exit_tkill(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_tgkill") +int handle_sys_enter_tgkill(struct trace_event_raw_sys_enter *ctx) +{ + return handle_kill_enter(ctx->args[0], ctx->args[2]); +} + +SEC("tp/syscalls/sys_exit_tgkill") +int handle_sys_exit_tgkill(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_ptrace") +int handle_sys_enter_ptrace(struct trace_event_raw_sys_enter *ctx) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_PTRACE)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = ctx->args[0]; /* request */ + val->arg1 = ctx->args[1]; /* pid */ + val->arg2 = ctx->args[2]; /* addr */ + val->arg3 = ctx->args[3]; /* data */ + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_exit_ptrace") +int handle_sys_exit_ptrace(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_PTRACE, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_prctl") +int handle_sys_enter_prctl(struct trace_event_raw_sys_enter *ctx) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_PRCTL)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = ctx->args[0]; + val->arg1 = ctx->args[1]; + val->arg2 = ctx->args[2]; + val->arg3 = ctx->args[3]; + val->flags = ctx->args[4]; + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_exit_prctl") +int handle_sys_exit_prctl(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_PRCTL, ctx->ret, (u32)ctx->id); +} diff --git a/internal/ebpf/c/file.bpf.c b/internal/ebpf/c/file.bpf.c new file mode 100644 index 000000000..fe991bbd6 --- /dev/null +++ b/internal/ebpf/c/file.bpf.c @@ -0,0 +1,158 @@ +//go:build ignore + +#include "common/events.h" +#include "bpf_tracing.h" + +char LICENSE[] SEC("license") = "Dual MIT/GPL"; + +static __always_inline int handle_openat_enter(s64 dirfd, const char *pathname, u64 flags, u64 mode) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_OPENAT)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = (u64)dirfd; + val->arg1 = mode; + val->flags = flags; + val->truncated |= read_user_str(val->filename, sizeof(val->filename), pathname); + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_enter_open") +int handle_sys_enter_open(struct trace_event_raw_sys_enter *ctx) +{ + return handle_openat_enter(-100 /* AT_FDCWD */, (const char *)ctx->args[0], ctx->args[1], ctx->args[2]); +} + +SEC("tp/syscalls/sys_exit_open") +int handle_sys_exit_open(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_OPENAT, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_openat") +int handle_sys_enter_openat(struct trace_event_raw_sys_enter *ctx) +{ + return handle_openat_enter((s64)ctx->args[0], (const char *)ctx->args[1], ctx->args[2], ctx->args[3]); +} + +SEC("tp/syscalls/sys_exit_openat") +int handle_sys_exit_openat(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_OPENAT, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_openat2") +int handle_sys_enter_openat2(struct trace_event_raw_sys_enter *ctx) +{ + struct open_how how = {}; + + if (ctx->args[2]) + bpf_probe_read_user(&how, sizeof(how), (const void *)ctx->args[2]); + return handle_openat_enter((s64)ctx->args[0], (const char *)ctx->args[1], how.flags, how.mode); +} + +SEC("tp/syscalls/sys_exit_openat2") +int handle_sys_exit_openat2(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_OPENAT, ctx->ret, (u32)ctx->id); +} + +static __always_inline int handle_unlink_enter(s64 dirfd, const char *pathname, u64 flags) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_UNLINK)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = (u64)dirfd; + val->flags = flags; + val->truncated |= read_user_str(val->filename, sizeof(val->filename), pathname); + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_enter_unlink") +int handle_sys_enter_unlink(struct trace_event_raw_sys_enter *ctx) +{ + return handle_unlink_enter(-100 /* AT_FDCWD */, (const char *)ctx->args[0], 0); +} + +SEC("tp/syscalls/sys_exit_unlink") +int handle_sys_exit_unlink(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_UNLINK, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_unlinkat") +int handle_sys_enter_unlinkat(struct trace_event_raw_sys_enter *ctx) +{ + return handle_unlink_enter((s64)ctx->args[0], (const char *)ctx->args[1], ctx->args[2]); +} + +SEC("tp/syscalls/sys_exit_unlinkat") +int handle_sys_exit_unlinkat(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_UNLINK, ctx->ret, (u32)ctx->id); +} + +static __always_inline int handle_rename_enter(s64 olddirfd, const char *oldpath, s64 newdirfd, const char *newpath, u64 flags) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_RENAME)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = (u64)olddirfd; + val->arg1 = (u64)newdirfd; + val->flags = flags; + val->truncated |= read_user_str(val->filename, sizeof(val->filename), oldpath); + if (read_user_str(val->filename2, sizeof(val->filename2), newpath)) + val->truncated |= TRUNC_FILENAME2; + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_enter_rename") +int handle_sys_enter_rename(struct trace_event_raw_sys_enter *ctx) +{ + return handle_rename_enter(-100 /* AT_FDCWD */, (const char *)ctx->args[0], -100, (const char *)ctx->args[1], 0); +} + +SEC("tp/syscalls/sys_exit_rename") +int handle_sys_exit_rename(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_RENAME, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_renameat") +int handle_sys_enter_renameat(struct trace_event_raw_sys_enter *ctx) +{ + return handle_rename_enter((s64)ctx->args[0], (const char *)ctx->args[1], (s64)ctx->args[2], (const char *)ctx->args[3], 0); +} + +SEC("tp/syscalls/sys_exit_renameat") +int handle_sys_exit_renameat(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_RENAME, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_renameat2") +int handle_sys_enter_renameat2(struct trace_event_raw_sys_enter *ctx) +{ + return handle_rename_enter((s64)ctx->args[0], (const char *)ctx->args[1], (s64)ctx->args[2], (const char *)ctx->args[3], ctx->args[4]); +} + +SEC("tp/syscalls/sys_exit_renameat2") +int handle_sys_exit_renameat2(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_RENAME, ctx->ret, (u32)ctx->id); +} diff --git a/internal/ebpf/c/mem.bpf.c b/internal/ebpf/c/mem.bpf.c new file mode 100644 index 000000000..de77d9c6e --- /dev/null +++ b/internal/ebpf/c/mem.bpf.c @@ -0,0 +1,81 @@ +//go:build ignore + +#include "common/events.h" +#include "bpf_tracing.h" + +char LICENSE[] SEC("license") = "Dual MIT/GPL"; + +struct iovec { + u64 iov_base; + u64 iov_len; +}; + +SEC("tp/syscalls/sys_enter_mmap") +int handle_sys_enter_mmap(struct trace_event_raw_sys_enter *ctx) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_MMAP)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = ctx->args[5]; /* offset */ + val->arg1 = ctx->args[1]; /* length */ + val->arg2 = ctx->args[2]; /* prot */ + val->arg3 = ctx->args[4]; /* fd */ + val->flags = ctx->args[3]; + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_exit_mmap") +int handle_sys_exit_mmap(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_MMAP, ctx->ret, (u32)ctx->id); +} + +static __always_inline int handle_process_vm_enter(u32 type, u64 pid, const void *rvec, u64 flags) +{ + struct scratch_value *val; + struct iovec iov = {}; + + if (!type_enabled(type)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = pid; + val->flags = flags; + if (rvec) { + bpf_probe_read_user(&iov, sizeof(iov), rvec); + val->arg2 = iov.iov_base; + val->arg3 = iov.iov_len; + } + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_enter_process_vm_readv") +int handle_sys_enter_process_vm_readv(struct trace_event_raw_sys_enter *ctx) +{ + return handle_process_vm_enter(EVT_TYPE_PROCESS_VM_READ, ctx->args[0], (const void *)ctx->args[3], ctx->args[5]); +} + +SEC("tp/syscalls/sys_exit_process_vm_readv") +int handle_sys_exit_process_vm_readv(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_PROCESS_VM_READ, ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_process_vm_writev") +int handle_sys_enter_process_vm_writev(struct trace_event_raw_sys_enter *ctx) +{ + return handle_process_vm_enter(EVT_TYPE_PROCESS_VM_WRITE, ctx->args[0], (const void *)ctx->args[3], ctx->args[5]); +} + +SEC("tp/syscalls/sys_exit_process_vm_writev") +int handle_sys_exit_process_vm_writev(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_PROCESS_VM_WRITE, ctx->ret, (u32)ctx->id); +} diff --git a/internal/ebpf/c/net.bpf.c b/internal/ebpf/c/net.bpf.c new file mode 100644 index 000000000..8f4269daa --- /dev/null +++ b/internal/ebpf/c/net.bpf.c @@ -0,0 +1,103 @@ +//go:build ignore + +#include "common/events.h" +#include "bpf_tracing.h" + +char LICENSE[] SEC("license") = "Dual MIT/GPL"; + +/* Copy exactly addrlen bytes: a fixed-size read past the caller's sockaddr + * can cross into an unmapped page and fail wholesale, losing the address. + */ +static __always_inline void read_sockaddr(struct scratch_value *val, const void *addr, u64 addrlen) +{ + u64 len = addrlen; + + if (len > sizeof(val->filename2)) { + len = sizeof(val->filename2); + val->truncated |= TRUNC_FILENAME2; + } + if (addr && len) + bpf_probe_read_user(val->filename2, len, addr); +} + +SEC("tp/syscalls/sys_enter_connect") +int handle_sys_enter_connect(struct trace_event_raw_sys_enter *ctx) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_CONNECT)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = ctx->args[0]; + val->arg1 = ctx->args[2]; + read_sockaddr(val, (const void *)ctx->args[1], ctx->args[2]); + store_scratch(val); + return 0; +} + +SEC("tp/syscalls/sys_exit_connect") +int handle_sys_exit_connect(struct trace_event_raw_sys_exit *ctx) +{ + return submit_from_scratch(EVT_TYPE_CONNECT, ctx->ret, (u32)ctx->id); +} + +static __always_inline int handle_accept_enter(u64 fd, const void *addr, const void *addrlen, u64 flags) +{ + struct scratch_value *val; + + if (!type_enabled(EVT_TYPE_ACCEPT)) + return 0; + val = borrow_scratch(); + if (!val) + return 0; + val->arg0 = fd; + val->arg1 = (u64)addrlen; + val->arg2 = (u64)addr; + val->flags = flags; + store_scratch(val); + return 0; +} + +/* addrlen is value-result: the kernel writes the peer address and its actual + * size only once accept returns, so the sockaddr is copied at exit. + */ +static __always_inline int handle_accept_exit(long ret, u32 syscall_id) +{ + u64 key = bpf_get_current_pid_tgid(); + struct scratch_value *val; + u32 addrlen = 0; + + val = bpf_map_lookup_elem(&scratch, &key); + if (val && val->arg2 && ret >= 0) { + if (val->arg1) + bpf_probe_read_user(&addrlen, sizeof(addrlen), (const void *)val->arg1); + read_sockaddr(val, (const void *)val->arg2, addrlen); + } + return submit_from_scratch(EVT_TYPE_ACCEPT, ret, syscall_id); +} + +SEC("tp/syscalls/sys_enter_accept") +int handle_sys_enter_accept(struct trace_event_raw_sys_enter *ctx) +{ + return handle_accept_enter(ctx->args[0], (const void *)ctx->args[1], (const void *)ctx->args[2], 0); +} + +SEC("tp/syscalls/sys_exit_accept") +int handle_sys_exit_accept(struct trace_event_raw_sys_exit *ctx) +{ + return handle_accept_exit(ctx->ret, (u32)ctx->id); +} + +SEC("tp/syscalls/sys_enter_accept4") +int handle_sys_enter_accept4(struct trace_event_raw_sys_enter *ctx) +{ + return handle_accept_enter(ctx->args[0], (const void *)ctx->args[1], (const void *)ctx->args[2], ctx->args[3]); +} + +SEC("tp/syscalls/sys_exit_accept4") +int handle_sys_exit_accept4(struct trace_event_raw_sys_exit *ctx) +{ + return handle_accept_exit(ctx->ret, (u32)ctx->id); +} diff --git a/internal/ebpf/consumer.go b/internal/ebpf/consumer.go index ca1d022cf..1c5e57168 100644 --- a/internal/ebpf/consumer.go +++ b/internal/ebpf/consumer.go @@ -27,6 +27,7 @@ import ( "github.com/rabbitstack/fibratus/pkg/event/params" "github.com/rabbitstack/fibratus/pkg/ps" pstypes "github.com/rabbitstack/fibratus/pkg/ps/types" + "github.com/rabbitstack/fibratus/pkg/util/va" ) var ( @@ -62,6 +63,17 @@ func applyProcessState(psnap ps.Snapshotter, evt *event.Event) { evt.PS = existing _ = psnap.AddThread(evt) } + case evt.Type == event.Mmap && succeeded(evt): + ok, existing := psnap.Find(evt.PID) + if ok && existing != nil { + evt.PS = existing + existing.AddMmap(pstypes.Mmap{ + BaseAddress: va.Address(evt.GetParamAsUint64(params.MemBaseAddress)), + Size: evt.GetParamAsUint64(params.MemRegionSize), + Protection: evt.GetParamAsUint32(params.MemProtect), + Type: mmapKind(evt.GetParamAsUint64(params.MmapFlags)), + }) + } case evt.Type == event.Exit: ok, existing := psnap.Find(evt.PID) if ok { @@ -169,6 +181,15 @@ func succeeded(evt *event.Event) bool { return ret >= 0 } +const mapAnonymous = 0x20 + +func mmapKind(flags uint64) string { + if flags&mapAnonymous != 0 { + return "anonymous" + } + return "file" +} + func enrichEvent(evt *event.Event) { if evt == nil { return diff --git a/internal/ebpf/ctl_bpfeb.go b/internal/ebpf/ctl_bpfeb.go new file mode 100644 index 000000000..7771745ab --- /dev/null +++ b/internal/ebpf/ctl_bpfeb.go @@ -0,0 +1,186 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (mips || mips64 || ppc64 || s390x) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type ctlScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadCtl returns the embedded CollectionSpec for ctl. +func loadCtl() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_CtlBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load ctl: %w", err) + } + + return spec, err +} + +// loadCtlObjects loads ctl and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *ctlObjects +// *ctlPrograms +// *ctlMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadCtlObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadCtl() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// ctlSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlSpecs struct { + ctlProgramSpecs + ctlMapSpecs + ctlVariableSpecs +} + +// ctlProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlProgramSpecs struct { + HandleSysEnterKill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_kill"` + HandleSysEnterPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_enter_prctl"` + HandleSysEnterPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_enter_ptrace"` + HandleSysEnterTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tgkill"` + HandleSysEnterTkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tkill"` + HandleSysExitKill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_kill"` + HandleSysExitPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_exit_prctl"` + HandleSysExitPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_exit_ptrace"` + HandleSysExitTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tgkill"` + HandleSysExitTkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tkill"` +} + +// ctlMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// ctlVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlVariableSpecs struct { +} + +// ctlObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlObjects struct { + ctlPrograms + ctlMaps + ctlVariables +} + +func (o *ctlObjects) Close() error { + return _CtlClose( + &o.ctlPrograms, + &o.ctlMaps, + ) +} + +// ctlMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *ctlMaps) Close() error { + return _CtlClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// ctlVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlVariables struct { +} + +// ctlPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlPrograms struct { + HandleSysEnterKill *ebpf.Program `ebpf:"handle_sys_enter_kill"` + HandleSysEnterPrctl *ebpf.Program `ebpf:"handle_sys_enter_prctl"` + HandleSysEnterPtrace *ebpf.Program `ebpf:"handle_sys_enter_ptrace"` + HandleSysEnterTgkill *ebpf.Program `ebpf:"handle_sys_enter_tgkill"` + HandleSysEnterTkill *ebpf.Program `ebpf:"handle_sys_enter_tkill"` + HandleSysExitKill *ebpf.Program `ebpf:"handle_sys_exit_kill"` + HandleSysExitPrctl *ebpf.Program `ebpf:"handle_sys_exit_prctl"` + HandleSysExitPtrace *ebpf.Program `ebpf:"handle_sys_exit_ptrace"` + HandleSysExitTgkill *ebpf.Program `ebpf:"handle_sys_exit_tgkill"` + HandleSysExitTkill *ebpf.Program `ebpf:"handle_sys_exit_tkill"` +} + +func (p *ctlPrograms) Close() error { + return _CtlClose( + p.HandleSysEnterKill, + p.HandleSysEnterPrctl, + p.HandleSysEnterPtrace, + p.HandleSysEnterTgkill, + p.HandleSysEnterTkill, + p.HandleSysExitKill, + p.HandleSysExitPrctl, + p.HandleSysExitPtrace, + p.HandleSysExitTgkill, + p.HandleSysExitTkill, + ) +} + +func _CtlClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed ctl_bpfeb.o +var _CtlBytes []byte diff --git a/internal/ebpf/ctl_bpfeb.o b/internal/ebpf/ctl_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..d6052ea8643f8f168329f571194e3a8d8027ffc2 GIT binary patch literal 47768 zcmeI53yfpedEXDonIU(jU5#Qr=trWviYjyE^@_6(i7VSOCGENnI?8i1OYrL+?Z_)b=ssAix}8}Z6r(@6jQ({*hX!qZ4j_^ z(vFKH9iR{O|DE%{n7eV-ltp{|6 z+@)?)JJc;|o4QGDQ8%bf>N>SSU8B~iHENYwp_ZvdYMwex%~7+|3^h$nQ3Gm{I!R4X zMNogUOWmP%soT^Jb&J}jZcu+rQUA@o6dnG#%Kl+M8^Cc>-ADiFh&${b}*MsD< zBSF3o*Hcu|39qM5P8wS?bzSZZxh`YlCh}vp9BcAvj1KooAl7L072CSK>-nd{cKc+} z?3WO;|KN?aTR0!wYF_(}#AE#6DUq~@v9)EqTS%}~?S6g8kGsgu+MRRs0td@yfz$X)6-wL{&awyB%c7IlN# zq^?sN)HQ0ITBBB}6>6DUq~@v9)EqTS%}~?S6g8kGsgu+MRV17T#;+8O%cpDtvCm#G z?-A`?uQNiu@CUEj(qcZj-PteL)J^b$vjTQ-y+@)J~*QJ?cI-&k(SPqsmef549@1`lISKrl7N7iemlVCc}Uw)Un zj<3v^X$i@6Cco!&9&qX0ns)VLI%BU>jLn-Bb}WSbATM$U?Y>tve`c#S+w z{{}fvUMCmHO>&vML9UQn+6hLuMuB@p}nFx7oO|wOf*a05ruz- z+$E>U+hkkL%adG>XI#0!TlBZ(0=LPwT;NS|LKNI0iwJKxcI5&$$vgC4CwIvW@-}&m z+#%P=TjUzKO|FtR$rZ9K7xFKYH|Sp^H_3VOI(eGhAm_+y9qvYWopdqrdGp zaD`l^7O8paG}VodL?lbjP~A94L{j8{nxsxr6I7AWezItrAsqjs{iGcwu1)0A%@3pf zB=(ux(jL$bb&J}jZc(SFjlf*I{6NBc<`3D?@+j`ou>PmK1HcBUBZCrA5983@?VZ;N98w2QYo==XRPbTbjG0*$lqvw;-9Haf@Xg?|AV6>kcJ)hi=fq?z< zt|<18Eyr%Y9PKAZ`$>+6ZPC$wQd*(+{c_Lq$*VKYpYL}ZcoXlr&Pqz*dwF=z)u#MP z#ic*{)$i?nIq&`1yrgg?&gb%RK97%coX7cITb$3`<9yy8=X3Tr-)oEWy|y@?L&W(U zBF=qeocqW)pG(I1Tr$q*l5swljPtocB-99SL=aTVAhW0eo?W5w6fSjaGQr-8)IKMZ>-TZhZZg!l%=~B0;9qJafP2Hrn zs2kKKb)DLvu2JjM8nsHTP|MUJHBX(U=BQa}hMK0Pr~x%eounqHA_njMIJ;{OVHZB) z-p>LD67EXGg$v&k0^4xm`<{G{>96X!=9{@5?S&9tkE8cw-TO6oKh}+>(R;G)dYX^8 z>tH_Ou8;YMyKd&)`(1cmE0@XWxu$J}*WHI6zpw%zy`J=c_W;JWyF`_O}LVjo(Pe8TU&*oWGE>GxqD z`jn(Q+K2M}*wH>TaN~jd$~gC%;q%P6_`dmlDE6gkNeBDVK=f_0FMTuD=V)Il{W%}a zLPRrE*UzJUY09-nB%mg#lhg!NWVA1}t?;`0(u1RYscWb>M$t9@4s^6Hl?EE^OGo?C zEg1-S|I*I8*vEFrfhc%e6#jOe26xGJ{Q~ch?YaiuC1*wPJWfR7=S0D7KA&;VLBO~| zt$&{WNpg`Kkjvy0x#D>A_nT}F+Ye~Zb#m9W51(6&-nW(J;NNEr-k@aWU>~E>)bP>jSGYsmqH*b}W zBtK;*5@T+H`y|~`rVp?{QpW&iSSR^?gdD@Y1MahQ%ipJ*V;nJMaY`M-_)^DxV#6VI zya8txr`&fqfU|~k9_P(CH*qep?)XWAfx6p1yGGq@+N`_%^@_b=TuB*5ey8I_6b|w1 zv#mPV{`Ld(=jqNuf06DQ^zYKW3H=r4wl)5HaHF`9Ec9!17oi(C1K4ZOf9~A-#QjaS znY6=i(|rfr|AOr&V$EJ1ei$|s*M)!s|0HcYc5a8tA?ZmwXK_lqN?X=&O1sK9-NgBC z*sh1*wu!Ml?gH-_t1#Iytn&L&35(-;{TSx=ADQ1@LwG;GlqBHQPl^%NDI9B3XEBC$ zJ%-*3?<`I|h7QBFiSxfPZ~65xKkxU0{{o3h-LmkK@qQF1j);s4=?mB*l8(4B<{}S5 zrHldGk3sLnnT1>CH~H0+8r+|-nYeHgzer9%C2T2Vga;4QKMj<6+V;i;AwiK}WCeNz z`T{O!u^q!H9&(&S3Qw^fQpPt?kC@~mb*kZ%3)0X31o8>E49pv ze*-G^BJ3?hlx!gJtI&sV;)sXWIEG;ScU7227-q{B%FZ2o+8lkp?+@AMrzQN}KG}be z{*PY6AMy8pnEvReYsUX|`hWBq{u2M+)Bo%>{4pkOyq*4!U&9~qZ(O7Q^fmku|G+<{ z|2gsZ=7O+qQ00T~MFYxl9w*xQ;JsL=#;t{Y3b%~=+h_}*cY5x-J@@?hj`W)x zcx}oa$Zz7yve?>VesR?l3J;w-_t2AtCmwt1OyT^K(`O0=vwFEwG8bp6h0@~c@_cE< zls*I3in(K$5t0-w83}vu9pdTD%a*hk34a*?eYZ;Zn)WEiY9H zvrCr{V`X-EW_7k)a2_+u7t#hFQ}S_4K8~Ab7iKQ3nAPP=i?cJUr8!fXnKRGMFO(K% zE|z)@lp`ZKXZjh>mS>j3mr55atE@w4oS!rJheD%$!d6)+FD@ZVAx%=+mo~1>Y=AR8xhr}P*+lEb@`P6wgfPU<;vu6(HeNi*!U}#p1Fw7&n_=rEHL-M zCTFK3iz7h_ZGYH~f%&;!OAhpw?b^e^6|=9zc37TYyztDWXA8@vmD2KON*D+Bs_!>( z=`dQnms-h2mOge(DP3%@ZYH;9SoN=e*J{0#Y%JTyE0-5%3(uBhYQRNOn3HQC`&R;C8tj=7l6c$%ln&-q;kgi@_v7L)xXesm?0>FXPVc`{6 zn4g2S56)9s3}z7+WDMD0GCYP3AzK(p%yx(!d}6`~gAE@KJ{TN7#?&s&&pEqJ5gvtb zOd>YMC?Yc%S2TnO^Khv+vrCTYhFR&^t z>kh+NaM62TCqloT0saG%%WUPcy(Yr19Cn6B!u$r}UnZf=UMkm3q|57wjSFJS=-?zy)gP_B`Fz$q6{CLceL zTr&MY$6O$+qRRuJ)$4voah1Q$x0Jm-wu~>n z!#d3RUAw=;>-*AO=N>t4zsU~mt?Tqp-)m2=^u6|U1--%|>9ddHjhp<|rnl6|*ouTUuO^`%#AXm;<|)H0CQ%oOjIOb^^BjQEYwX zo{-3~}{C7Nl0&eWBZ5iJIHxBuGp2%++Q$7rk@`o(<`%;c2oITQD{C;=j|Cne+ zw$(Yu(ZeRXD)q-b8u7P`?YP`ek@TXt50sYsU={ioOzdmIHOFwdqfY-t6Kf@4S|_iY z*w-ce2Km=b>|0T!y9Ji?zm1|G|7eH&$Htr%?lSzYiM=Yk<1x~cI~2COOfQB!g=2S^ z*dO73SS$@j`nG+LpY2O~Z^YSSzlJJgk%+`YILmVHa1t!-fP8nQU6LM4Ju)slT<*v^ z|6aTL?I`ifj4$mh?OJgh`>$p!A?ei|!{v?*$72&Fx+ebHJIl%b@LI9rF9k*a_qx+a`a|L^p2$?~tFt5I{eTvApA#O!W8B zK4S^x&+?Cd-bBA8{()E#}n^0u>|fvk2O^Ib^3qH#BRiWFQjAJb0XxH$7s*7Z56-k7=QE^n?(DJ z?GEy|As;odThM>w0r|rwmc%`>@r>fE$4GCyNM10p_n^MxHN|!E7fmdX^jZG+t0s0A z`ggod|B$ylM*oiQcr4*remuvErN9%D&cDY=j}d<&MZV9Bolbyr97MV12Odd>7hCtq&X7e!I!~urURmbnQP{ zAFv*b)`!vh!1<}SUTnGR!!qW}(fZ)pBk?v^A2wwDkUfgGKI~sLrtPf{mPhMDZ+)=s zA?@}Jw3}KVwzIHtU6u7=d$c}`_7D7iIzHMzjP?)zpY0!HziaPNB{8qzkozJxV6E5@ z2po&k9x1o3_3nFQ9rx}hO?xc&J>O69}ew2_e~R-mRT=w^PxEH!TI!iU2hKHze_Ft0N0xXhfQQv){|{lUdytc zbjhbpq$>V99*aNMn*#+Cc}dn2R8s11S=JNI^9Nouk(&6+JTLyj;-4gc$wWSf_0_IF z;xCN*!uI)xzaE9_k33J2^(cq<;vcR@XmsJ;dQ^4k%X+ki^~gSpdfat|EysT{k*_=i z4$CQg3@qgwtw+YLKco9&qx)lRcRh^mk750J8$UleAoCa2BbmSKvtrDVW0(WwdGEv~ z6vx;mK7{|T5WZVr?h}sNzk2{cO2X2zHr+22i}T&zJbi% zf_&_rvDL+@D505Hyfc<6oKWz zuR6x=gdwzZj7gB#fA;KEvA84FfQI3lp%vk!oV4H2H=F2x=-cJJfbfWZy>GW;oE~G- zefvZ}BP51<%3=EZH$A)jO%C&&(DjvfQq(af_n||(*PhY;)wd6{=c9f5p7z|Q5(kc9 zeeV4oq~D&edUn4(|F&oM+w)N0KG2?>zI~uQ|7qVo(4M)zeV{!T`u2hLe5G&S)1H1o z5KN9Sd@r;Qj0ODm{IkA&pgl2n^}_4^lC;!;cUJI4kw(8g|G=~R?fH4n?zgA>Z6VX~ zs}cQIefvOrzTCGDv}d+&A860HzI~uQ|54w*r#)Qv~^Q(RPKzmC0na)6a z{zTtC(4Jm8d)kxFpb)cn#J&q>X!qOmkNftRU*D;|eNTJd+Do?Qz&lsQgm%9@f5)@? z>A&RJ{q~f(gy{^l=QsQIf%aVQ+Xvb+-M0_4=lQ;Upgq6bxBKlG`AvB-3x3`a%VKZ$ z0y-;6V}%+(k9hX5oneps7tbzblOurrvq(Q&N30Rk!XzAbc;RW6?@#6y&n_%Sfb-uX zowz{%kaC*854)P5CH+VacE5oURKiDYhCQ5TV3R|_M<0YeydIqyFAc#ShaE-o4_p34 z*u(J_hOfhM3ifcE&~DRjAd%bsRNxNFk%l{mGeUn!=dnJ^e%^ev&n64E4)6PK!2fJN zyiN9FeV&l~yzu+C2HA|tbN%*7p}qX}uYvvk%7VT2{ekz_>y>Bvtu0Tyjr?T%jp4)* z|295k{Dr&?x3o{le*(9(U&y;~OZ$=&lW>2k&+>Ql_FAF8`5;*4n2;rJxt2qgHAb%0 zkQdxwrNZz|qWysda=kfRB(*MCu2cYK!d?Q=%4 zj1}KMuehwZs<^JWp}48IrMRuQqqwVhcaZJ;?v-Ee&-(R=r4(lr=M?7^mlanP*A+Ju zHx;)Ow-t93cNOmr@>oJ~QgKRgMsZGYUU6A*RdHQ$Lvd4aOL1FqM{!s2?jYNHL0
    ; zthlPUuDGGNsko)Mt+=DOt9W;i_a_u56{i$u6z3G@6_*uP71tFv6gL&O6t@+36n7Qx z4)P5N#Yx2}#Tmsp#d*bL#Z|?1#SO(x#Vy5c#T~_6#k+%iV?uFKaY}JUaZYhwaanOy zab0mkaZ_hoKl=o zoKu`vTvl9FTvyys+*I6B+*aIC+*Q0g$dd`hNyRC}8O1rpdBtVLRmFA14aH5xEyZoc z9mQS6yMuglLUB@YN^wSUPH|pwS#ecyU2#KkQ*ldiTX9EmSMly3|4>44QgKRgMsZGY zUU6A*RdHQ$Lvd4aOL1FqM{!s2?jXM-p*X2n<~#3x(>t#ncL-D5KEydf4cLv$Mg6*aMu1Vz|C{8QRDxOwcR9sP9Q@o~lUGawEO~qS^ zw-xUUvb<{Kx9__r6$gsbilx83=ST0B{`Oh=+h^%-pQXQjZYXXlZYgdn?kMgm-W}xk zBorqVrxa%t=M?7^mlanP*A+JuHx;)Ow-t93cNOmr@((8zCl#j@XB6iY=M|R~R~6S4 zHxxG&w-mP(cNBLO?+)^hBorqVrxa%t=M?7^mlanP*A+JuHx;)Ow-t93cNOmr@*N4q zNyRC}8O1rpdBtVLRmFA14aH5xEyZoc9mQS6yMr7g6eks*0DI53g42rSoh9FYPVuVZ z&ncGY^WO7@y!%gwWP{`LU5cf?zW-^(QeWSH0qpG$ z4!xxK3yP(_e)z8`miqes-v)c@!=XP?{AYuFr_|RAf9EZVrM}kx6Q9gK`P8R>;_1I$ zD1Pe4&p&a_99=C{SIyDo(!$Y)&p&!pp#Ou&;Sa34pV;$%4SVmeG1?#YlXUj{VtD^| z|AzdM;x%Kr-^R45`qAt!Y1-fOyk@Mvw;##<4CwG!p1&W>Cgy(8b9iRX-;d@}yG}em zfFDuv8(zqsuOG!GH9St=o1JHlE-ZZJqWpsOGJb`;_p6D1l9CU9KXYiU>F-CgSzRxl zA0YhE`=j{1=GB>J%+Zz07p-y}n()UR&p!O{slq7(x!=i2C&!&kIXP9h-vzO9($R4z zQ%*94`y|MHPEI&E<|OUpRAI`7xu1HHdYn2%%@j_$q^z89bj(TG36ip&NXjabvWldv zA}On<3MX8_t(k9 z7(Oe9tu-TAlvf23htM@_+e+^$g=< zKN9(6*oWjFtHBS4eXrFy-Demd6!|;&7?%IG3vP-~$zRrTIl}nJ-~2hwA^9I%lfdr% zT<79v7+>(aIEUo_`K$!M5!OF^PdJP(`Cr93B>$VYB=Ys^Z+;5_hUH(e(M_-ZVK^`U z$Q;59$^SjuE`BWQwD%dthapnLN0@FFZtwU!%ipVi_}+6EAN7wML4+as2Z2lMy8WL* zm?8Q9O&7gi|M0zLFaPLM2s9-B_oZC|{`>jX62=Ea<^9iL`4?^Ie*fP@4&$T#QTh9) zA^9I|y71Sle^kcxu>9AUUlA(d@T#{xy!_42!7?QOQ!N)fR(IO_4C9O8XK)V7e}^%o z9VLJHt}90vAN4m+;2e_whqCa)alQJRk0Zd4{J#)LY#c?Ll7IOAyO)3DHQ2-a!}$p& zIdaoZd+);&d*Oxe#yKp0Q3BvtbJF_^^M@h&OZW)m_X0RaZpZ0uGs?r8zoWkZzhU*S zF?P45~`b+-yh7{DxKl0tB s*Us8@ufb#Rc)3EBa{7l?-ssQ5BkFth-Jh*Hw|#F*;(UaDVgAYg2bE*hUH||9 literal 0 HcmV?d00001 diff --git a/internal/ebpf/ctl_bpfel.go b/internal/ebpf/ctl_bpfel.go new file mode 100644 index 000000000..cf523a9f9 --- /dev/null +++ b/internal/ebpf/ctl_bpfel.go @@ -0,0 +1,186 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 || wasm) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type ctlScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadCtl returns the embedded CollectionSpec for ctl. +func loadCtl() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_CtlBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load ctl: %w", err) + } + + return spec, err +} + +// loadCtlObjects loads ctl and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *ctlObjects +// *ctlPrograms +// *ctlMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadCtlObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadCtl() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// ctlSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlSpecs struct { + ctlProgramSpecs + ctlMapSpecs + ctlVariableSpecs +} + +// ctlProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlProgramSpecs struct { + HandleSysEnterKill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_kill"` + HandleSysEnterPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_enter_prctl"` + HandleSysEnterPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_enter_ptrace"` + HandleSysEnterTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tgkill"` + HandleSysEnterTkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tkill"` + HandleSysExitKill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_kill"` + HandleSysExitPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_exit_prctl"` + HandleSysExitPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_exit_ptrace"` + HandleSysExitTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tgkill"` + HandleSysExitTkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tkill"` +} + +// ctlMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// ctlVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type ctlVariableSpecs struct { +} + +// ctlObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlObjects struct { + ctlPrograms + ctlMaps + ctlVariables +} + +func (o *ctlObjects) Close() error { + return _CtlClose( + &o.ctlPrograms, + &o.ctlMaps, + ) +} + +// ctlMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *ctlMaps) Close() error { + return _CtlClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// ctlVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlVariables struct { +} + +// ctlPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. +type ctlPrograms struct { + HandleSysEnterKill *ebpf.Program `ebpf:"handle_sys_enter_kill"` + HandleSysEnterPrctl *ebpf.Program `ebpf:"handle_sys_enter_prctl"` + HandleSysEnterPtrace *ebpf.Program `ebpf:"handle_sys_enter_ptrace"` + HandleSysEnterTgkill *ebpf.Program `ebpf:"handle_sys_enter_tgkill"` + HandleSysEnterTkill *ebpf.Program `ebpf:"handle_sys_enter_tkill"` + HandleSysExitKill *ebpf.Program `ebpf:"handle_sys_exit_kill"` + HandleSysExitPrctl *ebpf.Program `ebpf:"handle_sys_exit_prctl"` + HandleSysExitPtrace *ebpf.Program `ebpf:"handle_sys_exit_ptrace"` + HandleSysExitTgkill *ebpf.Program `ebpf:"handle_sys_exit_tgkill"` + HandleSysExitTkill *ebpf.Program `ebpf:"handle_sys_exit_tkill"` +} + +func (p *ctlPrograms) Close() error { + return _CtlClose( + p.HandleSysEnterKill, + p.HandleSysEnterPrctl, + p.HandleSysEnterPtrace, + p.HandleSysEnterTgkill, + p.HandleSysEnterTkill, + p.HandleSysExitKill, + p.HandleSysExitPrctl, + p.HandleSysExitPtrace, + p.HandleSysExitTgkill, + p.HandleSysExitTkill, + ) +} + +func _CtlClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed ctl_bpfel.o +var _CtlBytes []byte diff --git a/internal/ebpf/ctl_bpfel.o b/internal/ebpf/ctl_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..fdbcf24fe6cd34db9a4bd6986ddbbf4d34cf97fe GIT binary patch literal 47288 zcmeI54{W37ecvBa=R4k6KFf|zQEIPwou&@Yx!h6r$EF>}q5qsir$ z3f4)Cq_auWL%G)NxU^l>&e4dVXq42gi8aVH)SEdpzzK`dvRzSVfID!jw`p53XluJE z!`cy8Ht+j;p6^4x`bj!Faq0vJAKc6D^LhUNf8Kw3@2Ah6dmtK#7;hrxf15seS7W-X zeS6AUQ|7%0S$X%ErON1t)mIRC7`DkD>AoQjm%nPA&4DP=c;k&X##G`z2XAqDn7LkM zK5HXISt#U8lCGYt$BXmD;4PP#e@GYMol6mZ>Fbk(#GwsTpdTnxZDD32K}gP{*hvPD?ST zc`N4fey1`{596pFdTZnF@}!IR%D#Sl8Bnh{G+(4v-tF?MjJf>#`E1$w^Y-VH9mdAb zr-vi1Lg9J2wa2_1LK&|zAG71&m4mLpZnUuQkXMj=8OJLU7)Hwfvp9UaJ-q*rIGf2Y zy|s4p>%kH8=e_z%0shoA56ZJ?-K)zbTe0eLk(#GwsTpdTnxZDD2`blvWv&OyTo0DH z9xQV`Smt`L+;#I}d5gM9-Jo`;>(n-NjoPBFQk&EjYJ<8&ty62%GPOi4QuEX-HA78P zQ`96iL5))b>KJu|8lxI&*Y;<1d5gM9-Jo`;>(n-NjoPBFQk&EjYJ<8&ty62%GPOi4 zQuEX-HA78PQ`96iL5))b>KJu|8lzgVnd65muRZQbL(8UVjXBpO2J7 zYIu18KQPz6%jxB>IF)o{KbCZ)B$CeOaa6wI=4o{_V*^S$lKyv`&TqJMjtseaN;*=* zE0sh1eK{srj>*t@MIiCtjUSl3>fy`j)2Y0~avZqc#*=bLiF~;4ygaUdBpo@=xl(zg zK0Y5`o_@X9uV1yrvgb#8t;5L595H|22CN9cR7a(E(O(hQzSYqrS$a$SQ&uYxmrr#x z?RX+?_2GzJ{t!Q~Tpe}p6A`DAqj~FIiMV{Kqh+$or#f0Ar>s^->*O?fiJT!f$XW6V zIZtkqi{w>uiQFQW$!p{qxlOK<*U3xd4!J?zAg_=&$xZSWd6nEHx5#citVGtxZk?<| zTsf+vZvCu8Tsf+vZe6WJTsf+vf$hmkWP|bDI$Vjka-e_d@5+JxCA)H(LCE>-cDv%=LXVPj=;~juy$T9M#d1XFE{9Rxw`4Zr{cDBIoJPeRI_9!x*3R&(NRy z=xCbUwfUevr_mnd1pPP2adL<3%7ykOyKhTm8%jdky})&e4^=q}}`meQv>Q4 zb%YwD8YtBuQVvXx%ZH@jd>MFHKU77i~Mpd>>pd;=F5cz3A3~Wv&OyT{lk#*Nd(lem<}| zxL#D(orCK|dwo2(UgW+!+OYGa63M!GGrB^~lbdAj@1v{a68&4`GI@<$Be%(Q@;Z5m z+#xr}8{`%8Cb>!8BCnFW%6{d zQ`e|1>MFHKU7<$5r;CgZQ=ahr%#liI=W=JKHar0zwy=d3Z!Sltz^F^5u z)zLP`1NZaMH8S`0(H6OAwK}>=&Xb$uEO~{TAvefr@)9{ku9K7G8aY8OTm4=?U%brs zZsh%pYtRng{d=gBc3tuB%^itMSbpVz6*KwlclJJ8|NYjiO`uwG&#$W`_uRT#;(d`4 zpP!f9^XY1d9qKx@OT_oRZFhls--gBOVlDY zPt8&@)HF3kO;QuoI5nV-QAemTs-g0{u*B=clDq#_Ep4zpJJfY*o4Q7AQCF$FZ&z9& zH>gY0I<-bEQ%lq$HBZe_Gt@LSMNLu@)HpSuj!{RbF{%|)nV`E9FvE|yaFvO`g&%PN zDtynUI^x3l_c7%;-S_J~*0(nw-HQc&J`Ubvb??Vim)(0Y)n%?HgZEh7da=y)WSQ&9 zGS`#Ab4j~S$U1Npjw`*#YUk_VJyv@^Ztxzf9X7kXpUeH_tIl8k&S&r*t6Y~BZG+&v z+A7}bBe%$9@*25DZjIgMPweq&FGbYQyY95}b#UD|xbDP|8N3ghar0^LeAC|78$90}Jl~WF@x%Ij z^ZrW{Gr=bwyl~=UnR9kw_yPO*@}EbHyTZWV$7Ac4<0G=6I}??^5wjB+B7Ywr^w9qK zm>t~Wej^S!Pk`~^92pbkCs~9gxn3MtZPGYV-6v-s@9_@MAH^Z*rEuJe1Lm+i%4J!E zqwY&3V%?suy8^K8QTdyHnr(T9(~;_qyFfAd*25XvrA!}o_8oPSuM?yhPCnJZ&W*{} z2F^Qo`_64v@9r2>jPLP`7<4s62T)4i$3~?9vx92aeJ%WA1L)F-%N=<3ZR@KvOu*!7g*ChU3$) z!`LrYNc=om`Z5Lg!ghwMHMafjpVlg%Q5IPQ2ZM{>AdAPD)aSG#FlzU z8Q)Gl7LbnAsfI&LIRDe&XW%dS-v;|*$PoRoFAe)N>{3oK7ikY*pQk+q`*X100j=Sv z)4m4#7h%5>DhYoX_PbzB!Tu8LG8b#G|1;R{hJ6ionrPD7kTusSaXIwSkb4&P-$h&) zKc9RGw!J?B4{2}dr>|gvh25^jzXf{=Zesos?Ds+g9ABq<3ijWjdmi={>_~W@q$S_9 zxd$rdo3O*gWL@|J73MzcWz2dgj5r~kZGHZyXk@qz-_P)2f9aFM*a*b`fnEG%%zTvo z(obS^{NJYk$DQ{!e~JI^>3?n)f64#d!!G|%?&2@;m*}6_#b4t86D<5v{`2&QZ0j4@ z7d{{jh^k(|55k%g;H&UC8*!9*B}V#?m*FOW{e3vZ1UPOH3rv9HgJOXRaGXIp5vKF7 zIKoJNG7e!}&rHuQnq2Ol^XKn*B=^vRkDkq4cqDT+motl%Qo&rDDCY{Zi}TZk1ygt$ zwgq$P)JcSw-%GO#(@)M8rUFUg(ru^38NWT}nYq~~1Nkve6)NWGiJ40UGc`X~%1zE) zLX3sU`H98JV$OL?%s-hh_!*aT+HaBepENPt9h7bi-&nYp>AE|qeHnZm{REo`Y{!7b7h zi0v~)lv{2IZk?Nj)ASQT{ATe-_O@Z;XFqen4WOTR@Z7nhN6kSDl;GLI{2cO0AO<>n zuN?h&kd8vO5=pYPc_13n%Hv_U3zJL9)lnU|J>q}(^K(Kt$iC^DotT1vW-|` z6cz~`3v6lb%{-91=aY{h>aJs~JiTbpd)xXSZhLfp&&N0Z!llPABJ>mUa~E^WeS4F$ z(~-roAda>_YRACzRIeqs^_K10qe0aiEU+Esr)Qsh{L&M-`NBeB{^VuryDJTTZ%qcENTof}y3*ZwLSjQils?U~YN} zu6=Nx(qeEHfrE@88%&1BoonpW6hRY0@o( zR}PF(grl!>LP|cW%gs5v*v#Ljpvx-@1N!_TaN zu3Rzb$@#_H<8yP1(ua1HHg=g$+cpkCVop@4}y zPnmYbWs#L(-y`;=c`lLST0k$2y7WUNRiziPYfAucN-ymp*pEMDOx!}*1y$TZy}M&BzOLC&ABab77C=jnH| zw|@R|QqEt(dD#-|kyXeq9K{x|WOwB~PPFKW(^-FN)jtVye!b;yuk**?R&2N!fmb*) z%3L^q&wXd*+{h1inGpSRwZvl|4o=*P{pj})p6CaZInoa}?gGl<6AmO(rXT2} z3xr*Cep@J+Lj6#uTqvB|Oh~A|y`!!7YBy??%7*c=%2pVj$Y||?dS@6`4z0+O{X8*ISWd=w~y@@>-E<9MQVA4 zZaMeheP=)U&{=aFXLJi@W_q$PyCAoujND@m!~*jok5_Tys)!p*!?*sr@IGW`7D0l@2<%$e+<7r8R7@Q|02Xc0siX{e*%2mU6aFR%%^a? z6yi^Vf8Sk`i??|Qhg@4r8RcHDm?rEm<2YJ$<@bCeI8J{X5I+eVXae(paU3W`?R{h6 zqp17vV${ez8qe2)^I%EuF8J?9Xpq?EP2q z|7~#e)giMEmGobO4yTRjkpGJ?ZnA7bC45)-^&ztr;{9N`I}uJVMt(2!;GYed1k|@j z6zw5>dCr#9x&Ib8RqMB#@Hkl7xR-Bt$Uc|wydNz0yChw2Qm}}>Z`W`;O1mO!>o4sr z?dsd{zahWA)^ zMo`EO`Gep?r}vo+@?GGo*P>>N{5bg9S5bcQFMtoqpg_8k|F4VxA4LtC$nx)q|7%e* zLjFBr44N_WzXM;C*YsWtqOuBKBfkp&(cvMp zq_`2{8{ogD;5 z4YWV@1mQ0UXE2}0Yr+>Wf55Wd$odqmxjksd`rqiUW3nII2##Yl2(MEKu;k;{sWkbA zV*N*Z$X>l;{l{X9?&!7eICzBZV)vcyVEu1#eU|-Tu>KF$|H1n2)=}9H-tqMx>yun# zgxCK?@X>aE9TUD09Ot?Qu_l4vAI9}x+9QhgkZZ9W>;Fc--R${4c(DGvaWXjn$GE}u z(BS;vjR$|dFj)V;kLy3yC%K0-hP7OboZr7oUi#W{?@@%$_htPLulFgkKi|)USnf+? z!4m&7NN+#xf)(lS@As6+5Nm4qmGu4n9-LxZUcn{2-0x|U{rw()f2WG{58n_mxb(L9 z2@iwievjn;qWI&ch1~D)JPeleap6A@e|a$s=cS&9!7=jx5dR=zaH(zmg@?ho^tI)) z=k>1-8C;t7Snek!$-cZPvcI2H1WSHLPX_msesJz5$@&z<`XtXB{5#sRZhaGMGVWQ4us7fBesUF_VeHTU&Fv>gk^bSu z{(d4n4EFoU{o-Hl?<1oscW-}wDSSoWJV{r!HEA^ZKN%=GPkvlOwW&U}`;QGalhr#vB_xJgQtWQy{Pk3yCYYbzuxTlInlW-Wh=l@RRBlnixiG1XJfp;PwdGFwz$j9~4?!QB_AuDqf z<3Tp+ta7)1AP9HabHnBnmfgDtVRx|)84MO>-e=Rl%3k}1z5cUJ=PFYUJHpHdHEgZ3G(#0;Au``3117o7Lm^snC0p8w01 z=jt8p`B9ti)qAujCZRI&PKf+vOi{W2iB0F49qsuAy6g6Q58ZWp{wrI~Yj(8f*Xgd? zGsW`g_MBq+x;_6f-FF|K_Rom6)$9!${#qmVs>0?kZF#OWa!)2~vpu~AJbjW_n)P^ZqMuJuG{kuZ8@*o(Vj2SUAJe_wkQ5lRL$SdF@4>h zFVTJX_ViDQ`gQ)64gank?J4hE$x|h{<_Mc{hS&9#Fhls?#kG-ln&f{S*W>f|>8{)J zIlAlg57J$?=QnLRkL+kqx#uYP>h?_7_Cz^VdtPArx;?*4cio;ZW4*o}HTEV&>odsr zI^2yd(IcQ9gNnN!x8D7~A{}v0Fr0V)J2w6P;=jdpUHU$BTTw^Lmuj8y|ia4%hdd zR^snX*>3Xpr`LzZj}PCl?dku5T2?w|e0!l-_PxbA-Gv{-A=m0+gg=fWg+t74;l+Q| z`Z|AmO)UXoL_UFIgyY4hx61zTJSdN}R=>S<`^24hul;Kwmj3eN%(rJMn9S!L{)C(Ew;IUHidUv`Zd0T^NVyZ`3|V1#eR@rwd5!XL!(YXUIBCvbdC07h8m z`Zok%gynC&*9BmNrFnoqy3{2Pj!id%}?iaUxo6?YZKq#!W9JY$OEirsl+ zKfJr{>9gE-38z<7Tvl9H+)&(9+)~_D+)=!#xT`qEQzLP<<6p5q@ALji<)2oZRa{hD zR$N!yP~249QruSDQM{?Rt2oB<5nsPC#c{<+#c9P^#YM$s#dXCE#ZAR6#p@xK{bob) zmSPjy-z5Bq;y`giaY}JUab9sraZT}(;uXcKiq{mcE8bANr8pLo+3Du1?8jq@xvtSn~GbC+lo7iHx+jk$9SnCxvtSn~GbC+lo7iHx+jk$M}K7Ui}rv z6(<#^6=xL}6_*v)6*m+&6}J?(6?YVGD()(d@exn2{)*#@lZw-dvxBio1$q@&RfXsjtKzQyf>ERGe0vRa{hDR$N!yP~249 zQruSDQM{?Rt2lO()IL;y#c{<+#c9P^#YM$s#dXCE#ZAR6#cjnM#hZ$|ieqw7AFjXR zxZ-(zy99d{ZFQ=VO6IyB>=FU5d{so(i#CA1^9?UhxZxUsU|E;y((p zoR7b*_%9THTk)_I3dZl}Hz__H;*TKQ{faLro>IK1_<6;jemMKcqo4iUV?UM4f95AI zJapb1Uo4at&GGrd%<+3KJaAl~|3P2>fpGVUxbWAUcYaOKewa?u+405e{&(y4_!8i* zvD~*EZK~mD_DhiVdz8Dz>U)PHxzAYc9V_G?j%E{cU!>eSGv^2-e|e;@ z^S=zY-SS`M{opsN|L-FHZuuvee;)o~r2Z04=RdVa`>*hP{mts1-=qDPcB#KS($x9m zvkAM_e}m^wZ&v^K9{I2BQvYjq$^TKzKP0hZ{;b~$N0_pjoWA_d7w=XgzO-w~J5Yl! zI7_(yjA}Ut?al*{T24`OBKNTmP>x|E<8ql>Fruh|d38$b9JB8*}ig;pmwq i?ti|V-b0u5@1p+rx5K1s&MD3eC7yJN&!4v+&Ho4MJ_Eo2 literal 0 HcmV?d00001 diff --git a/internal/ebpf/doc.go b/internal/ebpf/doc.go index 8d281edf7..d283bd6b7 100644 --- a/internal/ebpf/doc.go +++ b/internal/ebpf/doc.go @@ -16,8 +16,9 @@ * limitations under the License. */ -// Package ebpf hosts the Linux eBPF instrumentation backend. The process -// event source loads CO-RE programs, captures execve/exit/clone, and -// reconciles live events against an iter/task baseline. The spike -// subdirectory remains as a feasibility prototype. +// Package ebpf hosts the Linux eBPF instrumentation backend. The event +// source loads CO-RE programs, captures process, file, network, memory, +// and process-control syscalls, and reconciles live events against an +// iter/task baseline. The spike subdirectory remains as a feasibility +// prototype. package ebpf diff --git a/internal/ebpf/events.go b/internal/ebpf/events.go index d47f6259b..c432d9b79 100644 --- a/internal/ebpf/events.go +++ b/internal/ebpf/events.go @@ -78,16 +78,11 @@ func (r rawEvent) filename() string { return cString(r.Filename[:]) } func (r rawEvent) filename2() string { return cString(r.Filename2[:]) } func (r rawEvent) eventType() event.Type { - switch r.Type { - case uint32(event.Execve): - return event.Execve - case uint32(event.Exit): - return event.Exit - case uint32(event.Clone): - return event.Clone - default: - return event.UnknownType + typ := event.Type(r.Type) + if typ.Exists() { + return typ } + return event.UnknownType } func (r rawEvent) processID() uint64 { @@ -137,6 +132,55 @@ func (r rawEvent) toEvent() *event.Event { evt.Params.Append(params.ExitStatus, params.Int64, r.Retval) case event.Clone: evt.Params.Append(params.CloneFlags, params.Uint64, r.Flags) + case event.Openat: + evt.Params.Append(params.DirFD, params.Int64, int64(r.Arg0)) + evt.Params.Append(params.FilePath, params.Path, r.filename()) + evt.Params.Append(params.FileFlags, params.Uint64, r.Flags) + evt.Params.Append(params.FileMode, params.Uint64, r.Arg1) + if r.Retval >= 0 { + evt.Params.Append(params.FD, params.Int64, r.Retval) + } + case event.Unlink: + evt.Params.Append(params.DirFD, params.Int64, int64(r.Arg0)) + evt.Params.Append(params.FilePath, params.Path, r.filename()) + evt.Params.Append(params.FileFlags, params.Uint64, r.Flags) + case event.Rename: + evt.Params.Append(params.DirFD, params.Int64, int64(r.Arg0)) + evt.Params.Append(params.NewDirFD, params.Int64, int64(r.Arg1)) + evt.Params.Append(params.FilePath, params.Path, r.filename()) + evt.Params.Append(params.FileNewPath, params.Path, r.filename2()) + evt.Params.Append(params.FileFlags, params.Uint64, r.Flags) + case event.Connect, event.Accept: + appendSockParams(evt, r) + case event.Mmap: + addr := uint64(0) + if r.Retval >= 0 { + addr = uint64(r.Retval) + } + evt.Params.Append(params.MemBaseAddress, params.Address, addr) + evt.Params.Append(params.MemRegionSize, params.Uint64, r.Arg1) + evt.Params.Append(params.MemProtect, params.Uint32, uint32(r.Arg2)) + evt.Params.Append(params.MmapFlags, params.Uint64, r.Flags) + evt.Params.Append(params.FD, params.Int64, int64(r.Arg3)) + evt.Params.Append(params.MmapOffset, params.Uint64, r.Arg0) + case event.ProcessVMRead, event.ProcessVMWrite: + evt.Params.Append(params.TargetProcessID, params.PID, uint64(uint32(r.Arg0))) + evt.Params.Append(params.MemBaseAddress, params.Address, r.Arg2) + evt.Params.Append(params.MemRegionSize, params.Uint64, r.Arg3) + evt.Params.Append(params.MmapFlags, params.Uint64, r.Flags) + case event.Kill: + evt.Params.Append(params.TargetProcessID, params.PID, uint64(uint32(r.Arg0))) + evt.Params.Append(params.Signal, params.Int32, int32(r.Arg1)) + case event.Ptrace: + evt.Params.Append(params.PtraceRequest, params.Int64, int64(r.Arg0)) + evt.Params.Append(params.TargetProcessID, params.PID, uint64(uint32(r.Arg1))) + evt.Params.Append(params.PtraceAddr, params.Address, r.Arg2) + evt.Params.Append(params.PtraceData, params.Uint64, r.Arg3) + case event.Prctl: + evt.Params.Append(params.PrctlOption, params.Int64, int64(r.Arg0)) + } + if r.Truncated != 0 { + evt.Params.Append(params.Truncated, params.Uint32, r.Truncated) } return evt } diff --git a/internal/ebpf/file_bpfeb.go b/internal/ebpf/file_bpfeb.go new file mode 100644 index 000000000..b97645487 --- /dev/null +++ b/internal/ebpf/file_bpfeb.go @@ -0,0 +1,204 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (mips || mips64 || ppc64 || s390x) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type fileScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadFile returns the embedded CollectionSpec for file. +func loadFile() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_FileBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load file: %w", err) + } + + return spec, err +} + +// loadFileObjects loads file and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *fileObjects +// *filePrograms +// *fileMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadFileObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadFile() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// fileSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileSpecs struct { + fileProgramSpecs + fileMapSpecs + fileVariableSpecs +} + +// fileProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileProgramSpecs struct { + HandleSysEnterOpen *ebpf.ProgramSpec `ebpf:"handle_sys_enter_open"` + HandleSysEnterOpenat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_openat"` + HandleSysEnterOpenat2 *ebpf.ProgramSpec `ebpf:"handle_sys_enter_openat2"` + HandleSysEnterRename *ebpf.ProgramSpec `ebpf:"handle_sys_enter_rename"` + HandleSysEnterRenameat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_renameat"` + HandleSysEnterRenameat2 *ebpf.ProgramSpec `ebpf:"handle_sys_enter_renameat2"` + HandleSysEnterUnlink *ebpf.ProgramSpec `ebpf:"handle_sys_enter_unlink"` + HandleSysEnterUnlinkat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_unlinkat"` + HandleSysExitOpen *ebpf.ProgramSpec `ebpf:"handle_sys_exit_open"` + HandleSysExitOpenat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_openat"` + HandleSysExitOpenat2 *ebpf.ProgramSpec `ebpf:"handle_sys_exit_openat2"` + HandleSysExitRename *ebpf.ProgramSpec `ebpf:"handle_sys_exit_rename"` + HandleSysExitRenameat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_renameat"` + HandleSysExitRenameat2 *ebpf.ProgramSpec `ebpf:"handle_sys_exit_renameat2"` + HandleSysExitUnlink *ebpf.ProgramSpec `ebpf:"handle_sys_exit_unlink"` + HandleSysExitUnlinkat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_unlinkat"` +} + +// fileMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// fileVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileVariableSpecs struct { +} + +// fileObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileObjects struct { + filePrograms + fileMaps + fileVariables +} + +func (o *fileObjects) Close() error { + return _FileClose( + &o.filePrograms, + &o.fileMaps, + ) +} + +// fileMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *fileMaps) Close() error { + return _FileClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// fileVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileVariables struct { +} + +// filePrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type filePrograms struct { + HandleSysEnterOpen *ebpf.Program `ebpf:"handle_sys_enter_open"` + HandleSysEnterOpenat *ebpf.Program `ebpf:"handle_sys_enter_openat"` + HandleSysEnterOpenat2 *ebpf.Program `ebpf:"handle_sys_enter_openat2"` + HandleSysEnterRename *ebpf.Program `ebpf:"handle_sys_enter_rename"` + HandleSysEnterRenameat *ebpf.Program `ebpf:"handle_sys_enter_renameat"` + HandleSysEnterRenameat2 *ebpf.Program `ebpf:"handle_sys_enter_renameat2"` + HandleSysEnterUnlink *ebpf.Program `ebpf:"handle_sys_enter_unlink"` + HandleSysEnterUnlinkat *ebpf.Program `ebpf:"handle_sys_enter_unlinkat"` + HandleSysExitOpen *ebpf.Program `ebpf:"handle_sys_exit_open"` + HandleSysExitOpenat *ebpf.Program `ebpf:"handle_sys_exit_openat"` + HandleSysExitOpenat2 *ebpf.Program `ebpf:"handle_sys_exit_openat2"` + HandleSysExitRename *ebpf.Program `ebpf:"handle_sys_exit_rename"` + HandleSysExitRenameat *ebpf.Program `ebpf:"handle_sys_exit_renameat"` + HandleSysExitRenameat2 *ebpf.Program `ebpf:"handle_sys_exit_renameat2"` + HandleSysExitUnlink *ebpf.Program `ebpf:"handle_sys_exit_unlink"` + HandleSysExitUnlinkat *ebpf.Program `ebpf:"handle_sys_exit_unlinkat"` +} + +func (p *filePrograms) Close() error { + return _FileClose( + p.HandleSysEnterOpen, + p.HandleSysEnterOpenat, + p.HandleSysEnterOpenat2, + p.HandleSysEnterRename, + p.HandleSysEnterRenameat, + p.HandleSysEnterRenameat2, + p.HandleSysEnterUnlink, + p.HandleSysEnterUnlinkat, + p.HandleSysExitOpen, + p.HandleSysExitOpenat, + p.HandleSysExitOpenat2, + p.HandleSysExitRename, + p.HandleSysExitRenameat, + p.HandleSysExitRenameat2, + p.HandleSysExitUnlink, + p.HandleSysExitUnlinkat, + ) +} + +func _FileClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed file_bpfeb.o +var _FileBytes []byte diff --git a/internal/ebpf/file_bpfeb.o b/internal/ebpf/file_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..98aa27a69d40299f57d60ebff3e2460160c63b0d GIT binary patch literal 77952 zcmeI54Unr>dEZ}2yL)Bh4`E|a_{xg`Bb)1M-4ENc`H1`lB3#VI*hC}{N#2!Liudl7 zclTbjTvC)NNi-=5OA0|DlxzqkN=w?Emc&XYjdvzA)igA-)6!NcG}#c6(UeTO&18tu zp}7C&od1!|``q1Yj2%yD_0E-^^Lw82ea?HH_q^}Bx*xdj^qb=GSTH_f!QUY4DaICP zU%g`}&+pd;v5iU)3T=EONE`WBkP`X0`3`0le)-9f@Dn%5cMu#2gW$<0pB$yF-RR`& zCu}J85X+tof=5O57~@@+3hKfaKKtap$j4jq9Rv&Ar{ISg_9(Y0yOdj$9m-A0Hf4*lN!g&R zQI;u-l=GAY$~a4dM@cB|)nU*&lcyUxt}m^*KR%1;KSK5zeV8-Jl@ndz>& zu=VZD`zLO*=^xKW%8fs6G58qe#$&cU8$WK(U$2~fiSjI*&vD7eozD-Yf;nNeF6cVFZ2q&s zlS2tzsK*Rf;7u|1nUHlW<4>{ISg_9(Y0yOdj$9m-A0Hf4*lN!g&RQI;u-l=GAY$~qoasoC{uVJUd2*vIE9*Cls8KVfQ%^X^3w zD+rcM?m_ros}G;}DXVwu4%1zY_1=_^{AVP_LOFPW$oI-u5QGb5>;KidSF`73kYYYg zzS7l$^~}0;@#^Cyzu<`%TPf?OTrV)6B=dP}E8CQ=A>#$Lc>pOyM=*m)ITe6nOae=9+bY+}HkC!2D>1;a12{tkY^EO^K-6g})2 zk(HE{==ZWP?4}&pn`BcCxJAy31h>hi9PlQ2p7sv8NZuls$z5`dyiIP9d*mj0huk9f z$!+p3d6PUKcgTC>E%K1uCGV5B$s=;lvUOPKpB-|N_C7g9-X*8W19C{-BWK7%a+bVL z&XGstyk%RD3zb-boTPo8oFW&=X>yqyl56A)xnY_9vts@6Mv8v45@-B4^NW`mpXJ3_ z9{p>@`fH?@XqYeYf{jmqTZ!k%`yye_k%#0gd5>)BxsjqjuGo5kcWF2E0{6+LUf>;a zQY5%X79qTC+13l(CGXR|MIMqnEV(K2+gzU#&OgzgI6wNqi>`;c&ft1Dl>BjhoHp_!k#+u= z>~EJPKX*Nh{q2tmU+D6>a=OoLnf|E7%=lt|-5}d}R*RL%MM^uLYIc1={5*PlAqpL)!$KXqO&P4~IdP1Akube}8p;Gli?bf1fkneKD# zdO6+aPWQR8P~bkpo=EIVH${R6hMP4W)8LGF=j*B`7Puu;(#wVE1dG4bhdDiyPhdn3Wm3m+J)h7ocA8*Jv?py!r(|i8oJwGxF z%xn<6NAkI_#QRN4yw9}6^KOaHYnFIFX^HodmU#bYiO*}6_`GI`&uf-=e`tyKg_d|f zXo>fMmU#bXiT8b$c)w>Uwq@%R>rie|n)!5LDb^x4DNRp6Un7?(ipTQqEHrDD#v#$}FXs->7#;PE)2R zlawN+&xuVhO!v>&ADQ_zeNJp9#ADv`-Rb^W)`{tJVly$O`{(KYSti1C|7=bNUN4T{ zx4QT_arAxX*=O*+vw5=So*UtL@RHQP?aQBq_nhs%b^4yOy?(64Lg`;T_qErL)91hT z`kC+f$#s(dUNiQwroa9lfA0HC&fn>CUpb%Z@jQe`?%Sr%eQkg6y_4y_HMIR65hXhs^`A5c>mKJ?tYhhuXy@?v+0({aG!A`q3Qe0ra#>Ke*XT~`2TP7 zxytnY=1S0$p2R+}DH8kU9g*OcNN`^yxJ}+AZ;}V(4tbBfMIMs7HE#o_nSE%<~ct)-fs>~IS0Sj{7kNc&3nw=KDH+1{2lz=?sPvZ{W^W0Ib-G* z_ovvWrpYPFq)0q}-8anln%#BgbU!P-GQPhxeUEwi_qy{kAMkv&K$)ks{;3|beyKj) z&)R;m_r3hu554_KN@pIUU^}p`-Yxthe+%tF{yC&s%`&jdarF;MR>Hdz4yD$Av zBQPiUEPi@J^1rab_lP(69`Od}{RZD7-r#%08+?y=gYOY<@IB%UzDK;l_xU#XKHmo4 zBi`Wqd>ee9Z-ejiZSZ}*4ZhE}!T0$#_&(nT=i3I~=i9LNB`$2(`w@^0TYtVsyb&vt ziI|(#Ge_;qMWDobM5TL~_M@@*9?~EA##2NdB?$ z`^oP2rFdShJ`@BA`6;W)i){Kgn^pwzg~z_b_mXe7^?8eohU9Mww zu4B{vuwBRM_WZ^^IFvK?S=tZJO`q>dZ{l||v5p@2J6O}_yV5<=->*v9_uKLOwIdyZ z{bf-kcuOR>EE3!m3AWcQ6}t}wH)!wC-X!mkTjV~uP2MGMk_Y4td5^qB9+JD{eeyPW zMDAI(*L|qp4mnACpPVA^lGEe?IVA6qGvpyTOWr5v$Rl#zGOs_Uzh4!yKiJ=Pzkb8x+Qs`sI%`{n5GkzD+{(bN61%%|yodAeWTm5G4&OU=5A{q=wx ziUjY8gxy?kfrsR*NU*uifjvha(Vn+F-7nkzh==SC_V;wZ%>F3Y{;|&)aX%nWZqsh& z73NoqY~~%fDg1Y^U$*nw{qFNC?7sQJr|tDTo-3zKJ)*z={7m-GW@qBO}ijdv?nP=AU>ZrpXc-D^L*ZX zp3j@l^Lg|6*e>JuDR(G)l-rbD$}P$c*IN@o9BaF#_v<^Q1&RdDZ7+glpV@V$~I+-vPs#X ztWlOJicEF%hQEo#`K^&z2qhZa6ZNR#?${d>EQbU)8CVx{=Z4v zasuJG_(&x7wLQyr{|eqACq;t$WP81o;&tD2A3bmThwrIQ|KB7tPq43Ta=z@?{^5JG z75g48>^0iWJOr1?UB)kxx5%cSu@CN$3$$;N^W-);M{bd`WK*wadmnx8xyo|*wzoWZ z%bVv!H0{L8P`q0i?d4DyC*|R^GfeayjAf$^?I_%y@v`;iYYji~bYNE=;x zY2#(0!y#>a9zJ<|s`y-qPYWM;%JF=BcJMjNw&TANjI`a1*#Ye`d9&@t%U>MF)|7GN z|HphEDu;CDw~5+d^M5Wv{tUx;$e&}l1^ID?cOXA$!=}ZbMi|wN(9&PlQo>ZFm`UsIHBH0RBndX72E*gWZ5?%?3aBr_!}rp+Lnh&=KC>xaKvO@$XGxZ zlYAtMITw2)q|`A)_$`pP;FCxAG~{u7S_uDuDa6K;^ks4qQsPz}BR)9N{wz@1Z~7Z2 zghWMoF?pZnDCB!_LW}MMK4OsLRwOB~9a6_<(2ki3@{=~T@R1YJFaH$Esj~drupGS& zWy&}d5PlaVt8+wti$TI6^ba$fM|c_GJMd{C++=tM;h#YGPFvKG4XZ zPvGlrd_sgj1(~;>q7FkRGfPlXJ-=UqCUr% zU;g{-^Lr)!#bffk8trd7z>f6K`$gI@P6wsG;_I}3{{eQSzcQr#^Z|Cvi7Q?G?mxhe z^jF=>^z#SUk^ZXxLi+;;*pdF~t7w1l06WsB{($y(9$-iM=f9cu;sJJ~fBv^<|Dgly zNPo?(w7>fRJJMhCx3vF=*c0+)4>z|kWY?bH8dQb}^W@q)ueSbOVsiM+HNXo+fg{A{ zdI{hN@wq_)I6{10D*+rK^2sBgm?8W(xRfaG$cN=(!5sCK^`KO`>wyREdROTkZ~3A7 zN)Ntk{=QNvSl?(=gEN(8sk*YhTCc7J)$<6g1?NtlKz#W=x3X4WTB$CElEt~(PKg@d zWA*acm8DR=f=8kGA#HB?rYvH`x1%hw6{IvG5& zTv=KR)>qH1EL7I3i$SBZ7(7y6uC7$hRL23-BPS*2CIv6lDyuGgCrhlwDyAT(C1)iaHCw!tauivj+j(&!)8 zD{Hm0tLuSj|5#^eVZ9mDDl3c2)k(RfvyJLXu->=@HCd=EFRw|!R>_(cZjqKBd${q) zv4!BW)$01W)s>LBNZQJ}jh(sqcs3i}a#MKMgQYj!d(RKv8{Txw(J-@cc4cinl#U5+ zx)Bw)`HfQ9AI`q#XgHzc5jydn8($YJ++v$}iyi%AwcxU|E8!bL)T4B!(kLyTJ^Sdn zMya}7J(IbCy?ZpgLAnpAT|JTHh8x10&aOaJePWXP*jdiY#@dA+_;I#WHfR$b3P zeKgD-4cF@LtDb!%bCX1qG>|vH(F`^UGtw#1SI40{b9S-nsj^UIFyn7rtgk+@=n7q1 zT|l8Gukp+c-~WbiwOUy$om;D}me$r+r4A^Ib9r2qi1x;#VWYBMlgTc%bG_bJJ^OIA z6wPgMZQbU9Zxqj}AjKO@Bc(%cI~C$AWG^mNF@evmu42lU8ui7}`ci!{Bgr_g+~}Tb zEaJrD=(4BL$;jwvh`JsP@1B2C>8|_Vg`@|bQO){#fGi`k9lAp%``F^Dv3Bm^Gl>1j z>e(|TmaZoYr!NY@B*(0=bGyFi`XD;f%(T2QybxSgWlyZuSC$?=_XzqEBXhorIc!$B z@rc}1#V};Yxm8VKnVq&XWpbL;jM-guN=()}+i&BXOe!-w*EUubN{>`!Da4{ssw^(z zY{de3G(0Y`FPgs9$mFe>saw7IjqCL@)wT7?nMP@4jkS4HbR`+=l{GWGh=!iR$RPp( z$Q>H4IHmd`v=gvK=`pB9Kq0fpM3V_}=p-_gk<841)aA?&73LUp_eN+qwFp z)$1H#D7jgQ)R?76%xr9ih~dhxxmdN$j`_NxbnddKVXSX{qXfo-O*TEcURirovd77K zZecwXloMCNH{GbS6RUKv7b`%G18H+mm3h5@r30rzWx3R-$Y~cWt)9iYxr{{tPRAG) zR^gad)^L6|Hv)|0>U!znvuD?342@R`j9bgzdAl98NCebWPQ`oP{=j{u2kyJ;-i*`) z?TSP~1+#aa3@)=ZI3$TzM>kh({2P(@cyO5vWy6j}v_u>0XeezqCEbcs15LVAIbwIE zm@rOF(+wED!1SF2suFq>q0+isMFckVD6~-6@9do??!b+ajmwn<1C^vhaoXc!?FlcgoFg{wNl$wcTI1bd zGENHRNHpiTOrFkrK|gUqti@P?j3SH6LSw_66BD;&^U_{Q3Zu@PDwoXUgz*%U6kz&Y zFPjr4A33XJ0bRt^#KB%i=8D8}tG0Cz8CelwI`EpRvVMuHDj1!wIp|U_-ff~9=tK5QMJNqztho{?c4Z7xoE#8%gj^FhX=5UdfR=niyFHZ zoVsSCvQmAo+p9R+coTDWc`;%eyNT~~^MVXz|AN6V{wlg-iFlTYPl&3qVxYz*6Io=8 zF;cAuA9(2gdrEJ5%W2bO_)CBMWMB^)KF{Vx?~0+ZTf1_CD_V$-P2FtGmn1|_d+Wk;b?Vkw}y(CmU@_!Bzzb*0m3Ngxj?KY?d6a?3lBvgs3V4H5<9mq^o&`_%KV0cU9M28nsG z7sx38LFAPvdhziLFHyF3)XW@-nzEza(m#nm4-#LI@|zw@{%sYX{V{W8koX#&<0R1j z@pz!UX6~AM`c^;l(I9BwjiOOEiDwvdT*lFrJCbohJI5^jn6vQ_vPa(9$KzTgyKzOk z#^WsG%685C*I*_o`L(PaA$x3Fp7}-)-xT|v<=IRS|ETbgd@_ii5*|g<%k-7y(1o6}8ml)b(>{~(nGvEZvpZzyMy!!&%kH#*14S0v~|00-q zy^Kqr{H=6MN*NL3{_##}oVH2ZH!6#%YH2ovQ}%FQR{DlFH8d z&%G~*e?jb_va>yNzY@g1B>81&|IHvi5N7-4{(TVt3hFN2#1(knF~j~l;<)G8(VsJWD*cf5zrrbo{+Ss?c{Z?| ze0h*~0mg4OB;SHl5a;b|PI2C2&9Hs zV@c2UUA7t|-Y@nV?ZRSjklR6`CHAJrVrPF`_NgH8L9w@K7Z&>_8ROX&?szQq+aiA< zNPGzXW3KD5w11oY--5&@=Eq#mW6bBd9rFJU5+B8UOOh|YJ4kfEm-nsx@}CZ7=7opk z?O^6XFot-teu@20p?DcSIAW-a*tg_aVAA8$;FQOB7A@=CIR5qEoMnXUk+7D;-dyILL=&1Nx);{)MX#aRTWSl>M zl9d1I-3?vR#uNY5oBFS*|KhxzoBFS*|N1WTUp-mpK94m`{0|PZ{{08Dbs76BxyIVX zb)5Vrqu8%F9s~odr_NuExj_59LGYCX>}B##Uy3z^4Le>mOG zeYfrBMzYT3u%^lT?>J=ryYitRHlGKCmJzZ?#?JGxKgyGxKbrSg{1MIzliz29nA}$o ze`xk!ZhzLaY%|Aqi*~m^+akOD8U2IvNAW$IKm1Kh?gPY!!Sk3c4hNu2#>VG)Trv7K@f4-aik6FL4&Y5R$@^?=-WIes= z$AVZ(?jI&Smi$UMOPxJZLmCir4nBMuPP0KEO*`JyGoqy_)oqy_+ z-TlLTTR-fVj6aesqVX5>S7ZOTGXZu3v_ ze9XK95@M~xA?x?m_XM$TJ`6~DoCjwtBV>=PT|dYBr2^UQmv~;pg=N1~W`4gJ#6BTFU1;Vtrw(=f*$5U+v2NX=L*o z-@iktVozNg#J(i^rxfk(c^2C{-aqBN_~M_~ep`9)yt1=D#^sf1UkqXc>`%x3%9Y3V zkMrAP{9g-V@*Ez1GwScQJr;krV|kpuZ+YzR_HBMP8sYvKL?cVJ%vJ@o!`QD)yEtuT8u2haFWO+iyDq z>9-l*`NKZryXRxO9*aNRvph~ewCw!hOv>hG#uxL%yz8p`;k|bwb&~PmAMc&|!>K>y zc|P@rQ-Ao~<`3_cb#5MO+AHmahq_$EKGcT{<3zww{W zKeGMf`=>iL{y4ur<2(Pj$NZds9C|GNaTHBIgN$Un#{My5^E2a*d1L<8L;1&bez*C@b*yvZ_sriuVU3)@8ZP_3BUpRonAyRX@LvkyZ#RESq=KpM!GDyMNC`IbTJ)o`Z7Cv%2S?9CMHKIVi{MJ)eVe zj1PYf%CWQipl>`imIue`nEP8OoW49U9{Kr+Uj9DO9W&=9`k?Q$$f7;b%l!yAn2TpyO}s^fC8EXq?`QKU??oUj8#*_w?OKZZpRw z`bhu(kBL6g|35s@NBaN4i9XW*|9GO0^#4s0{YCxnR|L`InETiGa{7i*nXj3zd3vw^ zk0dAhnb1TvUy0#F@3-s7>4{$6Gk3?4pY-%QPAd}g1bZZX%>6THoW3@(&dT4*IlVtF z|H;#LC-GiMF4W84p}1q_{S&?1pK(Xx!xOzcCwE8UcRhXHY2k{l_w-)BnRz1TusY`cClpTa zkIM%0ra%Q5BjLYv#^pSD7XQIDoTwVg3 zI_Bg$+v)xGZcg;_e8U|xQXdz8;I!z?$0mAtUgM60{7o6-C(2HXagjc7`u;?3#)W@F z?Q7@$BgpCfdP-SN?~TjMUwL|eTx9)We1BXL-UA9G)T#_7Fw&HmIxKa-iHn)#85J{V5)iFZu&iMFSg>ka0g@bWkRqrB7a zP2!tzd4k}E5 zPfqlaagn$#{x-rqVqd(*G}*C8xo(X=38(WaYTY~!aewneo_?No=;M!h`s_p>`vv4L zYk_w>FNJ(Q;Kg?~=z|w{dSN+2eBOzCjtESS!~o&%h2CBF(j@uMei?edgJGM=LjP&# z#g}-8#E<8och@bnnfHfc(4$KJA@PHM2fg!~G$wWs_%QU&uTgLE|2^oPU!Z;lGA{Am zy6VM`-3`54e_Z?!{dNR;w+?vm=iULmJC9ua9IlgJ2tCK0>Oks~2+^olIt``k7o-d1 zIyXjr2U5;Qa$*xqddQVdeQpGI`v%6=cJ6itQV$W+zXbysjL@{w-A;% zjz5R6^q*s?zqH5kF2bLfu>8L;W-X#Ucs=-tXFrXwtohC^*Fds%J6=Zk6&}AI;f%*0 zLimKo;*;f^aOppX@ZBE&Ho^suzliVy9)AVlcX|952rqd2O@!q>67!E;f$+M=FGcu* z$8tW%BJASl70Z0^?PbLc#Vy5~inkPRE8bDOt9VcGew5=tzrOL5;!tr`abEGf;81r zTu@w8TvOas+*aIC+*RCD+*dqMJXAc2@?27JT5(2kPH{nTQE^RiQ*m2yM{!qiPjO%I zK=DxVD9T5YiqncSigSt!ii?VCikphtiaUzCihGLtiub^t|2?uFN+Dc)ARqj*>Gp5px|o9(XGKbNJHJye`koL4-rxU9ILxTSbg@s?s4 zZ}0l)G8u252a1P^M^V09CV-dz^0eZN;+*1w;-cc3;-=!Z;*R33;-2EZ;(_9!;!%{J zmsFfqoKc)pTu@w8TvOas+*aIC+*RCD+*dqMJXAc2@)b$NX~h}EImHFVMa4D6O~q}+ z9mQS6J;i;+1I0tdqbOgQRGe0vQJhm;P+U}8Q`}VCR@_nCRoqkDS3FQWR6L6ERY}EZ z#Tmsp#RbJh#WlrE#cjn~U~fNo)wbdt#k-346z@mb+?Mq6zdEJtq2jFKyyAJqWyKA} zEybIPw-j$H-ch`(cu(yE}+)&(7ys3Cg@wVbVID-%O z+o^%#q2f`LpPy8mRxEjY`9D9WxS+VGxTd(NxUIOOxU0CQxUYDic&K<3vk0HD&AAPALSPU{rp~-QXDGID$XmOS6o)yP~1|ysd!8A zw&ESdyNdS|??+j-Hh%kGlu{fj&MKDimN`Iw^CB5RC zL&c*gr<01)iZhCHiVKR1iff9Sirb1iio1$?iu;NOiie6vQU0E!;zUgz-I^Rkq(hl;a`^NQycmlZb@w-j$G-cr1+ct`QB zVj1rOKJ-T~lkxWWwMsZGYL2*%WO>t9kTX9Em zS8-2qU-3ZkQ1K|ruShCRE6ym+DK023Dy}JRDsC(8DDEomDefyCC>|;vMfv)q;dq3w@ zL&c*gzdETntvI7Nr?{ZFsJN!Mskp7UqqwWMr?{_ppm?Zw6y+O|iqncSigSt!ii?VC zikphtiaUzCihGLtiU*2^ibqj?O;T}MaYk`YaY1oWaZPbkaa(amaaVCqabNL3@lf$7 z%9*6%wBn57oZ^DwqT-t3rsB5Zj^eK3p5ngZf#RX!QIu~?Do!iTD9$M^C@w0lDQ+rm zEAA-nD&7Hm?;GB@t9VcGew5`;JN@)Gr4)yXvx@VI=M|R~Hx#!NZz|qWysdag@vh=M z#rsiyEzocOYg39t#aYF9#q)~GiW`bsiZ>N+Dc)ARqj*>G5bV8w`r1*Hk0uqT6=xLZ z6c-d171tCu6}J_46n7Q(6!#Sm6b}`TqI`2waawUkaZYhTaZzziaZ_t9kTX9Em zS8-2qU-3ZkQ1K|rr;>`(iZhCHiVKR1iff9Sirb1iio1$?iu;NOiie6vQNA^)IITFN zIH$OvxTv_MxT(0UxTCnMxTmJGZR({fa-N_>+o1r}zut3_enC9Jw#y%jd5tmiBt~J0zXY(q5mB zf^+yV|2tl<__ShauOEL|v9#B>e-vE6$L0SS#h+LF1;t-d{58ej1bg>0@4Q0sOBG9d z{rIm}EbaB}i(qfRc;~v}4=R@S`td)bSla8`zX+7Ynjp|CpMqh8-0`)>= zd3j9&5xbvkWxcw3$#i}MKcSR&Ze_W?^5~^X9LMmJnk>f_Y1~D%jYjbkOS!9P=9%iH z${ok>lbTG&mcz>(N2#8#uB@*G$Iet5Yr)#WYGr+)R;pDijRSk$4AVs|apMw6GVaua z(@e~M^(Q@ka4OI4C-b`U;BjEbmg@`Em9=W536pU+I9Jbp zQEhAoADqtAh7mB#4=-02gJWy!tLv4AAvew#$@3vN{g!*~yZ;^c1*h-6`;O8bB63#T zZpCd@+-k*fCr?>ENj2pOqLakqR%VHmxl&GwyUmK@r>s0dq|6d2?PaTRx3~` zqdjHCNot)W9=Gz2((&7D7FOO$MkZEq(kaFPr#Q|)u5_!dxDlwhkteJ;PMIZAqF58_ zc1o0HQ@a34vx;%RDNwAj+)+AZD{jQCmQZbjr>r5Bp#p^F&EO2D7nGUe?OeB$7_?MLtvj?eeX z`XMPJG5n;H)9lc+(I|dm?_4`HwTffTv=h>cxsnmLTXCBew_1TdHO5m!%9BLO6GSJ8 z$F0l~DbfEXOUzgXFc4OQfiMBgkmGiIt;EDIEHlIekkm*_5Nj9*oB}h&SaPM~S;^`) zN~AQ5GL1x$Svd4(=SawPZQ{VZVlS8L1{_D^Hw*nkep|sE5_UZ2l$3eJ4rg2dN&g(- zr${fq=M*`T6N-HmVfXt<`H5aaeL(0E84I2*gJ5e@hzg>Ev6?_gWzbp}Oxc19f z%i+>X`FG-TNcq?7OXN$pKak&PJFNUolROB@kkWn^&ntg+1pOi9zZ@nx|f){<(rSh3jUb&AGhEAo|a3WLi*o9nnTLJp5!|4-09bGY`q-#c^Z#r`>b z4k`cpdN%o`+8=Zg=dkkgHvPE$?swI^^5e389a8@H_icJ_xwHzG9u)s0d>vN)mW@81 z|K<-fpmXWb{`fxuA5#APEdNsNkAD{F4=aC{<(DC4{(TSGD?cW-L&|^Gz{Z~mtsH;5 z^iag!jjuz>|Ei3;93rLsmk8i+>Cyh!tH6hp{~pf2OSL~1BK=|Imtm8mjE|J>e)rBR zf9?|Nf1UAWa!BhRE5Q{|d5Ke*CAPbLA&!r)bVI;MPrNcJaY6`JF7sI(?Z5HYuHO<%1J4CtP}Gr);wR zFFmRZ-U*qIbLx=x|Ea5g8F8fjuf|6XSAGg%@kxi2|1n;Fz3vj_oBNW7mA@^8!NuqC zCFQ>cA3418;~Qt6JZ<`|WlY{z>}71f`MojE;MX@HJ|*rOC*j?K4PVuUls5hZZLa+E F{{i1B3C{ok literal 0 HcmV?d00001 diff --git a/internal/ebpf/file_bpfel.go b/internal/ebpf/file_bpfel.go new file mode 100644 index 000000000..39ff6f15d --- /dev/null +++ b/internal/ebpf/file_bpfel.go @@ -0,0 +1,204 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 || wasm) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type fileScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadFile returns the embedded CollectionSpec for file. +func loadFile() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_FileBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load file: %w", err) + } + + return spec, err +} + +// loadFileObjects loads file and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *fileObjects +// *filePrograms +// *fileMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadFileObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadFile() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// fileSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileSpecs struct { + fileProgramSpecs + fileMapSpecs + fileVariableSpecs +} + +// fileProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileProgramSpecs struct { + HandleSysEnterOpen *ebpf.ProgramSpec `ebpf:"handle_sys_enter_open"` + HandleSysEnterOpenat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_openat"` + HandleSysEnterOpenat2 *ebpf.ProgramSpec `ebpf:"handle_sys_enter_openat2"` + HandleSysEnterRename *ebpf.ProgramSpec `ebpf:"handle_sys_enter_rename"` + HandleSysEnterRenameat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_renameat"` + HandleSysEnterRenameat2 *ebpf.ProgramSpec `ebpf:"handle_sys_enter_renameat2"` + HandleSysEnterUnlink *ebpf.ProgramSpec `ebpf:"handle_sys_enter_unlink"` + HandleSysEnterUnlinkat *ebpf.ProgramSpec `ebpf:"handle_sys_enter_unlinkat"` + HandleSysExitOpen *ebpf.ProgramSpec `ebpf:"handle_sys_exit_open"` + HandleSysExitOpenat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_openat"` + HandleSysExitOpenat2 *ebpf.ProgramSpec `ebpf:"handle_sys_exit_openat2"` + HandleSysExitRename *ebpf.ProgramSpec `ebpf:"handle_sys_exit_rename"` + HandleSysExitRenameat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_renameat"` + HandleSysExitRenameat2 *ebpf.ProgramSpec `ebpf:"handle_sys_exit_renameat2"` + HandleSysExitUnlink *ebpf.ProgramSpec `ebpf:"handle_sys_exit_unlink"` + HandleSysExitUnlinkat *ebpf.ProgramSpec `ebpf:"handle_sys_exit_unlinkat"` +} + +// fileMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// fileVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type fileVariableSpecs struct { +} + +// fileObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileObjects struct { + filePrograms + fileMaps + fileVariables +} + +func (o *fileObjects) Close() error { + return _FileClose( + &o.filePrograms, + &o.fileMaps, + ) +} + +// fileMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *fileMaps) Close() error { + return _FileClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// fileVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type fileVariables struct { +} + +// filePrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadFileObjects or ebpf.CollectionSpec.LoadAndAssign. +type filePrograms struct { + HandleSysEnterOpen *ebpf.Program `ebpf:"handle_sys_enter_open"` + HandleSysEnterOpenat *ebpf.Program `ebpf:"handle_sys_enter_openat"` + HandleSysEnterOpenat2 *ebpf.Program `ebpf:"handle_sys_enter_openat2"` + HandleSysEnterRename *ebpf.Program `ebpf:"handle_sys_enter_rename"` + HandleSysEnterRenameat *ebpf.Program `ebpf:"handle_sys_enter_renameat"` + HandleSysEnterRenameat2 *ebpf.Program `ebpf:"handle_sys_enter_renameat2"` + HandleSysEnterUnlink *ebpf.Program `ebpf:"handle_sys_enter_unlink"` + HandleSysEnterUnlinkat *ebpf.Program `ebpf:"handle_sys_enter_unlinkat"` + HandleSysExitOpen *ebpf.Program `ebpf:"handle_sys_exit_open"` + HandleSysExitOpenat *ebpf.Program `ebpf:"handle_sys_exit_openat"` + HandleSysExitOpenat2 *ebpf.Program `ebpf:"handle_sys_exit_openat2"` + HandleSysExitRename *ebpf.Program `ebpf:"handle_sys_exit_rename"` + HandleSysExitRenameat *ebpf.Program `ebpf:"handle_sys_exit_renameat"` + HandleSysExitRenameat2 *ebpf.Program `ebpf:"handle_sys_exit_renameat2"` + HandleSysExitUnlink *ebpf.Program `ebpf:"handle_sys_exit_unlink"` + HandleSysExitUnlinkat *ebpf.Program `ebpf:"handle_sys_exit_unlinkat"` +} + +func (p *filePrograms) Close() error { + return _FileClose( + p.HandleSysEnterOpen, + p.HandleSysEnterOpenat, + p.HandleSysEnterOpenat2, + p.HandleSysEnterRename, + p.HandleSysEnterRenameat, + p.HandleSysEnterRenameat2, + p.HandleSysEnterUnlink, + p.HandleSysEnterUnlinkat, + p.HandleSysExitOpen, + p.HandleSysExitOpenat, + p.HandleSysExitOpenat2, + p.HandleSysExitRename, + p.HandleSysExitRenameat, + p.HandleSysExitRenameat2, + p.HandleSysExitUnlink, + p.HandleSysExitUnlinkat, + ) +} + +func _FileClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed file_bpfel.o +var _FileBytes []byte diff --git a/internal/ebpf/file_bpfel.o b/internal/ebpf/file_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..f1c850d6b47d51b3c4a3ac4ef5e8475c0a355b62 GIT binary patch literal 77184 zcmeI53vgrCdEYO{ePCBBi7RQjlqE-ZWm|^i)e8HN1j+UWTJ73UvX)>y63CVfP$aaV z#3f;py8;BK#!MXsqdGC;%3RoS9m;YNq;*nGt3*gAjW`oE#nf(wle#HVD=FhT8BCo? z*-XYkIMBfA_oJ9qA@# zJbqd})#(xBzTJDuxPJuU_Jt-4m!4cV>Ae&-=#4%5`qF=ShmH5h4x8|H@546T`G}Ov z^GfqRbObsC4MRO>+ayq$Ux&7!YtSZi721HVK}M!T&;ThKLV6S@j*Kv$r3=rXhhU4mAj3(yL*3@t$O z&>S=aO+k~;1T+qfL8H(J)Q65hhpaAI_u}(*{FR2o#$Ctx=VUyWh7EfAcJ4L@FOOQ@ zDgK(nOFC-g_~lvauH$`1-NjA*ynXs9f6BUz=4^Q$u*LAk<}GWyD`YS2{@%v@%VV0F zq^l>RY#LvS@{)pVpSI!^_uKjuM{Iq&`QUt$a=o$h*_<|>JD(p3*%L81FRX7dFAPc< zw|nn3E%VYYTVOjnQFsw;--7HfX<*s3{Qp$;?)h%}W$d%xTf1p|&2XRhO*`KRD1Xg1 zkCdln+)ImjQ?b%w4w`|cph;)~8i&T9Q7Go0MIVg$XA$$yBIch((|ulPv2EI;w73p! zLD!&7=qj`UU4ho2%g`Eh30j3NKr7HPv;fURbI=Sl1x-Q|&^R;(jY1<(A36dZf`*|U zv@N|M=fUDSv;|#*HleG~26P2lhb}{F&?RUUx&W;}%g_Qe56wX{&=fQYO+e$&7&Hov zKz-;4bO;)T8ZqO0yBwBwAfI{Pc#NID-e|}EVqS9R^UFJpw~2qH9G1@8be|S?UwG`i zohZh3Tw?-0EuY4Hhb>QVUdxG}o_AV8P2cHT4`@1C z5>4kLvKODX=V@s;X##3Gn*Qrf=LMV2zCl}0*De<;hqiz#$0*7%HmtczeWe_}=#~4G zwyuXOr%R{!D=5d#t4usiM@!_wz5epp{?T;yNIDlQkJiWK?Oo}wkZs@6a13nQt27)3+k8sH3Cp7qqmP8lbSLqB!=+*CJ{qz* zHk>i;#gNUXG+Y4Nd`iP*aNKBVxB^aq7r;qy6`TSufivJ5I0s$^=fQPw0lWe(gB#!q zcon<=Zi1`eHSiL+1+IbD!OP$_xDK}SVKKA0hudhx9KP^Yw5NjCp)G1;+e7oB`W%l!kL) zTaMCj-mw`d!bWAhfUVsvhF~v;Gw_Gq9JY2?#wWrj;SW1HoB+2?K2jg>I@sE2X%BD| z{%ha}xCyr9lJ*AMa!G%HZMmesz_wh)P#tW`RSYeIZMlk}8rYVr7+M0`auq{Wuq{_H zv;el{DuyaxTdrcL47TMeh6-R?u3{(;t{W|ea^Pif23!NDz)RpHxC%~y7r=3F1snsH z!BKF*==XY^=)K(HjnW&pMpEa(>%t}JjTyF#?3s&%X|dkedq{u2pWcZ zP|RcVnBV3x@6E5-{+h=;Igj~s9`ow_3jFKPWoQk$1g%0BpcQBtT7c%EIcNr&f+nE} zXdD`YMxha?4;_IH87)4K@i%P!c|BWNG{O4oSlbL{{?LKay)R{^`~Et1(b~zMQO~3>kgn>*TGT^RC+GE6+6T z^B3H=9(%^#M-AQ&xY+aL?(-iroaDL9hfKLk=W(5S-rlb%oyU21-rk>)`{L$8zjWT- zk13sRn*>Vd*P$)w8ng*rg*Koo&^mM(T7xb@tI!2#1zLs{pm}Hxnt`UENoWEZhsK~$ zXawp*N1#K{Fw}$E`C96a_OtVQ>HHeF30;LYpexWibQub}aDE9~g)TrV&@!|D%|mn0 z3^WBzLKDz9GzN`ABTyeY0v)ot2>1E0;o|cck2v3oFW7OpZ_qxFboZV3d9R*F7k$oq z#+Ks&JWm)qZ&~B@pYwX29hIgF%t!w@Z_A#Ki)+v(bQRiwu0ZS1WoQk$1g%0BpcQBt zT7c%EIcNr&f+nE}XdD`YMxha?4;_IHLBmiF+BW^(Ums(BoA*t7^w-Dz^|20w;PdnT zb6$N84g23;ADj8J|C|@s@BQbz7!R=L!z*Ce_2D`g_I-F6oG~i*lfWtP5;zI2f)n5c za2#9#$G~N96kISGT-R;&9*Vx==dQP3^Eq$eedO&D@B4qAYu`WaKF>X))34{&-EaIo zWUNd3?;+dqFz-W0phM6w)Pv&s@E^(Z+Y;8Jdfz4Z-m$#5ZpPz3N z)PHVk=Z!_!p+(rA#R%Ln@ARMBn)#%(=d&h6=I@i8u++C;U%*6YH|K4nWy{Zjc>c4Mn#~0S0 zrTGyst{XegPw`#?#=X0a?5|f%bM@adUQF5dEf$l|1hoI2v5pXV&)V9f{(9BUFN^j) z33<;PjCrTOUN!BZ_Xl+bcJIqx?E9s&j+#xfTA&rw&U6=dG+e_z(v zVfntdwa5MEsKyTewXg2?Vbs3p8^quL^VC^$es$NWYJKE+Dt_PP_5Mza`@M-r z^o1DNwtM#ZZ0Q2t^S$8P@p}R9`Ch<#z8CPG?*)wS3vH7?>B2g+1zm$Sp{vjabOl<6 zE<JGy_dRlh6b-4vj&h&1d--|)ULe$UAcPxHQ&rfl9jkQRGce`H8Dy?(mrd%i_mjt8za!M(8y zmiO(z`@_NXCEZT?V>Y}?{}E5#eh~lBkJ$L{m17;)WBV;@xYzaGusscbAiodw#^wWa zdiK9p+kZYQBf7udmG!7q9iz412{9yKX23eh2W4UGJVV>2}w@_Cmb$S^PfF zGxm8|e?45V=iLR2w+sFCunwHkg^U?Lr3>Ub3A(`@b{w zn(r(3*TZt1(|`WkfBq|$zW@Ap)m-oNpa0tTvHH({%UJ(6u>Qrm*Mq0{Ohid=j{3TjQt&|(vx zZ+ma@v<>;g_4$k640(1%<9S~R+dXl0r;G#o+ghfhMbtj{9n=?3?YpMxex2;w)u9{C zk_5q$TzNwr4XciF#lB5fQ~D|_^74K}jy1iw?6=4++ZDP*cm8rXVBf@5uZ`*26@YOc z(Eo*pZA0F{boBk$!!}S@{|DmjIMy<~(;mCJTavu>zxLUcqZiiZLg$9nT0Uq)ng4(n zx5s)9d7CfCT1ULnZt8fMa9sAR?3c@4mR)~YY_IGqvQNt{+ZFrdBUonFXX3n}UM_8M zA9#~|VA~MJ{G&nZF`)k)@)_AB-nOVTTt$wxZo2)f?0OuR{ZlwDi|UeA-B)D)9FDbc zUyx&M%eWkW3C9^ZUY28D_OcxRmOGXVe^-uW3u|Bho;mcwH;8`O9-IF{Ekn|6rVeiw z((&d=TDk?>6|ZWWcGY%{%dYLJZCRFG+f~QuitK+RyKGk+kPjrKJn&ZiwA+R@+X2U5 zes6)BmVc{$bou?M4SU7gM1%Q7kcP;H{QR!_fYw>JVBW5uHSf2}9+#cR(9PnuBKu#; zF54A)9tHEhRrp)7OWn4`MfHx(AyM6~mt*Yav5vXpay%gF%YL66-zFND{j?nG zIaHSY{cF)Hb3oyxN77R>*ca8~>^|2yRPeKH|QKWt0L@uPCA<<#v%IQHfE zaU93xcv6n<5-rPK!10P4|Fj(6EvgBBQjXsxhjBT+Ajf*1mF4)C<@mT9ugEdBftWjz ztT9ii%kCcyxR1;6zmmAJx%0`TVA}iL;vrQs{rvONL2_*7;zc=*i@R>0mE#klzU-fe zdt8oRfO|%cYjP|JZ_~8?wH)6gs@uPnW7)zwFZ>pTxz~6}odRLhNz&QS=U^JFwY`*O8&;!|g+2fK<2qH8(Sno%OQkMWlf z=gH}*GroR!Pi2eV`O(R9S#Nx1I-ee!J|{6|$7V+7#&T)vF*dD7p{Wzi@N4+N| zN6*Z9b2I0r#zyC|<6eGr+O*}SU2Ob+~|x;-f23Q9nE_Z_3=qb zX>Mk8ESokpO3#cwot`buYCW?v-q`fnv(r;)Q+piSVgT|p+3eZ;9O~d4C&oSblR``T zxK^3XP0!4Erv4o_Lt}FVFE=_hKAG+2o1V^Rr@XoRZBml4(aFhKJ+MWxUSqdu%?~}E zf8x-Xw`(RlcW!3NM=Bb3bk2s3+4eyzvtofdrsc_lPCRKZae5l#-^uc=X`A# z|CXDj0Jk33!hSINp@V*x4sW0%AG-OS-q>xninrO`Ka}%!O;7pn_N5%@v!nU+Zx$Do;0xw0k9EjiecyTqK&Ll}?3_(QJ|%k;MPj_$R8kxCj$^)@g=obySsB3RW@co_r}Goz>A5o#;}MO9 zapijVTz*_mJoGMFS{hjrI_OJT5BevP?@8Zt|DzJM=NVO)nDZpb4WnJ$wixUkA6Jao zbB~{u&`-=vpG_lo9xNEXl8Fp*88vonPmH@Z*f`S6u)NtXdAqV`iJ6J1GmoEpLfTV$ z=6qJhu$kpLJ#tG{x*^(0Eo&m{=(LTggVW4rNN&?9(Vg#XyLD1BvCQb4El!Q4pUCP| zD3d~ZbbMUSR+%6V`iC|2rs132FnF_O=w@#{J~weTJ3BXeHlLoFMQNT=x3qTl)U4@V z2_`KiJtqO=KvEYM%sA2ol8b6{v(7d)@^>k4d392gzP|Oi9&|bz zY+7_~boMDtUQX6?V{^Wup168^%gvme`f39QLU~eRPpjf(bzG0h)FG$B=wv!Ss;8ZI zW@cLE%}JRQ#ON50u^BN;Q?qh@7mA+r*0>; zkw91seF=Ls;CfWT8tW#>7$YV5Xp+uwnKYgC68EkVLMb{9lF)|9Wh`Gb=S0^m*|gY7 zX=ZRUr^-bWIbtkDH-<3mZXlT>CLL#W#^q|Fx7E?HqM_WZZ4E?3XGHPpc}+Dscaf_q z@pQJP*QHcsR*ZZ1@<=b1wz`nwOQ+yv)lt2W3Kq^8x?W`q_ywcrwW%?iqjN_tTA?GJ zT#dU6!;ROF616j(ZFT+Y-y-#u5rwHvuPoEK>8E|&-|d%v3WKlPC~}o3<4-$0xq2^Na2iOym+aYrb9Mpmz((AS@yP!vNcKhJShJG`haBgaH zV(O_a`T(9(73=!_UY~cbK6+m@KXU)+`|kg7xoQrM7p=lpB@Otwf?o7W%VuzqE3IJ0 zfi~(jyf=Eg?2*8Rc6tLRUyr`FN%tyIw>89fQ%%HH>teI_!VI2N3+wv*_O>qHIw#7e z^_osIuQeVXlttA0PU$MDV_xLcH4Bxg?9*nh`Bn7an!rLdX>7{Vq2dkTiYgA-6L#o zFJXPVHtSd~gWN6RrjtEb_aolv`|dq;|3jy|L$cVL^(H6AvQx8JPoEX~=C+#L=#`sp zy1ybf-y3o>{G{CR)7!W|D{k^E zV2!7n-rv7L9x5D`eP@2aOM*Wnyk~B}%LMpJ;heChCqca(l2{r3pH}|Tptk@PFiH31Y(kp=kKwK`$k$>1p`A5Y`@!Wvd0v}aAHsH0vB6gFqY5aS{e|LPq{Et=T84Z7Oz>C2DW5NTc2Rwa4T>Y1n zW$-Mc9sh&yHMIfLj_R*`mGBDu|3Y}ryS8}^@OOlVV%xkX_&RxjxBJ*OZw-7<__CD& zZyo%g@RhGf`N1XOU8|Cj)LZlWIraa_fG164_yzU<>VP){{!Qhk)DQfhg|B*b!1DvV zOE>~{^^+o+^!`l353CKCXN{WQetEiZLs-Tcg)f6&6#wBpa^4YF1ALA6uTcC3_^%}X zWkZ8rlXwmMBVp;EYosxx9ko2S312=U}m3bw=yM>eBiu#vjo(b@7;SBim>i_XUFBjn5!g=tE;=j8h z{U6{R!e#I);(zrgWZntz9^nP>AB+F6OhVNFUn#r<{(s^>@SL!;o3_UZv7G}|X@61W zXO)w3K7p5&AC~h+)Xi4|6>D?dI|ODP5*z!0rS3eYFE5-H)_KhN9~ahn%<+xFKZtou z({uJ|LDJWHIQt}77#1;GO+MA%*{25B*{3Gh*{8OI)%2Zx3d^aX?Cg^aeZ$T^$??z0T zI$!^Rur5BFJsRF4*J-P=UJz&XKP{%Cw>@6`Tid1|6+@0P*N-mL_}tG!cu6fFNL z`8VP3?A=;`)!waB_%{5Vz4PTdSIejUH?U^!1)N4>sk_>@6K%40!b1{9%hk7ceS6op zcm4I)57l~1<|n;}d2L`Gdqg;%wD(qZUUQq;JDtazy@`XJy^$%{_&a-(64v;?Ea~mI zCS>fL#&`Cnfbb$_E6b<)JA1PPcJ^i&?Cg!)`Y`DmdlCt4ydQWlWbOxQdd|MM^_a0Q z(U7@6sQ%8rL@?hw`w|P<0|_68zZAo43Gx>c)t%?Xo}>b-_9aK*^YC}}r3!y-{{d-# zy_X!cFW(V9k&|*u?%J-(M}_GUoc$@o-`Sr9u!z~J z@)@*0b+EHPZawAf&pPanS?`Fw@i2codlbg}?(EMH{GI*r;a?Ng^^LPH&i<%9(e}{r zd&T}ZdtyuLndeVIf3+`Kez(4H_C;CkPnpuIAiT3b%kbC!7?AeYXO)}mPqo``#{LLv zzjg9$_n$Y_(XRdHP5tLh{pU@8f6tqY{gL@e-?8v9Y3h7=ukhpF?#^S%abaEGsK49P z{siq!0_^NfD!^)QGQt}FHzmCtFNQkL$(_9^BfN;&D)Je$H#M-cH_rYzd*jwSUz7Cr ze5JeI`5WbiUGHfA#vZMPJYDZ-`p*7%nBT9K3H$9|m3bTUl(Roku(LmEk2F0EzgNO1 z;BQMW@1BsqvrjI+4E)C>{pbTCj|-0k_(tIv7)g0?ISAUjpncQ#`*QGi z_xJL`n!dAl3-EXLZV4=6HfP`5{k?{`YJSe%HNno_x%+j_-i0xrJ9{?-cJ^)r^S`q{ zKKz}%i^AX8pCs7XJ7=$)z01MhmfpTkq4jnCW%#@ND#GgT>|GW9Ew3@GH(Pr7EiUqR_RZzD1b=7$)V>AtTLHWD8VK*~ zpR;ey{q z`u(>{k&k|l?o#BV?@(NdeDqn_rN~F`VP1-SbnSR4@=+UoDe}>CVXJM>lM4&l{#FYm z?iq4lH0PQ9ZeGyqoSb(Wz7cekW4&fl_Z(&M+i*{jyA3TTC2jx9lxMrS2NU!vn4sIu zyTU>D|7*&#-Kzy1<@iV8uHVTCZr?HG*lxZ{7j!SeUFVVDmNo4lj;35)pWj6KOO*aQ zQBM7?5pRR|S-hb8*G#ybo9g>>Cf}XrUEg5%CrrLOJ-wz5Zcm!>?=;_i3A+Cp+__&g z%wXpial0|TV#>2?Q+Xy#y>@MC|8JV|?Ap}+hv3fb|G!Onc5Q0^55k?>|6$V(@`60I z=Px0BZvR_Q&fe{>FSu{q{=G@}GV=^8=<^Me{$-oSdDxWaGV|TVV0gWT*I%QJ$@O+{ zJB{#qk1M#%!+nL^HO!#-CB`@_f@a=;^O+Z`?j*%Cm1%`=2)T+PA6w|D!3- zzD@0~YiLi>=l1`yDaXD|?H_?VxBoj#J4iXH{XdTMx&3#coW0xM{epI&&L;i+UMk?E zho3R&>^I-x2zq_g-7oHKzHSa*H|butslE#)o$JhZ-n*gYex1qpx=r@_Bc}YGRoB%X4SEOI$@>jc&I6nJWz>}Oz^3xQYRY+FQ@^|o z?%XeHrhErB^^4xS^rSr8FZY`AOF5}uK8N(VUk;$0+%NK)j{IhNw{aRc{I1-$-0Quy zbA9EbMLr?n)jbJz?jJ$;D7k;eq;E1eKI^#d{ut6haC47SkFSwk)0btW*?g$}R`*qb z>+mMZsUzyD!1b_8|7()vRp!48*aV`cUF3f*7DaxP6kQw%z*H1FY?%&#-j6RP9p<+x#?JoiCmXu+A6y+b+7PzxKzM0<7h&2Uy47 zYJfj0d{B1XG``m9T?(=(@08s=k5krJ|1sHhQ`XsgQb9K51G0ZqK{n-x?4MAOP5FrI zpHq-cS@Y|O!jXp$fo?H?0d9Q zvMJBWetm#T!tyl@v#Gxx#);)?eH;8U#ChT}@dEJ@@iOrW@hb5e@j9_5_ER@kpCMwO zI7%ERP7-H`^TcK11>z;*W#Sd$RpK>bedo;8SI27@^M%%5d4xDZ93xH;r-*aJ1>y>E zmAFP+CvFfoiCe^N;;>d+wod(t^_hFn-(45E@CowQ=U2h-IpP9wg}6#wBd!xSh?~SM z;x=&@m)7cR`k&aX8=QZP{1e0};vBKPpWkio3i(%wYs7Wp262y>EmAFP+CvFfoiCe^NVtZe^+aDu32xN2Z5h0EdCx}zTIb!`kT*34! z#8u)N@k)TzzOE9l5w8=Qmt!QJ)=%RP1?;=BPaGwV6DNr?#ChT}@dEJ@@iOrW@hb5e z@j9_v>UQcck63hb>=Q?cgOk54HULVzn>%CUJ|nO&rGhQ0uGtjSxqO zW5fyK6mgEYKwKfN64!|9#0}ymaf`T39LA%tPW_1^#4+Loaf(>~H=J%R{Q_}?xJq0j zt`j$io5U^RHgR~*#`292M~Gv@3E~uSj<`TvA+8eFi0i}+;wEv6xJ?|!jT+ZKBg7G6 z{p}RpT=)cWia1AHAg&NsiEG4l;s$Y(xJBG1HvbqgP@fTbuSGXkzX)-RI6<5V@Bv9D zPh2KmAYLL~CSD<4C0-+5Cw8|awSHQ@Av|(*>=Q?cgOuRt6M7&JALcB`6 zM!Zh!ZUnpf4h=~o$mZB5juOX-lf)U~JaHw!5y`hoTqCX%H;9|WE#fwDSTAa1)B0-u zBg7Hn7;%C)MVuop5Lbw+#5LkNaf7%?+#+rhhvhvl-8%Irju6L)6T~Uv9C3lTLR=-T z5!Zn zgg8c=AWjkIhzrCO;wo{CxK7+4ZW6bM+r(i!3hvaOI6@pFP7tSvbHoMW3UQUVMqDRu z5I2ci#BJj6o2dVZBg8S{1aXQuM_eGT5Lbz7#C75Zag(@3+$Ij=k$C~=%PNt_|h6PJk>h?j_$ ziC2hMiPwnNiQOw;o%-X|4#z%mlsHbDB+dmmA?;Zpt`Jv=Ys7Wp262>t<(R+ z5#ktef;dH-BQ6kEh^xdk;yQ7IxJle1ZWD)Zr1}#_1N@)_jT0w{GsJn~GVucO67e$e z3h^rO8u2=@d*x31TkA9QmTvu(ec~u_oH$9GAQC$w#{&GQ#7q#Uh;zgR;tFwaqblek6PCJrB>`V&WpW5fyK6mgEYKwKfN64!|9#0}ymaf`T3 z9KMa}PaGkR5hsXK#5v*uafP@_TqCX%H;9|W>j9qAsz$r@RURVtiKE1E;v{i~I8R(A zULal~UM5~4UL{^5UMKbrQ~im3;wW*PI7yr#&J&l37l@aLmx))1SBck%*NM$TJ81&F zzBB!=5AkGk90_nq++)NE;uLX?xIkPXt`gUX>%CUJ|nO&mUIs%z@2^&26M5XXoU z#3|w&ae=r(TqUj%*NGd%P2v`Dn>c)o>Q5XYju9t_Q^Yyq0&#`7N?aqZ6E}#P#4X}B zarkzsKXHUOMw}o{5$A{t#1-NyagDf6+#qfew}{)s;XA1Q#1Y~cae_ESoFgs}SBR^` zHR3vPgSbij*8$!sRo!-Hx4z2P5Wki981YHs#{#@x(wijyDDfwVKS%r};#UH!OVzIu ze}nk1iMPeN_0{;-5FZS%9=?nCH1T7^lf)k-elEZXN&kz)FA~2({8i#_5Pv(sdVgZi zUGgEDyI*lV@j>Eu5uYX=53sI>=7>K|{2cKYiC-lCN`Te=yh{8R#NQ^~bGO#k)>q?S zPyETyKMyU2E`+L~&xAf3`i0QvLjNN4`Oq(hmO{^mz7TpL^u^F~p-+cC75e#*d=v1{ zT(&Uh9h%8b9y;;xdk!g#&rIjjW7FrR=DghK)c9mJJzJbjXA2W^>FIoSYSadw%iku> zW22LkvwE<>KNxLlE<1D4c)jX{EuHQyPj z=GpAU^6i8OMm33ce74TF6C`^+J2f}!9XdOjpY>+PW=7}6a_L-lG~cu3O*d_-iR+gQ zQ96yw0H~yQXmaxW+4Si6_{{9Y8ELfwt;)cGo?WQ>E_2Lv*X^O*}0jy(Z@xLXN}@~@J`=%@2UGAI^~@{apJD@ zT`DmvcUrl_%I#JTJ3VIkD4d~3fKGvjtww>+SURTJ-C^bMF{?*_&?pdkSNcwkbElQt ztw^Da>oF@w;p!B4*y>&B!*|#utlkcmM6AP6=g>KD4u^3NOW$q_ZbS-h^oW(i&?pcp z*_u#yLM1mF+Z{-5)}eFY93)%gb65J9Ex3`}ElIHr93u1Q}B`AV>=ii z7_oD{kIroob3=$=)b44vW!#NHf{_E~+Lo~?j5*VeXe-9jM((t7hn3r{NShkZV?gLp zAoK{(De$n>C=e>`Z<3S|iv#Hh>mnUt4rGKJw*6~W28LlBA?84$8kGTJJvs-@K}L%4 ziKP!mHK{wG64S8cX;iYrZ3|=T-^j<#LH!-8&D-_Yg^c6p^`bbiS=X+EvhF*&PUa|1 z>`<@6g4>@<%Lwd$|Ssb2Xn^r*jvc#mU7VLIPhB?UjG*M{R)Ds((#_^~yhv{4+Kg)BpSAnDhVo7VRJTF+`*Z)5V9c z_a|Gl|5A_o@9&ZSzuYSS`)v-dRsUb!BLCGM^}n`9{uycfUhO~fsLkJhjru<(k$bg& zbj`*O_WyM~@_*|V`NuwFK*{lAMoQ)WJjrvbX z{9g56S+ntj^}nG<{>Qe+KQn3LzgGRDTjalv{4+KgQ~v{U%=P~nj6XWfz2wt2qRyGY zP1`EC&5MJ&ar_M8F9ZY2vCH2%UndbcP4!zx{DXMk+l8m@@b*jmUhSX!QyU|Lh&unj zO?H>R>wmRLz4E{QIUDgH?%!Cl_jTN{s@n8k`7a~?IPMQ={%@C^^Dj#K51#(+w0MbP@Ruax>r5}UTf?^~w|u46RbPs{G|A3==&4}*V!`Tzg` literal 0 HcmV?d00001 diff --git a/internal/ebpf/generate.sh b/internal/ebpf/generate.sh index e9ef3a51a..83cb87d0f 100755 --- a/internal/ebpf/generate.sh +++ b/internal/ebpf/generate.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# Regenerate bpf2go bindings for the Linux eBPF process source. +# Regenerate bpf2go bindings for the Linux eBPF syscall telemetry source. set -euo pipefail ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -32,5 +32,9 @@ generate execve ./c/execve.bpf.c generate exit ./c/exit.bpf.c generate clone ./c/clone.bpf.c generate prociter ./c/proc_iter.bpf.c +generate file ./c/file.bpf.c +generate net ./c/net.bpf.c +generate mem ./c/mem.bpf.c +generate ctl ./c/ctl.bpf.c echo "generated eBPF bindings" diff --git a/internal/ebpf/loader.go b/internal/ebpf/loader.go index 6046d532c..09582a9f4 100644 --- a/internal/ebpf/loader.go +++ b/internal/ebpf/loader.go @@ -42,6 +42,10 @@ type loader struct { exit *exitObjects clone *cloneObjects iter *prociterObjects + file *fileObjects + net *netObjects + mem *memObjects + ctl *ctlObjects links []link.Link iterLink *link.Iter once sync.Once @@ -68,6 +72,22 @@ func loadCollections() (*loader, error) { if err != nil { return nil, fmt.Errorf("loading prociter collection spec: %w", err) } + fileSpec, err := loadFile() + if err != nil { + return nil, fmt.Errorf("loading file collection spec: %w", err) + } + netSpec, err := loadNet() + if err != nil { + return nil, fmt.Errorf("loading net collection spec: %w", err) + } + memSpec, err := loadMem() + if err != nil { + return nil, fmt.Errorf("loading mem collection spec: %w", err) + } + ctlSpec, err := loadCtl() + if err != nil { + return nil, fmt.Errorf("loading ctl collection spec: %w", err) + } var execObjs execveObjects if err := execSpec.LoadAndAssign(&execObjs, nil); err != nil { @@ -104,11 +124,57 @@ func loadCollections() (*loader, error) { return nil, fmt.Errorf("loading prociter objects: %w", err) } + var fileObjs fileObjects + if err := fileSpec.LoadAndAssign(&fileObjs, opts); err != nil { + _ = iterObjs.Close() + _ = cloneObjs.Close() + _ = exitObjs.Close() + _ = execObjs.Close() + return nil, fmt.Errorf("loading file objects: %w", err) + } + + var netObjs netObjects + if err := netSpec.LoadAndAssign(&netObjs, opts); err != nil { + _ = fileObjs.Close() + _ = iterObjs.Close() + _ = cloneObjs.Close() + _ = exitObjs.Close() + _ = execObjs.Close() + return nil, fmt.Errorf("loading net objects: %w", err) + } + + var memObjs memObjects + if err := memSpec.LoadAndAssign(&memObjs, opts); err != nil { + _ = netObjs.Close() + _ = fileObjs.Close() + _ = iterObjs.Close() + _ = cloneObjs.Close() + _ = exitObjs.Close() + _ = execObjs.Close() + return nil, fmt.Errorf("loading mem objects: %w", err) + } + + var ctlObjs ctlObjects + if err := ctlSpec.LoadAndAssign(&ctlObjs, opts); err != nil { + _ = memObjs.Close() + _ = netObjs.Close() + _ = fileObjs.Close() + _ = iterObjs.Close() + _ = cloneObjs.Close() + _ = exitObjs.Close() + _ = execObjs.Close() + return nil, fmt.Errorf("loading ctl objects: %w", err) + } + return &loader{ exec: &execObjs, exit: &exitObjs, clone: &cloneObjs, iter: &iterObjs, + file: &fileObjs, + net: &netObjs, + mem: &memObjs, + ctl: &ctlObjs, }, nil } @@ -171,7 +237,7 @@ const syscallsGroup = "syscalls" // in contrast to the one-shot iter/task snapshot program started by // runTaskIterator. The caller starts the ring buffer reader first so no // events are lost between attachment and consumption. -func (l *loader) attachPrograms() error { +func (l *loader) attachPrograms(cfg *config.EventSourceConfig) error { type tp struct { name string prog *ebpf.Program @@ -192,6 +258,60 @@ func (l *loader) attachPrograms() error { {"sys_exit_fork", l.clone.HandleSysExitFork, true}, {"sys_enter_vfork", l.clone.HandleSysEnterVfork, true}, {"sys_exit_vfork", l.clone.HandleSysExitVfork, true}, + {"sys_enter_kill", l.ctl.HandleSysEnterKill, false}, + {"sys_exit_kill", l.ctl.HandleSysExitKill, false}, + // tkill is an obsolescent predecessor of tgkill; treat it like the + // other legacy syscall tracepoints. + {"sys_enter_tkill", l.ctl.HandleSysEnterTkill, true}, + {"sys_exit_tkill", l.ctl.HandleSysExitTkill, true}, + {"sys_enter_tgkill", l.ctl.HandleSysEnterTgkill, false}, + {"sys_exit_tgkill", l.ctl.HandleSysExitTgkill, false}, + {"sys_enter_ptrace", l.ctl.HandleSysEnterPtrace, false}, + {"sys_exit_ptrace", l.ctl.HandleSysExitPtrace, false}, + {"sys_enter_prctl", l.ctl.HandleSysEnterPrctl, false}, + {"sys_exit_prctl", l.ctl.HandleSysExitPrctl, false}, + } + if cfg == nil || cfg.EnableFileIOEvents { + // Legacy variants (open, unlink, rename) follow the fork/vfork + // precedent: some kernels refuse perf links on them. + tracepoints = append(tracepoints, + tp{"sys_enter_open", l.file.HandleSysEnterOpen, true}, + tp{"sys_exit_open", l.file.HandleSysExitOpen, true}, + tp{"sys_enter_openat", l.file.HandleSysEnterOpenat, false}, + tp{"sys_exit_openat", l.file.HandleSysExitOpenat, false}, + tp{"sys_enter_openat2", l.file.HandleSysEnterOpenat2, false}, + tp{"sys_exit_openat2", l.file.HandleSysExitOpenat2, false}, + tp{"sys_enter_unlink", l.file.HandleSysEnterUnlink, true}, + tp{"sys_exit_unlink", l.file.HandleSysExitUnlink, true}, + tp{"sys_enter_unlinkat", l.file.HandleSysEnterUnlinkat, false}, + tp{"sys_exit_unlinkat", l.file.HandleSysExitUnlinkat, false}, + tp{"sys_enter_rename", l.file.HandleSysEnterRename, true}, + tp{"sys_exit_rename", l.file.HandleSysExitRename, true}, + tp{"sys_enter_renameat", l.file.HandleSysEnterRenameat, false}, + tp{"sys_exit_renameat", l.file.HandleSysExitRenameat, false}, + tp{"sys_enter_renameat2", l.file.HandleSysEnterRenameat2, false}, + tp{"sys_exit_renameat2", l.file.HandleSysExitRenameat2, false}, + ) + } + if cfg == nil || cfg.EnableNetEvents { + tracepoints = append(tracepoints, + tp{"sys_enter_connect", l.net.HandleSysEnterConnect, false}, + tp{"sys_exit_connect", l.net.HandleSysExitConnect, false}, + tp{"sys_enter_accept", l.net.HandleSysEnterAccept, false}, + tp{"sys_exit_accept", l.net.HandleSysExitAccept, false}, + tp{"sys_enter_accept4", l.net.HandleSysEnterAccept4, false}, + tp{"sys_exit_accept4", l.net.HandleSysExitAccept4, false}, + ) + } + if cfg == nil || cfg.EnableMemEvents { + tracepoints = append(tracepoints, + tp{"sys_enter_mmap", l.mem.HandleSysEnterMmap, false}, + tp{"sys_exit_mmap", l.mem.HandleSysExitMmap, false}, + tp{"sys_enter_process_vm_readv", l.mem.HandleSysEnterProcessVmReadv, false}, + tp{"sys_exit_process_vm_readv", l.mem.HandleSysExitProcessVmReadv, false}, + tp{"sys_enter_process_vm_writev", l.mem.HandleSysEnterProcessVmWritev, false}, + tp{"sys_exit_process_vm_writev", l.mem.HandleSysExitProcessVmWritev, false}, + ) } for _, t := range tracepoints { if t.prog == nil { @@ -276,6 +396,26 @@ func (l *loader) Close() error { } // Replacement collections share maps owned by execve. Close only their // programs so the canonical maps are released once. + if l.ctl != nil { + if e := l.ctl.ctlPrograms.Close(); e != nil { + err = e + } + } + if l.mem != nil { + if e := l.mem.memPrograms.Close(); e != nil { + err = e + } + } + if l.net != nil { + if e := l.net.netPrograms.Close(); e != nil { + err = e + } + } + if l.file != nil { + if e := l.file.filePrograms.Close(); e != nil { + err = e + } + } if l.iter != nil { if e := l.iter.prociterPrograms.Close(); e != nil { err = e diff --git a/internal/ebpf/mem_bpfeb.go b/internal/ebpf/mem_bpfeb.go new file mode 100644 index 000000000..e2ee49396 --- /dev/null +++ b/internal/ebpf/mem_bpfeb.go @@ -0,0 +1,174 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (mips || mips64 || ppc64 || s390x) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type memScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadMem returns the embedded CollectionSpec for mem. +func loadMem() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_MemBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load mem: %w", err) + } + + return spec, err +} + +// loadMemObjects loads mem and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *memObjects +// *memPrograms +// *memMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadMemObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadMem() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// memSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type memSpecs struct { + memProgramSpecs + memMapSpecs + memVariableSpecs +} + +// memProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type memProgramSpecs struct { + HandleSysEnterMmap *ebpf.ProgramSpec `ebpf:"handle_sys_enter_mmap"` + HandleSysEnterProcessVmReadv *ebpf.ProgramSpec `ebpf:"handle_sys_enter_process_vm_readv"` + HandleSysEnterProcessVmWritev *ebpf.ProgramSpec `ebpf:"handle_sys_enter_process_vm_writev"` + HandleSysExitMmap *ebpf.ProgramSpec `ebpf:"handle_sys_exit_mmap"` + HandleSysExitProcessVmReadv *ebpf.ProgramSpec `ebpf:"handle_sys_exit_process_vm_readv"` + HandleSysExitProcessVmWritev *ebpf.ProgramSpec `ebpf:"handle_sys_exit_process_vm_writev"` +} + +// memMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type memMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// memVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type memVariableSpecs struct { +} + +// memObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadMemObjects or ebpf.CollectionSpec.LoadAndAssign. +type memObjects struct { + memPrograms + memMaps + memVariables +} + +func (o *memObjects) Close() error { + return _MemClose( + &o.memPrograms, + &o.memMaps, + ) +} + +// memMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadMemObjects or ebpf.CollectionSpec.LoadAndAssign. +type memMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *memMaps) Close() error { + return _MemClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// memVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadMemObjects or ebpf.CollectionSpec.LoadAndAssign. +type memVariables struct { +} + +// memPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadMemObjects or ebpf.CollectionSpec.LoadAndAssign. +type memPrograms struct { + HandleSysEnterMmap *ebpf.Program `ebpf:"handle_sys_enter_mmap"` + HandleSysEnterProcessVmReadv *ebpf.Program `ebpf:"handle_sys_enter_process_vm_readv"` + HandleSysEnterProcessVmWritev *ebpf.Program `ebpf:"handle_sys_enter_process_vm_writev"` + HandleSysExitMmap *ebpf.Program `ebpf:"handle_sys_exit_mmap"` + HandleSysExitProcessVmReadv *ebpf.Program `ebpf:"handle_sys_exit_process_vm_readv"` + HandleSysExitProcessVmWritev *ebpf.Program `ebpf:"handle_sys_exit_process_vm_writev"` +} + +func (p *memPrograms) Close() error { + return _MemClose( + p.HandleSysEnterMmap, + p.HandleSysEnterProcessVmReadv, + p.HandleSysEnterProcessVmWritev, + p.HandleSysExitMmap, + p.HandleSysExitProcessVmReadv, + p.HandleSysExitProcessVmWritev, + ) +} + +func _MemClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed mem_bpfeb.o +var _MemBytes []byte diff --git a/internal/ebpf/mem_bpfeb.o b/internal/ebpf/mem_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..c42f95631c87094af4da1872cb54734f10ec1c36 GIT binary patch literal 32240 zcmeI4eT-vQdB%_J`S9#+5<_-j3ZcCa8ob-hu4iXAF$oFI#|Ect!jNphAtbhU#=EvM zAKn>H;>m()RH|Ak&}m6qtEKHwMP;D0nm<506{u?gtz3~mMrv9O1*)N~R995(NL67Z zDz?vi&U5YScV{*mf+%X|YOkO3JLf&$U-w*(_m@tddLSGQna&k5--kQk(FuX0ny{4O z=j%=AQr^1F#hBHh@lRjg64#|e&VSG|=JMssTf;8gdE)a|oGbJg^XfOIAYSKbcOYiQ zg)f%n)0pwk{K)BkK;mB*49BS+b(m^%M0k`e0{f7y2XvF%rfyKzscY00wMkv2u27e$ zOVkE+ky@wLs8wp2TBPQv8R{4{O-)gg)C4t7^{B(t7&S^2LH*4Zb(7krZcx{$Yt$CC zNnNF`P?xDo)CP5tTBp{iRce`9q~@p@>KHXmO;MB71T{|esKeA4HA)pR3$HUSK4${h z*@uj^1AAh3A!KZPu*)ap?7%L+kh8m#6YI{nzy89~wTG<>Wv6vYUR`Yywhj||9H=%cn{l!K3G)CK9^u#w@y=Ysp z(@wwax7%Ymvqvn(KYMNM#`=d2n9JXlc&vZuo9xeibGa@47fRtWwMflTGt@C^nwp}z z@lguf5+fbg-=(m}a5r8`;TSne6+ymSUrJnGN})FWH>m5>HEN66q^?p|sLRwPYJ<8+ zty62%Dz!{4QghS{b&Q&(rl?73f*PlK)M09j8l{S${#;*5W|Q2eZcx{$Yt$CCNnNF` zP?xDo)CP5tTBp{iRce`9q~@p@>KHXmO;MB71T{|esKeA4HA)rn_rLxNIpgvvx^-gw zoViKDJM%R!)Um(*k}WOf-RqtIIh(rio^}4-rC)Xa@A-&R&Vw5+6y5rO^!p@aJZJWc zJ}V!_c;h*@Ze4nvWi#l~ExLJWVob-^oBeXIoQX@fyLdN@IKA|SZaT96Go2{YIlu4* zH;*sm&6rp+o!Bc*=MI<7frP6c)9HJea`gG-$g>>ddADvdzIVg|0C32g*Ox`4~khjRIjzc2S zK26aJ`A}38+#<)wYvf__I@u#{kmKYwIYHheC&^pnlw(&8YE*>k_mhg0NDQG_SS zZE}LVLAK>wh=tb4o+x;YY|901kz)*RlB48RvWUcAaqP+kUM6oce2Ls9H^>|0MY1gy z;@8P*46l(}1&n-$y^X&GWF$Z-ML0!f*7f@8-g%-E%RtE%|eu-SaBWuSH46e?G?f^{nuP&s^RR zy;ze^?7Pda?D^H-XCEuOGkL!;Pe?i!s+=!X&XX$VN0rZ;RnCVh=RuX@zsl#$DxWv2 zp$(TF$9I+Ey2|lf4K*3QO10zTLY3pS8d{=%gKGO9;kMtQHTqYnWvXp2gy+Z^>KHXm zO;MB71T{|esKeA4HA)phd+~X*YBtGj>IQY4x<+kLo77e63U!&fL~T$PsdZ|NTBVk$ zMQV9ocE!g)83z?)>7FYT`VT+8RhAJe(^)y!KvLHv2Ud#-i+Aqx zkp1D#72u}W;oKah{VG{x_gotb*>Q*WBvomTpOSO!-raNU?zvXRBhJBYK3BQ!R*jp# zRkOnIW$F^OL0zQQsWqw{=Sa6qE>d&U40Vi}rlzP#YJwW4demWRj2adFe{!yUHS>1& zT#Ipnb8HGC>c-jbxz^3IQpnA--E*zy#)td<6W>d_b*ALLPXybG=hT-w*Y4dt*Shu^ zL@RFlz3=Y1RvKvcT)TU&U6X-;bAo-o!8v%H?1_RmL=kS+X>glt*KhD9+3suLEpkc} z=QI(CpB4p2$z$XgIYS;M=g1zpNRE@sj(5MWWqa6uK>IF{+pc{=4e|zgk-Sc>lh?>K za*JFgH_5i$(Vwg2BEwh6Ir1_&LtY|}ksIVRd6AqV*U3q8jhrA?MStAq+WY78liouQ zo<91nu~U-%Puum~KeY2{*p+MWW5&pR{eZChhSfyi47pin`kPsDl$>hLD`p}5Wh4*Zj}?bvxeR4z$R+Bt<=+Ev=JhFjWI#%UAx zH`uOkhTA5__IN9JyYXVju*&advBh<@e)RME4)gnY*a!2AO9FxVNiqC7`D0D$ES|o< z9z$QgL~?q07^Y=dt*X~De?==K@UTp z#e^2WW4I+it`kUMi}jE)zKVME$ykv()o{y%4Ca3vMLWR!Z$lA(fINp_md4T~YZHqz zD05oe9{i;&;!eRW^YQJtYjEE}cN6YWxbJXT4c-O!JK#>i|0LX)i=i6ar{PB1hni47 zqh!E+r?~BcXv{kU{$q&yxKsj{tmAqjLt#=Mn}VBl2-fK1R*i$^5xFQ<FlS4Xh3WiMq2oX~l9F?>oAG!tKkFy&YqnU(mkpwxnM6vJ+5C7RYipF9 z%|Dx+TbPr27G}-(%+%D(bk^3MZdVLKdA3lPDpyzs-?KDf@DGJX`}nOgSDcxx7+e32 zpQZ6i)fDs76O)B*zS*fM6t7Y~ijs`yCnx8`;fmyf#*a=FrjDE`pFJ{e(B9s*3B>2n zSmPCM$Le{9koiF~e$*BGsO!@sMKd%r?cL=e`7Fwjot&9@dcK@3Octi%x3J9)d$&lV z9K6#E%@!*2v(p};+;WR|Xl5E-rL$iA%@U3>+a`{meBWs|lpcEMp0R@m%@Br+_grCi z2Kgiq1Kqw;j{eAyEI9)u$MUO&6S=j%$$uM z5;KVdz4dPNO9FYJ>efB?#EB>G^o}0#X3m~PT<_4)uH8tF-H5Zph&xv)_ShZku{-AM z%Cj@Qsg3qn9d}k|C%P%wq19tF`Xow?Y2;zfAV7NLTmi#ves&fEG+QoBWGm-N6Y)Sl z_`Nn?p1?F=udxl$d`Rf9XWQrAu?MpEJp4GKet7#CP%TvqI=5$Z!f%Jc*$MFn#N7Ou zDOjJKoterq|K4G6*!2OjIPAqS9uC?rDNS^Gw`T;|;daowV1^28iP_Thxij-;v$KV{ z!t65zj7_^Hb-TTA5Tl@zTERw^apxLShMiq|nA{aZy}LTOcI%{MW7%;xw=g}PJzJ24 z3sX3opO}c-z{B2%SYI(P3q8ZKUq4Ol`h2 z;rw-q2*~=Q5(#3IBC@0mPnRGp{5)JL&f6u&bp5P!>atj&uW!9u9G%W4+ZL_l=bo12 z{q+x+rTfr9otzj;1B=qipu|QBYYH-|$7d!AmfPJ4VfrE5Qy?0%i2asaZtuwmF@^)IgQ4mXCz{xmY)* zrfmjvpRsKxj)J(JhAUfNLj)9{6d`%K(%?2d#h973~;+|NZ~8{g6})h@s(Y`_mw$<)`qRD`o8ZdeC@u4AiLNj zA2IV6erspJMejW9_-S-J5Z<%6jF%VeobVrr>>7`R`Fs?dCcdAYDpyV9m`VlA9aYNA zq>tHjWLC)nI)SHz?ROm+D`MrZ+HQM@%ZiAgD;{7lmBtHmbJ=I6u)gOfp4s7P=n6A` z_hEv8aQj5p-GRm)dCz?(AAL0YzK86r<7R{on|mVhBsQe+nd!NT_sk52*dezw*|1TB z1s@%xT3lO7GtU&pJ$$0KE_@jNS3U;0O^gp1ey{r-?vE0AI>9Vu0@&Hc?apOe5A``y zuq~3E$F3K@1=)3a1#awkHUc7do_1thBIpS2?3w(WYzCb$8J&I@9&CC$LKeS31Mbid z+gkbEaMg!^?Ym&R=YgvYk7s8~mBKZQ58C-9dnE(p{f|6&`ed-*U*QM|7GE{jPNm=8 z%rE@4Hfylp+qLVd2k$%i@S`Wq5zO5=Gg%rhOwY-S9lope+@a7+Kylyrk}>=79w3Bw z267G!eH`kaC-GjPuk+3a{`hsmp5F_E<2`}RgTI88 z-^+x)VBF6qJ-ET0D-QlIysa2C;j$cOQ{+(-uHeWme*ej)zX6r_VVvXB1K=XV zOD6Jp;i_Y}+*M8Z(LdM!W#y%pXaB z(O!|~P2^i*pA0a{6iGV{vpx~FU*tft2u_tT`LTK z!Gsqje1rUVCj7i`oBSOUJ}$h~8()UIl)vvkOgM#CVDjCgaKC55_rpFEC*Nwqr!Wpe zQXdI_*o0pIN0@*AoCz=Q2d^?*81LUAP4e%WzIRB!w8)<~eMz)kWS#uirtdiNk8F_t z-h`WY7Z}-ejG~0s&`*6V@4$^F{36>{(-m&e@((Y70&t$yw`+ZlJpV`pTH0o zX8i^(nDDny{=O8$g(W=g*sp(IhT)&Ylt6p*70G{zA&vLGeGO&5@{oCJSxX)_=M*sG223YJ_{wUU+ICvn&aG!?*jQHqR zTc7Aln37R&+Oh2#lxJX!jPh6UK6)S%V2RKA4S6Q=Aqg)sTv)=(A|JzdUjxelmin)df6YV|F+K)X1B~%J&?Nr} zmO6~LsLz`w(g5#ix$r$n(>EsECO>8RPJ_|Kc0ID|mxRln_D0;eWS!dc6)X`2Ks3Pb z2gd?@C)jhm_k=Mo$U2pF441pcz*r|b>s*mM%KeM&8WxuLHKz9vzWzcxb@n5F|3cX$ zz0SpU3j6!l8q>$PvHRBs*gL^u9Cdb<<+&!tbg(b(?oViEX-D*f-LH1{r``RD>xSLGuwL)( zPi}q;{V(rNcKwod?n_w10{hdxe=?!?*}ys{jJ4R`pKQ3Sd!AbdclW2C?EYliAN^*} zzJdMex+N1zo$B_RW%-VHcYo^cN4w{z-Sbn+t-qb~)b9Rd=f{wor|_Ko({g^Y>lfBJ zS-XnN!)Lnw@*dB>!oS}2H_N`SC=!8s%k#y6f3Tg;cl~?X8SfDM^n2R*=B|HFJHMst-_y>2(Dm^=F=6>zN#@(r&Np@ad)isP_n>`GJO6gqzo(tQ+Vu~%bLf+D za7S3+iqx@h{wH3@#pvmeLl6F~fd3f7#s6;u{)vEp4(Y4)VK34RJsPm5x#Sm02mHbI z^6=S4I)e`VPkH}sejon+_-BBmZytt!uz}%a?L+Wa{VVq2{m56|odqx7E)LHlxI+xA zL63G>-e;LamrV-ppgr2NCwv8b3^&uWGTP+!W8h%=E8t*x7L|QU+5aCe z&tMw$mG+e{IB?m&S(f(oIR|$lz>{!G`}yHAkEMNmmiA0`S^oap_8r5GoRMXW`+N#+ z8B0EY5N@1DIxPA9Y=A!mx2&hWz2ql@!sjK$D~g+n*A#Ck-t1*N{sQ@hVk+EIoKT!n zJf=9OxU9IQcv10^;uXbB#cPT;6mRx&7#M8ta7?kMSjIx2zr!-#f}BxYR4n5wXfN|I z$PLBIidPl46t638E8gm5`Mx-qzr4@y;ke?Y;(#tBPBS*A=%FZ}oD2RPnIlxZ(#tBPBS*A=%F zZ}swERIvvR>|cWk#VN&OigSv~iff7&6)!1XQQTC#rg%f~W-m*1gY}EX6nlyjic^Zm z6z3F|71tCmDqd2&qPVG8`aAG^5taT9vh;U=hok|5JghjbIH@?TIHS0zxT?6WxS@Di z@v7pM;&sJs#aq3+C#rZ@aa?gyaawUkaZzzqab0mk@v`Do#Vy6_irb2}dU=;;Q1h;)dd7#jA>2iq{pl6>s(OzNq41#c{<+#c9PE#YM$c#dXCE#mkCU z6}J?xD{d>^>gDUAiiZ`)6(<#^6=xI|6;~D46*m+wD{g`V=cVh`6mKZr?B(l$!T8t5 z6nlyjic^Zm6z3F|71tCmDqd2&qPVGeP4R}}&0dzRJXrr5Vv0S*3B@VJV~TT%rN0B` z*&C$4gDm|WWa;l9uPSaSURT^!yw%IGsN!M8am7i+X~h}EMa5Ocb;S+E%ZgVOw-m1{ zZY$pE<<~?N4=auysEgRcwKQ@@m4RtHmZ17aa?gyaawUk zaZzzqab0mk@v`Do#Vy6_irb2}dilnv;$g*c#Yx3!#Tms##Z|?1#SO*FidPl46t638 zE8gnm{ZYlkisOotiqncGz=8KQ`zwk+s`z=uFDU+k;upbz=kxvFQv7d<|GSsvzlI3L zKX8-crxi`<-{cGj-3s@3`xZwGC;U~(!$_fw{A6Wi7@n3T@#DrxOtS}9a3MlwHg@977Q z2y}mH?El9K?iV@1e5GLa{{`5w*fum6#pb_roNjRNH}?MjkzkHYPU6>h_)YUH{%42I zkAwXGG~oz-^;XHBF-PVWrmV6)#{W&xseA7|k$t;?j5--{ay*+9&tpzbWN#Nb?qt-- zF()HV64~3tL_)DdOUl=rDrAK2*ws+Y!${`vrjW z2%UiXjK5pxxl%pUg}$yc^rvvYOnmu%vFDQYnOEquaQNTnrF>tfPd3T&e2Ty4@6^+e zkLTJ@@ONUW{Pz1lM6=%yGAS#5d_ZU(A3Np0$w)b<`ne;?|{NB-t3xOd3^wMz)Yb+!7NzktCG^?#}+v2o>a zOa8uHFn?*k9rAzE3c_$*t^Vdb4E%IcV%@!-+MwI7zyJMiF#or~W{3RWTy^oUT7TKc zcE~>~?JHLfx76SNemIbS=)3Uu^H=lma2;WC`SBce?ZKfB$Oi*-{099OslNF6gTr#z z^W*#B)LY}uao}?*ATWQ!(xyArzsz_!sMH@{ncK_HAMF#8zhl@T|9f9@<_Dg4+W8FR zAG#C1JLSK|_#Ra9m%m|>E13VcXD*+z?N+lv!H>!&NuG~_SD?IMiEFr9hrs%Xk N1C=}vXu55o09B=&4UllSckD@H zO?o#VhLU(*z2sASsXf#P)uXPPlGICU)K%&Vb(y+EU8F8hThw`K zlR8J8rA||)s10hBTA~)IgVYQ)O-)gg)C4t7jZuASFSUmnp?cJHw%ZzYmAXP*rY=zz zsSDH=b)MR!&QWKn)6^+ygIcAQs72}^HA78PQ`96iL5)*mRG->Q?V(1fM!Z^%@vS$Q z;d^YjTF$rOdu)JOj`{T1aJ3xs>#^Z3cAMayjQf4K>U*wiJYTfazAl~Kt5;=_fU%>`+U4_A zBwxk#ssx6S^8YF>*KSXA?-6G&|CuXmH;FG9UhjRcU4P+kvOjlvtH!-PQ!*8+&lIVH z)C@IEO;MB71T{|O`ZB}yWrpj^4A++#t}ioOUuM?rJeyggu2NU1%hV<6B6We2H9|FF#`jKG z>)p)f*L~xWKYx?a_I&03>gMxB?uWwran;Y;bf1U256+*r3q`*B0Lb%X+xBtgyKQ+c z<^V9e&9Io0+cAnOw zX%kS=k@VkmI)7->xxUNRQ__(dUalPC@5+&5Ir34-9rZ>0R_!$hL1injqWusz;M#n@>HOvdsPMi4Zb`sfBzIq!%-q3t7!a2MyOkHlKR5 zO1AmbqYZM>XgxYbw)xbf)8sV$XUQ4z9C?u3Bp1o^u96qX4e}y+io8UgCNGm` z$t&bJ@+!GWUL((w*U2riT@P!a1+rZyYav^Xdep9;wU8}GJ!;q0TF9289`#L6)WV`RyLfkK-gY@UV8MXT`#wWw4>Cb&Mnj){8d{7_q8rkmCXb*Cn{ww4dd6{g> zh4v=fa-l!Swp{2hvMpCF)FRt*)k5=RTdrEDNw(#xh33e%T(!_F*_NvonkL(F)k0Hb zTdrEDLAK?pg{ov*u3D%>ZW*nGisX6nAh}7-kmty0@+>(;o+c;BQ{)7>L5`EFMz8cf z(d|#NpNNt5?&G*Fz28lUw^!qOQ+r2`VOdYb)Ni!+z4aUIeV(|>9psOHJ}sJb-Tm+N zp|ghTFRa-6%ZNcQ{~K@a{?zTWPsj!Yv(tOpX#Ij6m-P#FJk~F8eq7+ZxM0U!{em5D z^$Y7Jf%=6t>MC`Gx=dZ7E>ah$E$TeANu8t4Qm3i5-|H7_f7dTm>0Y81se{xEHBC)X zlhgz?PK{B0YA>~i8lieru4fmx&RyX8cVUI?$@TIA*U<}$bYGyhsPoh&b&fhqou*Dv z8`LVbL@iPWsTpdTnxZDD32K}gqx#fdY7aGHwDyu6fAt%D>;Ah&yz9H|K`VHFv&#E4 zNx_{fWqy@#)n4Lx=mwj9?Iq5i8*IK3?oFLrdB6CRIJdsFd21IEH*dGkt#&`G&)9vi zKErip``l{Rkr}QtGhAn8xX#RQotat3Ou+uKeQvewu*tdA%-8L6tGO@OKDU}-vdMYe z?kiVvUnmoE``p?x4T<}FJMW?kJVjn2Pm`C)v*Z=>9C?-8B(IU@$?N16*{+A% z=T_dAZ=YMu{<(c_HPhoKdTzZ6Np7E8mw3)wq%Kff)Ol)?I!B$QPE)6-4QiEIq86!x z)C@IEO;MB71T{{LQGIGJwTBv^dQ`iv;@oc6)$MbuX@{SNbL(51x7+7d83^^6q-luy z%=Wp}wg=al8Ll%kTxYh=t!CY*&-73uR3m0T-U;jFzHc@2b^F}9eQw1#+5WyYZRbza zo)>GO40+CIEi_2B=S6(KM7HNeeE&qY=f&-FEAR8Rzi&1BIljNP_rFp5{nqyPtvp{u zXHC1*LOf?gr^!5TM5o9+cSIXx-WNoxhOgwgn!IXvrQf$cIGG#qA9?un(f6lMnTh@X z?Bfr<7xH>prWf%plw95Ng_Sj7sjF!ih`dkZx6uHr&HE;)7;G7|-6~iC0+OntK5k z;_Z-cwx(dWZ)$noCumPXf1CCORK6;eFblXoN4pg6^RP=>CSiYt_CeTXXY+A2VE-#; zM}}X49VQ}u{kO*IMcxJdnzfs^>pMlY^?WD%WW0GuOH8m``D&VJS83-YE@@Y3%LXoK zR~e@ZxW0i4X5YK8{p&>namfr_~acIgY5 z0|#lBF?RxX3=_}C^)T#5p-Eh)V3#@6!1W>6VaywD5`T~^eVK%NVI#xU7*qc^tf;4y z$ruE^TJkHyav1tN6#w@2TW|Rc%Y0o&Y^jHo@vYS38e}eYYTyzR%>NkpdiYEJx5NHJ zWQcy)k%D~}7AGmEn5$^_Veg?m3Hyz(zYp5Lbt~-)un)j~CsY!?2ll&RO~QT>c9~}l z*iXZL0`>*iX~GF-L)KiU#AVOD0rxcQPa!Uhn@=tU)86;M164Bpd@ni(cC!{g2zwIl zVp6c*5A|`KqI(kd57B)P_7B63gm*|<&%k~kR7?(bn24+k=Tw*njF;z)1;U6E(%I1G zH7xXS+xsBH2mPf_WRVyDhc@w-F*8g5)F%EC|4A&o68{(I582Q*vM#U52jUFO*)T=BaCDv;{e8f4v$s5 zZ1%p#9=q?U?BfrA5^2Mz6$W5G! zd-&*+kAC?W@Xn6p&Xv8&#N=2$S1Am6rQDErc6g*PmK!a!EhtAqa!zzI&KGkNE_tWf zVj)-Z5cSLmQmRbk@`bFaQFbEte70OGOFat{UVeOZbbKspYEQc@2B9=jD2$dWtb=nL z9`f)Hg+}|hRw)<9Cn}z)f7{JazEbsyxv`;K_^(gVXR?KlX0%N106%$4-9u zv>i&1JaS+9;6ZOUhK&D0VPYKl#1RACzEzHHWJs4GTZtsunmiBUnq>9jUAF;5(j$Q3G_=Gd7ZD|b)`ma>&!E(pMn2{YJfug? z6)@Z;CnhjJv!&soY~|eWP%O|7uGc0@LzpJ)HMSv|4+$OiP5a!Rekgn2qfa5~FKs>p zs>2lzox5Rl!flJe+4gY*qC9zK6rs;fjE`oS|Hff(*!BUkIPAwT9uAr=86Il)?uHR$ zhTB2E?(HtHB_@W)&YhV&o1G|>3lrxH7@KBI>U4YIAVxtuwStK(r&fUk8zN-nC+%{trI%-^M; z%PWf&`uesLVrh3a*|caSSAJHKck3T8OZ%aNIyng}4J^t~9!l&iqan0TUrN zk}c(A+Ii=?_K}7EJcFTw<+1}Wg zqYZV~mpYrAj$>+|N|(z={9P`_j;U#y0o~`Bwi8Q1Y|p}$t;nA5S=+O4g@gT!-`Rg> z+!hYLmt-kv9`+0HI)VgjJGk&jV5{)(V)!fATQ<&b$;R{(cM7oGHS8dTtLzKTwXf|e zyMS}$&_`HV^_}Yg!kT>x9bp!Gu%w}+Uli151P1_o0p zUnrNe=SQ)==Z4O2aW`~HFt__K!GOQHqwDNI>Bm0!z{$rS&wlt3GwZk+p~K2g$DhH5 zlph}}SN!wi7-EO)&Sd-s;1|4gkZN&l86H1h$ou$2Z`FSZ?w8&M*-eZ$7_Qe{hr3ZC zcPE&oOaMDu-t1ha^-!NP1=AwgN$h&DTajJ6S767EXCfeS`))_ZCA^N{%AU!UWix2| z$>?-`xUt#T5wiFN8gPq#*ff;uhRfarY~BT%-49%DcsxHbTq#_^_+U6!vNtn8o_y@# z(h9vJ^aAQM;|}w9l^~{*&7+o7skr+Y)78e z`f@6S8RAvJ!^dS@cZcjb^b=70GiCsvhj1Wwd6K z_IzsmKY&kpo+Ej`V-n{{hQyD|eN`=6Qnf0C;aD?8&nU$NRw< zu*81|{@pmN7wJDN{7RQsB}0s9;8WsP;U8&rd9&m%Ncb;xc}?2f@h~?KpAV z2bMl<=eyozz7KHR4Nfq=q$4JYOZ;8GX2`BzUB3xSzn17fh5WlCJG=%NV$3`~CB2u$ ze>&`~kpEHm(_wFw{2k$AVQ-xbu?BG^{(r)MPcm%&MuM=92Q=LehP@d5Zv%%tPQ~WcWkk|617VArA>-5ciVn;A_7X_WS_v z2FJ**ekh_z?^6gLUI}|C^51~pg+W_Y;Tz;Lc={CG+vQCwo(=E;_%EpVi{v@Pzp4lG zPVox)>+tVBfW|;ON&UYKzPcCVPqFl)^S=uIN%Ecu+T*4!Z%}cO+zWtYHO1=z-UI&#+EvQ?8p1~~>0)GgSlo@qkCXR+uc=~w z1$YlQN%qD6W0>~=-UCjPZx{bYmzN3f9`GRfl=y$V%PR(W54c1=1OGi!=>GtBgB#=t z_+R&8mp2vQz2Ir`Z^A!1jdeG``@wVMKZSo7i`g97LE2+YcoyxCJxDkK4W}`m$R8Cx zjrjw0>r)u(lk8dYJ&G7{|1!9MMF7dR`AM*>W6u9BuundYFK70@Y`?D)e`nILNIBd( zRwTQ1tQufh#~NUX{|M6Seg)5!>F@TZCK+OkTi4wFv;Ib4dT{ zuXgr}kAe3tboPr+O8$#>zmV{s1$TYj^U{p}HSl%FEEC|X!Gq*~6aUw+zXtefa0x8s zbNdg5Vw+|E!O$>_VjF|5HthDF7Ffz7{S!v}%e}=Zh86dR!5_evGp^r+?*{iEOgrE8 z?fpmEQQAZHqwW1?d;i(qf9!ma{pju7e`I|MV||h{QE>nHSMb?bXB`vHfMp$%bx!zh zuutCJf3Tmujr)(Ze;DmAXV+8c12NJsbHd3^zX{(1-rj#Y`_1 z|M|b!e`I|MbA6I$IXG5%8E69fQJj^<%#lAwUL}8n9K$`NgzuJ{ZkQ5S-VdsfTjZC? zH)HL5JMxjW`R&NZRCHj_5HiOOkCUDIAl$DFtPg9PXOA;HgPVI(v8U+XLl2+23cWTk?-p6k-!tx= zdEwH3)VO!Xj|-3Fkxr+7UHAiNpKI)EjtC(=WKE1J@#LN1Mu6r0*)+=`{!;fOE-^0r zltshhKObQ8Zm$G{5s~k)dN^-fdh={A$7u-+BP`_!rYGf*XH{Zc_@tpu_@DOjqwP; zEY@Dd?!LqMCzO9maYk`baaHk@;#tK_#Vy5)ikB6yDqdF{;ePAt*Q+?DIH5SDIHS0z zxT<(c@vP#e;+En?#mkCU6}wv~sjuu$^1B@|j(x>(#Yx3!#lihm(l06hhT>_(bBgB` zFDPD8yrOtbvH4OiP+$Ic9i93|q%}J25m%g4oK`%jxTLtDcv|tC;#Pp={$Ww^vf@?6 z>xv`1RhIsi^m-M?6ekp?6lW9{6;~BcDV|l_RNPX$sCZfNs^WFU5#CR?>#sPbSiZX# zkmb+)})#cvkmb z+)})#cv=;;P~)#j}c=id%{o6)!7ZRlKe^!h>zQ z{}sm+Clsd?XA~C|Hv%l@ooU5$isuzCC|**$qL{y5H1k#RGe6XZNPUHS_TdA@v9CC; zIH@?Tcu;XkaYOO6;yK0hiWd|wDPB>$rr15waP{qxO*vS9#fbpljBqK%8O24#RmD?^ zXB9UUw-hfbURJ!ScwKR%$5hw!x73IK{Z*S|%0Hnvr8uLwsJNsPcfRX+;^;aBIoKT!noKajVTO!0$?Pb(e?uvkB)_(jE^Q~ZkJFDZU4z%pOI ztN6ba?~p&30^`Q_0mZi{zT>VF_a^VV|L%M4d|zV2@18dQ$;Xk2!pJ4R1m8Sp@Mk9S z^Y!45clbM#O;g(Mq5Ub)ripDDGMJRk?J{X?5wudMRy@i4$o;1uIwH{dsjmCO z1ojs#!F;7)=6Cg57Tfp+qnP}+j??iD{zl#XjREh-$OwMDhTjBF;4dSze_Z4K=)e*D zYOInw;~gp2MvbyQp8HMCsr&Cgo_(JO8L-l434skFuu%jydOUkf0uNZ}vx2~MwTi%ok7oyLU?Y8&j%WMD z@tBnXEB#jbti-J#**+WJDw6H9Q|&E%{t(ZfyEaMTTV?CmuRQs0`xC^MBXzRvLd!E&<3#!UAW{_%v?f8x-x5z)v{0A9O@|X2r=f7`@{9C+lcI99)?f8!OY?1%;CiRy`PdfiE!wpGX z(ti!^+iz6=zee26+J9k_`b#*S|Kt|=m);2vm^Z5ba|p9p{{BZzbn_jk*rfgC=&kdA zFWfe(f8yQnfO(_(%bvJd{%PhvD2c#G{&F$gtumAu6 literal 0 HcmV?d00001 diff --git a/internal/ebpf/net.go b/internal/ebpf/net.go new file mode 100644 index 000000000..57034c6f6 --- /dev/null +++ b/internal/ebpf/net.go @@ -0,0 +1,85 @@ +//go:build linux + +/* + * Copyright 2026 by Mostafa Moradian + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ebpf + +import ( + "encoding/binary" + "net" + + "github.com/rabbitstack/fibratus/pkg/event" + "github.com/rabbitstack/fibratus/pkg/event/params" + "golang.org/x/sys/unix" +) + +func appendSockParams(evt *event.Event, r rawEvent) { + evt.Params.Append(params.FD, params.Int64, int64(r.Arg0)) + if r.Type == uint32(event.Accept) && r.Retval >= 0 { + evt.Params.Append(params.NewFD, params.Int64, r.Retval) + } + if r.Flags != 0 { + evt.Params.Append(params.SockFlags, params.Uint64, r.Flags) + } + + family, ip, port, unixPath := parseSockaddr(r.Filename2[:]) + evt.Params.Append(params.SockFamily, params.Uint16, family) + if unixPath != "" { + evt.Params.Append(params.SockPath, params.Path, unixPath) + return + } + if ip == nil { + return + } + ipParam := params.IPv4 + if ip.To4() == nil { + ipParam = params.IPv6 + } + if r.Type == uint32(event.Connect) { + evt.Params.Append(params.NetDIP, ipParam, ip) + evt.Params.Append(params.NetDport, params.Port, port) + return + } + evt.Params.Append(params.NetSIP, ipParam, ip) + evt.Params.Append(params.NetSport, params.Port, port) +} + +func parseSockaddr(b []byte) (family uint16, ip net.IP, port uint16, unixPath string) { + if len(b) < 2 { + return 0, nil, 0, "" + } + family = binary.LittleEndian.Uint16(b[0:2]) + switch family { + case unix.AF_INET: + if len(b) >= 8 { + port = binary.BigEndian.Uint16(b[2:4]) + ip = net.IPv4(b[4], b[5], b[6], b[7]).To4() + } + case unix.AF_INET6: + if len(b) >= 24 { + port = binary.BigEndian.Uint16(b[2:4]) + ip = net.IP(append([]byte(nil), b[8:24]...)) + } + case unix.AF_UNIX: + if len(b) > 2 { + unixPath = cString(b[2:]) + } + } + return family, ip, port, unixPath +} diff --git a/internal/ebpf/net_bpfeb.go b/internal/ebpf/net_bpfeb.go new file mode 100644 index 000000000..28edfd4ca --- /dev/null +++ b/internal/ebpf/net_bpfeb.go @@ -0,0 +1,174 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build (mips || mips64 || ppc64 || s390x) && linux + +package ebpf + +import ( + "bytes" + _ "embed" + "fmt" + "io" + "structs" + + "github.com/cilium/ebpf" +) + +type netScratchValue struct { + _ structs.HostLayout + Arg0 uint64 + Arg1 uint64 + Arg2 uint64 + Arg3 uint64 + Flags uint64 + Truncated uint32 + Pad uint32 + Filename [256]uint8 + Filename2 [256]uint8 +} + +// loadNet returns the embedded CollectionSpec for net. +func loadNet() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_NetBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load net: %w", err) + } + + return spec, err +} + +// loadNetObjects loads net and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *netObjects +// *netPrograms +// *netMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadNetObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadNet() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// netSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type netSpecs struct { + netProgramSpecs + netMapSpecs + netVariableSpecs +} + +// netProgramSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type netProgramSpecs struct { + HandleSysEnterAccept *ebpf.ProgramSpec `ebpf:"handle_sys_enter_accept"` + HandleSysEnterAccept4 *ebpf.ProgramSpec `ebpf:"handle_sys_enter_accept4"` + HandleSysEnterConnect *ebpf.ProgramSpec `ebpf:"handle_sys_enter_connect"` + HandleSysExitAccept *ebpf.ProgramSpec `ebpf:"handle_sys_exit_accept"` + HandleSysExitAccept4 *ebpf.ProgramSpec `ebpf:"handle_sys_exit_accept4"` + HandleSysExitConnect *ebpf.ProgramSpec `ebpf:"handle_sys_exit_connect"` +} + +// netMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type netMapSpecs struct { + DropCount *ebpf.MapSpec `ebpf:"drop_count"` + Enabled *ebpf.MapSpec `ebpf:"enabled"` + Events *ebpf.MapSpec `ebpf:"events"` + Scratch *ebpf.MapSpec `ebpf:"scratch"` + ScratchHeap *ebpf.MapSpec `ebpf:"scratch_heap"` +} + +// netVariableSpecs contains global variables before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type netVariableSpecs struct { +} + +// netObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadNetObjects or ebpf.CollectionSpec.LoadAndAssign. +type netObjects struct { + netPrograms + netMaps + netVariables +} + +func (o *netObjects) Close() error { + return _NetClose( + &o.netPrograms, + &o.netMaps, + ) +} + +// netMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadNetObjects or ebpf.CollectionSpec.LoadAndAssign. +type netMaps struct { + DropCount *ebpf.Map `ebpf:"drop_count"` + Enabled *ebpf.Map `ebpf:"enabled"` + Events *ebpf.Map `ebpf:"events"` + Scratch *ebpf.Map `ebpf:"scratch"` + ScratchHeap *ebpf.Map `ebpf:"scratch_heap"` +} + +func (m *netMaps) Close() error { + return _NetClose( + m.DropCount, + m.Enabled, + m.Events, + m.Scratch, + m.ScratchHeap, + ) +} + +// netVariables contains all global variables after they have been loaded into the kernel. +// +// It can be passed to loadNetObjects or ebpf.CollectionSpec.LoadAndAssign. +type netVariables struct { +} + +// netPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadNetObjects or ebpf.CollectionSpec.LoadAndAssign. +type netPrograms struct { + HandleSysEnterAccept *ebpf.Program `ebpf:"handle_sys_enter_accept"` + HandleSysEnterAccept4 *ebpf.Program `ebpf:"handle_sys_enter_accept4"` + HandleSysEnterConnect *ebpf.Program `ebpf:"handle_sys_enter_connect"` + HandleSysExitAccept *ebpf.Program `ebpf:"handle_sys_exit_accept"` + HandleSysExitAccept4 *ebpf.Program `ebpf:"handle_sys_exit_accept4"` + HandleSysExitConnect *ebpf.Program `ebpf:"handle_sys_exit_connect"` +} + +func (p *netPrograms) Close() error { + return _NetClose( + p.HandleSysEnterAccept, + p.HandleSysEnterAccept4, + p.HandleSysEnterConnect, + p.HandleSysExitAccept, + p.HandleSysExitAccept4, + p.HandleSysExitConnect, + ) +} + +func _NetClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed net_bpfeb.o +var _NetBytes []byte diff --git a/internal/ebpf/net_bpfeb.o b/internal/ebpf/net_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..7a8cd9f73bb7ad7d041302e4fabaf03f6c2b407c GIT binary patch literal 33648 zcmeI5eQadcdEU>R84iciYBiCi)iiaItJ;=k<<)AqyOJi7wH|4AWh!3Fv@ErBY-eVc z9PKdTk|UBU548?TB}zJN-G((BWRM0m^HFD<8UaxQ5z_=+7BSK(61YT>77XIH4B$3{ zq)iF5P5DPr^?A>E&diy2Nm*{3pe=Zz%jf*w^Zjw}d(XY(>aSnA{7fPdnf?)(|ABB| z=*J-NBO8`V{CTg5ZoXo}=FP0t(dnOiYhOY)A9VK7*qFE8dTT%D;++vcf82$l7g^Vc zF+VJ(SD5aetf>pXxhg-6neKdh<=(8=Z05y^>kG>NA+g-3C-T&onxop95uYK8Abn)} z1KlI{sJql1>Nd4Y-J)(%H>e%zI<-w*qqeB4)F!n-ty3%1De5G3f?A>$sRe4D8dG!B zEHy(FLI2G@b&uMk?oxNC+te;~i@HhOpmwP1)HZdE+M=#fo74uiPOVU%*57O*OU_V5P%rO4v%LSzMm^ehsXNqdYL~i2-K1_%JJfY*o4Q7AQCF!= zYJ*y*R;W|dN$Lc(L@iPa)I2q&=BQa}hAM*o^Zqky_Q*ZzE_H{xP3=;*sGHOcYKOW` zZBy5%E$S+@No`Q;)CzTqI!T?NmZ(K)ftshr)EqTS%}_fbJdn^;?FpHeDiNO`$u1Q%6xa?esAkX`Sw0FT`_k{iqE)Y zG1#_u_`YT8?z%KtmgDt3z8!35;pStmpgYH%-u!N-a{rU(1eTLwIj^jIx4VvSRL!KM zWI5SyyPU^eIk^AY{;{0Yw`fPox1-8-;C^mLlKJC1`TTQOKYTlVIV-QR9Sw6=(4UM? z_kYkHJ3nmCv2W3yl&{CPC+L@(*Wu^3!|v0#Uz)!w?O(B@f$Owt3S_r_tENb{DG*;G z+j_tgmQOhU2tQ%{2Fi=Yj`+N2HR}}PUJ*vTtq1WD2e zMj26Xmz*VUlXK)9a!lSO=gB>CfxJg9lK06a$F3cye}bH0{3JO`o+9VS6>?0jlk?<; zWBSjk^T#V$`q65F=@Tq3QDJ)4mtcK-zOOoejr@`fFIB)i4u8F6!ArJk6a+{ zl5IOzve6DX76osUZM(o-vTYZ5i<}V!Z<0lXHypcmfji_q#;=om?vSU*>*Pstn>;~YBbUf6a*@1BE|8m|@ANs+`zQJn z??>Ob<$1VjVkvj!b?4Xce4G{L{WSAu*w21S%JI*^*w6l;E!Xz?+kZX{_Q@ZUa&C_`Gl@A-p(JmL9SCP)G6vD)vc4Us6;MO3)DO{rsk+wYKAI;@#1sj znAs!usJql1>Nd4Y-J)(%H>e%zI<-w*qqeB4)F!n-ty3%1De5G3f?A>$sRe4D8dGyt zGj9FfNW15p8>3>i{f|ZcK8gPSFLHm`lltGR$WN^QFTM3mQFT4{^nQ=+l;;imBzvuH zPDnoZwX7(vEBpMj!sj|X-`VFX^*r`X-Um{u{|$eiSQ&TaRUdTidb1>@V?Y12dk(JN z=bl486pP&?rtfm>%C-CYq(s~kyXP2ro<;tH_VarZ^BuUq*bCd=Uyk_hC~@1K5ud$iBC!}7|?(LP%S z;%J|pb?^g4adC6;W_U6kI27kQ?Mpa+AD8UL|+QE%G*bjl4r{lXuDM zUFsHfle$6eP}iw#>Ke60U8Odu4QicQp-xdJsT0%^ zwMZ>c^VFD{vzjrE$J{;=-!1m6JsRGJtNrKE{@d>6;XjV{-?Ci#hkLJZ^qm{~)Lj`A z=ni$8+NEw$H>n%c4t1T{rmj(2)KzMe+Mw2{73vgqk~%>xQH#_9HBXJHIck=gp^6;s zzwIa-?Z2@fvg?cQ2ampU55BwG_q<2nxsSec%dO&Q|9$kGTh;;IzwC-)zq}?2-XXWh z+vHVpm)s<8ksIVqa-F=?Wr0ws^Ms8PW zQqWk^+K+B7lO#*w{L45;d^&_fD(zu~pO_FFFW?=W0~exBh~=ub1e1^rnUwmtrNgwfon z1pNxb73c=e81_}@uetD;gnyG`Cgbp141XWOzs>OzvF4x;-vb+(>rxxm zgrz(g=MqjCR~gGyoHDMmPPcIW9>?`Qgl%CQkN1KPS}$p_tNPv}HXLs^kG{S?V14gH z`mnyd6cF@Jn&JE8*P8TM*KOw+W~uuDoF$xk4V{E-3+JD(Zuu?4uat11CYo3uF zJkG@d&bfjQx-{{u%m_`eBqOeOkpS7i3uf zIn*=H`X9yZ=+mfE=3xTiSty$`dX3>2_C>>!LZ!LD zG~2dO_TF*Jm}Aaw`+bi2MM;0_oZSB382`)x@yLJ21B}N!9hCo$f64eCkoe$Q^kai6 zkEeJIT}Bf0^Y}41iV;bVgUz=-?1VGPSed^Pgzpc+?;nJZ--U8y+~oL(6Y1jU7sc7x zV|ISol*>;&|NK**D1ZFfAG}n4;S-aW%4M^>(x{nh)n>Uizq~kGTQap*5n3|W&z?bg z`FVYQY4+-TZ6=l?u0MKC%=ptz>FUA$T__%SX&&d86m=B2sn)g`mMczu4lx?Gzvjp~efX?CtQU%giA2hfh9)La}? zJYBCY`r^Ho>$PgbAnTPml(f89ovxK_kIIYH&y<%|mZYDxMKir{?b^b8+4i1c*9<~q zu~xg*SY{u*adyVwKQtQS<40wwzOcA#Z2$W} zOjqaTmL%X>)sLNic)qrL`by)a)6)i{9v@arehH&Cy&NCf&-g*K;-r~=*!AFHH@T?yEcf3ZKe#Xt z)9g!e{yvFE%k5a_Fa6aQ+?u-Z(dVAKbm4`QC(Rg^PyAYKaRF5okO@oRuuAqR`mNv*( zqeS$4Os1)^xNxObwynIrRI@F7=zPEYQOkR?4Ui~V#-k8Dl$5p@y!CauAQ?VWFrzf8&KlR)vko89nzO-v^eA4dA-EM32H4S8N#T)0+dD{fg_oB-5yD$Zk-x!IYW@l!FpH0?UJGf?A@EY8kf zy>k5}j3>tO)fyJPz3UAYQ|%2G%`B_gjjAkWdv{}Tw_HPm`=1-Yen~c$UCm1? z^V8**YI1ADO`?pc!+OIF^He-8sc%{CwV}mcvrE19(D~)rYqh22>a|9Beu=GlS!`vQ z_4y?`&q#)m!W1F_0w^68-hRqh+)u^>aFH@%FpIz-%gH8_m2&86vW=0#?1aqDup}%t z*zn{0`S`3Xa4GHj?2NPP5)o1M%M%4+xgxWa45KR$DSRES6lZqDv0Pu3E?w?|nCpkm zOQ1j5WILkE)uorEczSA76f_@DpLIVqrpEYBy1&3q_+UVD+OMeoX$8ism$#AnVT%${MDwaOmnjXQW zfiAsWJreJ0v0>aC?J!{aj2$}()FkvWLgi(7sxU6}GORGTpM}TIJYH~(L+mY8N|~qP z8lq0405=XkJqkE1J))TY9eAwa>szX^^F;pxcD~3hQdq_HcSHG;o^u`uYaM58Yg*8!Psj@Xo~E><7Ljyi9x&d#Su_A!k%6 zVESokGav5Y7SR~Fs^kVbgU649-H%V@@7m5o90TL+vSj*p`1v48 zo^f818>3BYr(Z1cKs`J#ax*$?T!Oemh6O3ys2u2U#V<;e<@v`w=*dDwi{uf;cjAly zvd8C<#61l$m0jxNvYZcm(7B&Q_ZJWu4tjX_eNEPVq9fnpdCn)t%Jd};51H%}IA-S# zd0uxTdanN@_2;*m25a)HJa2|;elUFpG&796{OpBG&wc!oIgP7r$;{18*XEbxWe?xq z#%`l%W}rCl`9)(+U{4z1J%a2_?K^tE$2^NI`cJ^_`7!LT|7*aPj5#LnBz^pcuwyO- zjCVeF{9(W!Mi}o7Y#sJ}Bf@w`5d9PTTELjtF;clB5B^_xYk|K!ZO9h4ME-zDEMprk z-(hXMFt*0>`>Rr3;-khi(%?Gdubbpogqw~La>pv;-!REd^xdqJf7K*^L(*@M|CvdC zErD`(!BYMo8S@6V_=#S?Xis9#G5(1J(~|i8fDtcm3nYIsHs*8hfy!72m+=}0^@-i` z8^&D3yPRZ!{AIi{#yBTS7MYaS`dGJozV0;xg7jB>j={Hca9d!AW2Lzcz^u-svYd z880mJxJCY-CiMZCm#*XVag!=$!8_#lo76efpWG#*|64Ned*mx7v5k33vAyZ*Ch*D*I3mEy+dGezsbuj~;AYZ}MpgrkHGTPt7 z_l)#Zz>=T+8~ag{{H(;+880mH4RYHgS0%m~u*7pb#(u>l-;nqgHh{9_pvpskMw51SkLJ#$G6>Kl3&1j%Xog?B-`NIx{UuBlbRIn zk+)3h1u&*~aQ~8c@o9V)EBCeAvnHB+5w?s=XIb9GX9Je+ECt61xuXcieW8C}nE7#HuK65e06TzXeHey%aU_g5XV_g5UJg!fn5h?nyJzA@j#xF&YU zU&Sp_c$fTjW5i#0e|G!7H>QW{#QHDZ*R4N66QqCEzo5O=e@TB?Uoz+7`~IZF@?|_R z&h}ZMib8NmyN*3zqB_RVkF(|bz*!fMdZH}aW&H`#Tb6OkGyf-Xs}`1VM|}S%IUak| zL^0;jKNlRkW}^3EJ(>#h3(I%FdcZ)_2w38q?ESvkA;01LzV%Pi-!D7AFMkIp{Y%pC%Qve&ClSu!A%b?{cj}w2Yde;wH)`$ll~&!`(OF}dCT;_(H@!p7fZp$ z`~33z_%=QLZz3ks|0W7#`rkx}O#hqm_0#{Rwir+Uo9dG3e^c9zz5h+^lIed_Y=4^m zH?_}r`ri?@*Zbd*tcs7x^uHr{70>>7|Lgrxn*Mi${qz2JWPiO3>Hj$@IUYQ)K$z(MrIQzfPwA9c=_G@l7)Q@91j465k@z|BkK&Eb(nJ{qN{{z?iJj z4w?RUbR%HgKSnpn^uME90mE;Nb{%{FJLZ}G_x5eZ)BoPSN2dQhmI2HCQ||w`8Qf7a z{I>&~{f-|p(dsm8OlMjAaW;q-f1C?g{BhASLhdMmF|YnUXZ?V%_s4a{^FHVA`+a}h zV!Zdq99LhwS!cZW#~inW_s3nvdw;wOM!)<1wMX{;S;k4?>7SFR$nw{ne@;sO(f%?)&3{<=d$ANgaqA3pNOZavuj@&9A~SoY82XH!1`g-=N}p+)%oEhvuE7JdlB@5mv~ z!ory+EE;)MwOl8!K|hH2e?#7JJchF6uzNy;M^*trJtJK*>q(j=tPF)>|e-4AUOTTy|{uBY)lk47!we@=gyV(frYXf_-Ft8_& z2llCf-4-q{%hZwBg2CH4kCG(uw*z}qEbd6mL4Ep;x1ycDIk3w+7k@;56CtLLFz5b= z76*2_ju?^nlYu=Q(+H7$r7!2Ut${u9V*`6S7$4hTdDvG+;@4pC_R1hK`pUqbECu#| zHL%NGe{f*3;1Bc>y$lQOQEm_${lkG>_Wb@x{KtVkYIrNgU#=lv&T3%)<-i{F*Zv(l z)5|lrKO($G@Z}^*-iq;jePFlO7o(E6ZhZRD{2+be#=w4iH?aTAz%F}_R)&kyWF_xE)U}woDm~e zp=Sr2Y$7b*ynK8K;V^wm#czNg#mV$m@Ez52x-gvnw(VgSA2(F~8aQkZ`g2Qrg7(R~ zzA%3z`NQ~4aL~R)1{}0+RO%1X-@Y@|A=5I9a=%FC&cQ*5^+ld{4kq-+cjp z7UA~=EcMBv@#U>6-cY=ycw6zV;=N(E>ocfN-Zh8yN3r69;*#P?#TCU3#jA?f6t64Z zP`sshTk)>qy(l~J5ioL5{_JfV0>ab0m! zaZ7PqaYyl{;;!Ny#XZIQ!)*6+!Fn9YsrbC&qT&g~Q;O?~n~GbC+lo7iHx+jk?%VV3TO{mEn%$BGMzONu8IR}?oCx4^;kKt|>}p}L1;q`GWuehjqLh+R1y5gqdmg2VJj^a(lUBx?!dy4mm z`Hqa@oZ`IVqT&g~Q;O?~n~GbC+lo7iHx+jk?Ah$|%k$&MPh|o=`lcxURUV zxTUzQxTAPeaaZw<;-2FDVSZOeaZYhwaZ&Mv;wi;-#ZAR6#cjnM#hZ$|igy(E6z>o7 z-5JF>#d*a=#S@CB6xS6u6}J?(6?YVGD())YQQT9!Kg{=J6z3G@6&DpxD4tSWSKL(G zQruSDQM{?Rt9VCoPx1aR%ilVM_umsa#qusVc>i(YqGEY}9LCQmURL~u;-3Wv&zmQ{ zqWCuy|Bm8sDE?2we6PGG4*bi#cPoCcV(D*~{-R>(uZ@4=gHK<$cTs~k(?|9tx)?Bjxd;vpO9wKPFgk@<{nnp>s~oIyvJ6 zIc?-w>NxdW`4P!;#!11+Bjq#JdX|dBkK8iQZVt~KJXzr%CEha7Z<{li=5x}r@v;>( z$ts#e^Emaaq(Zb+M3cwKPS2IkxNce*cT{kKp|MsBjaBftBnDeW@2wW7sH@=Oox)zg zh4P&_q6;VopUMw9Ui*TxCQqnX`{9N*344}r_u)|rAqdNT!yo?vfp3vtz8eo6a$ohw zA0Xhr)0Vu^X|+z4;gUZ1e)|0Kfc}qg9#VgD4{i(M>DGxpI=}a=VA4WKa!(>Q|cFAB8Sf}^*@aBkoxbMl*IVGDe+t3 z;q!~_{WuS)|4N>j8c?an?wi>Igr5egqRgfFHix62if8#gBgh zMycO_xA*y_e(_m{)PLW$E9~w1Z@<|cR)5#!m*4fa_51JsLH$wi{kp$CneCw-13n+I z-(GNp-}&paU*Amkke~lGpONb8m#lwHeyDij>6Q!J^G{WLaQ#LfN8BO(pDr?A1uEk& z@Al>J^<(_)oE%dB#R;3*+&km6|1+rHuIa<-=lq}8Lr$sxT`VD}KYHK7TbJ#)tuk^T mud)B;*uZ8(L3{20pWc4RRcU~q+;Fy$O{nA}(_Gi}YdJ?>0A?ItA4HE|q`GajpF#);yOiR|$>GMP9X$KF*!g4Cnd zj5_WQr9UQ8kU`5_xneKC$28B={RppH{VsWGad_G|{# z7q_Wh>K3&_-K1_%*Qssl8ns1Tr8cPzYMol6mZ>Fbk(#4ssFTz*HAPKQ6Vy00ppH{V zsWGad_SkRR)Gl?4+M#YzH>m5>Hg%2KqOMY#)CRRqtx?O=617OpQ8Uy@YMPp&CaDQ( zoElKasiV{w)rzTng5hK2#lXeiFH}Xgf_p;00o-akdY(tItNowUz)_dHwYf#R% zy>9>Y*Rj29jK7YbjkpUjydG@tvmQu~95(MoFQDE>T!r22bbcF-?8`V_cHL*&`6GxJ zT<=G1;{4~ny?*oS&eIF1)$1kOu&=lXNqP9Iaf-n0Ety}nKDQn#ob>LzuAx=w9V*QhP(Dz!;%Q0vqhwM;Eh zi_{!7L!G3isVQobnxMw10d<@@N{vwswP(i@?WcCBThtD9le$4&r?#nU)E0G>+N3t9 zb!v@Trk1EhYL1$rPEym<6g5drP~+5qI!+y>#;8{8{5}kCb(rP67}$vXwKrSsU$0!B z{Plc8j4_<>?KrB}T)v+~cmU2{a|=a&_zsXUpTrU1$Pc^vgx94a!e#xE8cKd%-wMAk zN9rLhys?B2xZB_8^v36%%K9ev0g{i@MDqCrj>_lVby^*pvR6fV%Bhak$SJGUu{t?TZjdL* zO>&03O3sm6ETq3v0W%4??M&2OT$(!T`xkGM}x5%sHF1bbCCa;lue#t{xa)#=Cl8e95jJ7+BSC8sg$+Mj(V5^ufWM_9P5!%bK9OG#>$DAF; z{ABt`#?y|DrO7>84%$QBCObQg{van9zeSFdJ7iZc^f%en3*$j{^}=|OUA-!iHrdsy z5?Ld=dQ~DVva44mvPyRKszjP(SFcK>L3Z`3MCxQ$uS%pwcJ-=6%4AosN~A;?lbj|u$SHE2oFv!C33A!$w|k%H?UTK)#*CKr?gbpX?svxmgks$p zA9s4^s8v}{WAOdU_p2YZ`S|MBa&#Dd1`v&KG z!_B8^!_A{=qv!guu}$q#x2PTJCUt|lPHj`ys4eO$wMlJI-FQ|TZXBzPGQ&&MA~i?N zP$#KrYKoeqCa7_0Kpm%!Qe#v@uY^*cBO|xNos-`rv}tLzuAx=w9V*QhP(Dz!;%Q0vqhwM;Ehi_{!7L!G3isVQobnxMw10d<@@N{vyi z*!zRS@ZM}6EobBp_R)6TKG;VO=8Zh3IM_$?`W#!e9aD+qtX9WbETq3v0W%4?? zM&2OT$(!T`xkGM}x5%sHF1bbCCa;lu+g3@MBM(m`f=V*_xBaA@4e1oU;VVZ{&T!<%yD0x<8_eZzBK3&_-K1_%*Qssl8ns1Tr8cPzYMol6mZ>Fbk(#4ssFTz*HAPKQ z6Vy00ppH{VsWGady7jY~bL(m~=hoY5Zj1fdp>9$)sOwa&yE(4MIj+;WRmL}|4QicQ zqn4>9YLS|wW~h_YG&My{QWMlTHK2|=t&tm}mMfok^R7A?bMdbD{(HuQ{q@2AS|-N9 zdupze2k)ufI&rYScKz^TU^V=nT2|77{q@0nYWtj)-xCl!da%Ei_u{;dIoMy@`_6;+ z)IE3qeej-|^MU)Hu{N3eps_VF_d{bXa>i2M7@f1(}Z-iRdk+0N=E-K%xqT7*%ZIY;{G;+e_8V0xusHP5p#UmvKKEieO zV}{@z?ecjeJo+Yl(CtWLzaZfvqVjFSPvO9MhvW@h9e(#F)|eloKLz~^{Wa)M(Z3G; z8TzGiFTpQ;nS%dI^ylDTgFnDgga22(9|e95ez=&7^>13QiG3gRcbwn;dcp0|ZGdgV zTi})XW{{V-aKE}Y&2H{UKc{d=ze-=$a7e$(JYC1}$2j1Q-GvWkB^48Q`8l$TWeVYios3ZHZ2J@NqMcGF>yY#|DQ^j$Q_xRB@o(geih!O}|C8`P2$hU~4*rMXO~L;~_~lxx!T&4ppND@Pe!6JV`%pC3DG53Ho>2HC z{9nbnaQ=GoIoSSw1QBSG9p}$ufZ(@l@qdRug>Z4d2>)Zy0LPaZo`U}?49~&eh94Op zlDuxf|0q=4*WibX$-3~{D$NBOWz1$MjRYZ|9b^6{Sm+Tp@;K9n<7G^~iHlF-pV%W_ z=FHo%uu6P-k9ax%_Zj~KjEC$_E!(g0jTvd$wfGXg%0ukA{ptG??)zGgN7!oOc4 z;Q}1@hzBmf@ec981vri)p9u4LzXZZbc`^^++~>^vvdLy2efsG~Kb-y0lOMU5edfcH z7qeNjTqzaI+*CPRm|tF;DJ+@7HTagy%GonWFP|&(OEXvJ3)6vQvGUGy5{%D&@a)3; z)j&SXbA^hzHZ{9aFw=_*rEGp-1!pYf7pIo<#jJ~%TD+Pt_?VE7GxBlPT$!D^x@49Y zSLX9m%Y|uEnwmCOW@ZcXQ*(vB2lYrw$;m;%`Qp@~&)#dcSePmqoO*c{IV~?vA z?eB+K$}g8qacX{gwlF9c`OVK4^2=tqbU!MSpPHRr5|67@KQ@2=d|~U08T-rIanq7Utsj zu=7p@_ek%Ye8?PGEG(}q&IdTQ(b0vu1CGn`a?d$l(fB%e|Qx`t))KeEP zJah7-IfCgEe5$axfT9vO2~%LdLj5d};X}!Cl9X(V!D+}Vo4vd;GrK%9pPehrEftpI z2tE}gP6bOdpDHX|iQg;9hkGacM}a*)-;$4-SZKJzhOQOwxjyswU}g`dS|PM!>^=7_6Wf1(G^ zKN39i^s`T0$UgDprHfBJ`u>Y&P!Vae)Is_hIilr9WSB~e3zrL7Tg#QDg010w=ll7e zlBA~sIZtYX>odT`$j-i6z&u`AT*S=JmS(22%U5TnSw`9X&TobX8{KUV}XoL z1-7#vn|vbs=u;oYssC~BORGGyY>?@WX^*h}yxukI!;!u^ODmV>aL$#*g}E$iv1@X1 z08rMcAdXq)MrUT)55>-@Y3H#Wfdac^ac2JN<&`VwPxR%r0w%p(^#+rva1wK?pIgD6 zEVJ45s!V3Px-q+5*U(`7a~;^v$)06r^HOC#pS@C$r4frn7DI>mh6VFfFd?aTP4~i% z$zHHiy>Q?8<(av{((=??DLcQ!+B_#=SsC^DB|FYYhMvL@A^|+e9U)wPvY6bD1Osr9 z(qjk~L4Zsrn@ncPzOzYEt;|ega z4i;r9gBlyDtSPv;Jzc;RF*TblP096Vt}ZTMp`FEI10!T3@{2H3^GmqC%N2u>TwKmx zURYR`F|=07STmP+@Lg`yb|gSe<(j zI{LZl(x1f16Ig>}Fx+VDEYYPp6-b+HNe|%CK$C7(j>P*?tRIV`?FI~=v3)0=g7}_; zFS{&v6~_6VLns2=XX3##4<=mY5WA~L$@5fDK-6hu;QGO*M+W<)M-z7d6KHY*8 zu2=RnxMCNj%5wkXZuDfLqDFEH;~Q~C0H+7%k;L5%F_pbQCS*GAd82a=v+hqIG7R+2 z?)N2G^NEK1Gxu{oIcBEMac7swK7oC9ZlC*g*Q4k9cT)d$vuQ9V&&vH~c+L-oZ;xt* zBQHI9;o?&tx@b=0c4f)T&g2X8OY*!&p5F$tQ-qu5@i-n9ws1U*jiu~OW1(t7R-BOC$XAHs*gGZL5MxIxAz8#za%lRKb{BX&bBI8$tzcggZWQcV&e9HMR zAU@U}GOOfYk@UYdWS>P!{BMAxuMC+jsO0~b&|@zc(+%+mc$<6}PXvzD@muE*kAUS# zft(*e-}-5^i=2fH<3WyuOZ*Gay`{}Sa7#}1hq8DiZUKIQyjJY*SeM9mgC zDg4=}>5?x9pNpCv8R8tymGeJ{_@k+)87Kd+q<=hW;^dzIM=wQ=ikfzakAv6A|A_dJhYy(z@-aMw98DfF9r8QCN6#HHTjYnqx2{LcHu*C6_E%7U z@{fX#Y@(CUFH)bMmH6L{8g!B6uSopYqh^%+o5CHmkNl_L($~nZAbxCQ$TSo;LwpC~*VXwOLp_P+;w+c@T*;vmGgB0fc)MfxLe#&x2&NdBzkAE5r^Z-7Vc9x^S((oa&p#2-cc zW{4$yhdhD@z$5V?v#q!n;-iR5l=O@Us;5U?UeTDcaI7R+p ziGO~`q(giZJV|a!d~L{NLVOgQBY#=qUl=mQ5FZ7X$gd#&XdUAp;$d)&{B^{?@zX=5 z9^w&jgZ$TsA8QPmW{7VGuaa+rt%-gXjDD5=cv`rL{)Y;GPIwa66M0?u8C*Y5zdl8= zK8elp&srsX6wiR4os3v}=lR`WS;suT1)Lyrm9XoWly8u^dBY78!I%U==RGJSjXd&1us z*sK2ozOC!*la%M}h2gp)EcODIo~@5B50{Q*Z!c0{-(OMmm)r|vQAcqS{&sMpIOu2L zyTHDmZMmcFowB62<$~ip{|AwN7>jX|EcuE{;gIz9`UoO@yFZ8YNAHf99OH%W1Q$bW zz@-pNyo`(F_Zg%g!D3$v@hxB(7m5D@;t!pQ7#RoQ{|7#qh?w;d-w)m-d%NBt5aT`t0rNDB0UrZ*RPP_4dZw*ErJ)i+xRy zefzvU^7eI-@!r1HRQfvE+t;Sz)ewt)-B9OmlD&Q1Qrsnb`x@hV?CooyI38lLuW7Qk zuSLb)et7%p*MDzc*O=aOJH%pNJ0TYPx<&T(wWnC#jLH0yc(JdeWN%*+WN%-SWN%+n zAr||ZCVTrj8Dg=o8M3#pxe$weEt0)`ErnR@YnklrYc0fLU*&zUw8z`mMu^3}Hp$+; zu7+6bYm4mdYYY7%`FZ=g2KylF?dvAl+t)5w)+<@hqs55b^ZD;nNcaz7&zG+a)_vh; z!J}9ZeEhq?;~{E^zEOosnjwRZRc_sud)V%4!%;uV z@Nzg1{#k~%RQT6yJrCRGCE=+5%J8JsLChkR}oBu8Lxp+A04;bDK2hu;(|3>v7@;RISh}~xoLXG(a zhWEmO@c)Ia&k<9y@q@@eVmNNicDP?;_?ilreKdB2M((G>?yC%!eQ?t+fw;|j^VOT&~C_nJ9%g5FWdCD?wW5uYwL6Cu6g@A4Byz9jin*`jm4c2 z(>DEWyZZm97_R&Of7|-pwyXbtkKwxiUt+lK|1IXP`~NEp*ZuGQ4(e_8`D?fZ-(vo{ z|Cbo9`~Ncx*ZnX3bsSf`cWd-Mg!;Szckv}g1k_Q6`*q2OzlGrmmHsEd$3yGMHm}Pe zre|`yUl9KbIHcTBMg-LNL63*7(@EA-e$Q|`bba+W?L<_9#7VH!Z=Bb!uuaeY z_MAevIAO_u6^A%ssh_t)d!?8B{;lhmX8m!CVx)b~gjm{_3$fH^HpF(kLu~sm#PYrP zQ#iy){?bMX6DKT5FA2a2%kMruDgY-ezoD5GfD^t8$MXVk!f(Uj$6HwPU&SHLv!7p{ z*KO<|epB(5;%&vY5QO>sj_} zzP<8XXh-`MCqpdbomQMtTvS|ETvyyw+)~_DyrHx*Z3ek9Iw zQgK>wMzLR){rP1TUsv2z+)~_DyrHR9seESKL(GQruR&p}3>C ztGK6F-a~}jGp<P6wB}0#QFR-6n7MN755a!_zcG9H?BCYIH@?TIHS0z zxU9IYxT(0MxUG0YaYu1iaZhoK_uKvUD~>BpDo!iTC@v~4E3PYUDsCxmE8bAtQQTGB zQyk;{e82sQx!F-TZ-F?HxzdicNO;($MEbid_9dTjw?R9seESKL(G zQruR&p}3>CtGK5)c3ibzaa?gyaawUkaZzzuab0m!aZ7Pq@rL4#;;!PJV*AHo!sGwO zo&6D4oK&1voKajA(pM&tBSv= z_z=I8E$x-`cPPGF@xvjOtS%}3sNz}0&ny14;-3$(*q{HY_!Y%pSNy8tZz_K1J&#>@ z{NfX-N6$a}AvJ`Gb1?&M$mg=(lWppBGLr`0@I# zqWzz*koxUewokCDa38VfnYMJFf`5R-{YowTcOm@W_%NquXRpo4FXk8Vmr43RWb=RY z<1~J+y*zcbBvRke=98-}+b?!Qmw!LP_9{QY`z`;R!R0nM z-}5`**{l2_%P%pZ^uMIjahTYM9&TsPk zMmRD2zI-42A9%iJukq8)_v^e5@!|UV{SeOItNmrRKgSbg{ACN{%lG{+W1`z6r*tpK zC+_e3m*pMW`#pNC$eiA*{0_@+@V-JsZlQJgZ$sfjmtI>yR1HVp6}kTLF;hQW*Y$k} Yz!cc!wm;&6{CgcaZvuxef1GFh6Ag4oAOHXW literal 0 HcmV?d00001 diff --git a/internal/ebpf/source.go b/internal/ebpf/source.go index 69583b889..e692659f1 100644 --- a/internal/ebpf/source.go +++ b/internal/ebpf/source.go @@ -123,7 +123,7 @@ func (e *EventSource) Open(cfg *config.Config) error { go e.consume() - if err := ldr.attachPrograms(); err != nil { + if err := ldr.attachPrograms(&e.config.EventSource); err != nil { e.Close() return err } diff --git a/pkg/event/metainfo_linux.go b/pkg/event/metainfo_linux.go index 606b0f669..e00d08ee3 100644 --- a/pkg/event/metainfo_linux.go +++ b/pkg/event/metainfo_linux.go @@ -22,38 +22,17 @@ package event import "slices" -var events = map[Type]Info{ - Execve: {Name: "execve", Category: Process, Description: "Executes a program"}, - Exit: {Name: "exit", Category: Process, Description: "Exit all threads in a process"}, - Clone: {Name: "clone", Category: Process, Description: "Creates a child process or a thread"}, - Openat: {Name: "openat", Category: File, Description: "Opens or creates a file"}, - Unlink: {Name: "unlink", Category: File, Description: "Removes a directory entry"}, - Rename: {Name: "rename", Category: File, Description: "Renames a file"}, - Connect: {Name: "connect", Category: Net, Description: "Initiates a socket connection"}, - Accept: {Name: "accept", Category: Net, Description: "Accepts a socket connection"}, - Mmap: {Name: "mmap", Category: Mem, Description: "Maps files or devices into memory"}, - ProcessVMRead: {Name: "process_vm_readv", Category: Mem, Description: "Reads memory from another process"}, - ProcessVMWrite: {Name: "process_vm_writev", Category: Mem, Description: "Writes memory into another process"}, - Kill: {Name: "kill", Category: Process, Description: "Sends a signal to a process"}, - Ptrace: {Name: "ptrace", Category: Process, Description: "Traces or controls another process"}, - Prctl: {Name: "prctl", Category: Process, Description: "Performs a process-control operation"}, -} +var events map[Type]Info +var types map[string]Type -var types = map[string]Type{ - "execve": Execve, - "exit": Exit, - "clone": Clone, - "openat": Openat, - "unlink": Unlink, - "rename": Rename, - "connect": Connect, - "accept": Accept, - "mmap": Mmap, - "process_vm_readv": ProcessVMRead, - "process_vm_writev": ProcessVMWrite, - "kill": Kill, - "ptrace": Ptrace, - "prctl": Prctl, +func init() { + all := All() + events = make(map[Type]Info, len(all)) + types = make(map[string]Type, len(all)) + for _, typ := range all { + events[typ] = Info{Name: typ.String(), Category: typ.Category(), Description: typ.Description()} + types[typ.String()] = typ + } } // All returns all Linux event types. diff --git a/pkg/event/params/names_linux.go b/pkg/event/params/names_linux.go index 14b30b4a4..ebb52580a 100644 --- a/pkg/event/params/names_linux.go +++ b/pkg/event/params/names_linux.go @@ -45,8 +45,12 @@ const ( FileMode = "file_mode" // FD is a file descriptor. FD = "fd" + // NewFD is the connected file descriptor returned by accept. + NewFD = "new_fd" // SockFamily is the socket address family (AF_INET, AF_INET6, AF_UNIX). SockFamily = "sock_family" + // SockFlags is the flags bitmask supplied to accept4. + SockFlags = "sock_flags" // SockPath is the filesystem path of an AF_UNIX socket. SockPath = "sock_path" // MmapFlags is the raw mmap flags bitmask. From 427c972ff235d26cb78c2312e0a7c598e6df48d8 Mon Sep 17 00:00:00 2001 From: Mostafa Moradian Date: Tue, 15 Sep 2026 10:33:32 +0200 Subject: [PATCH 4/5] test(ebpf): Cover the MVP syscall event matrix Add a checked matrix that every Linux event type decodes with its documented parameters, plus mmap process-state and live open/rename/unlink/kill coverage on a real kernel. --- internal/ebpf/matrix_test.go | 147 +++++++++++++++++++++++ internal/ebpf/source_integration_test.go | 44 +++++++ 2 files changed, 191 insertions(+) create mode 100644 internal/ebpf/matrix_test.go diff --git a/internal/ebpf/matrix_test.go b/internal/ebpf/matrix_test.go new file mode 100644 index 000000000..c53a492b7 --- /dev/null +++ b/internal/ebpf/matrix_test.go @@ -0,0 +1,147 @@ +//go:build linux + +/* + * Copyright 2026 by Mostafa Moradian + * https://www.fibratus.io + * All Rights Reserved. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ebpf + +import ( + "testing" + + "github.com/rabbitstack/fibratus/pkg/event" + "github.com/rabbitstack/fibratus/pkg/event/params" + "github.com/rabbitstack/fibratus/pkg/ps" + pstypes "github.com/rabbitstack/fibratus/pkg/ps/types" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "golang.org/x/sys/unix" +) + +type matrixRow struct { + name string + typ event.Type + syscalls []string + hook string + params []string +} + +const hookSyscallIO = "tp/syscalls enter/exit" + +func syscallMatrix() []matrixRow { + return []matrixRow{ + {"execve", event.Execve, []string{"execve", "execveat"}, hookSyscallIO, []string{params.Exe, params.Retval}}, + {"exit", event.Exit, []string{"sched_process_exit"}, "tp_btf/sched_process_exit", []string{params.ExitStatus}}, + {"clone", event.Clone, []string{"clone", "clone3", "fork", "vfork"}, "tp/syscalls + tp_btf/sched_process_fork", []string{params.CloneFlags}}, + {"openat", event.Openat, []string{"open", "openat", "openat2"}, hookSyscallIO, []string{params.FilePath, params.DirFD, params.FileFlags, params.Retval}}, + {"unlink", event.Unlink, []string{"unlink", "unlinkat"}, hookSyscallIO, []string{params.FilePath, params.DirFD, params.Retval}}, + {"rename", event.Rename, []string{"rename", "renameat", "renameat2"}, hookSyscallIO, []string{params.FilePath, params.FileNewPath, params.Retval}}, + {"connect", event.Connect, []string{"connect"}, "tp/syscalls enter/exit; sockaddr copied at enter", []string{params.FD, params.SockFamily, params.Retval}}, + {"accept", event.Accept, []string{"accept", "accept4"}, "tp/syscalls enter/exit; sockaddr copied at exit", []string{params.FD, params.SockFamily, params.Retval}}, + {"mmap", event.Mmap, []string{"mmap"}, hookSyscallIO, []string{params.MemBaseAddress, params.MemRegionSize, params.MemProtect, params.MmapFlags, params.Retval}}, + {"process_vm_readv", event.ProcessVMRead, []string{"process_vm_readv"}, "tp/syscalls enter/exit; first remote iovec only", []string{params.TargetProcessID, params.MemBaseAddress, params.Retval}}, + {"process_vm_writev", event.ProcessVMWrite, []string{"process_vm_writev"}, "tp/syscalls enter/exit; first remote iovec only", []string{params.TargetProcessID, params.MemBaseAddress, params.Retval}}, + {"kill", event.Kill, []string{"kill", "tkill", "tgkill"}, hookSyscallIO, []string{params.TargetProcessID, params.Signal, params.Retval}}, + {"ptrace", event.Ptrace, []string{"ptrace"}, hookSyscallIO, []string{params.PtraceRequest, params.TargetProcessID, params.Retval}}, + {"prctl", event.Prctl, []string{"prctl"}, hookSyscallIO, []string{params.PrctlOption, params.Retval}}, + } +} + +func TestSyscallEventMatrix(t *testing.T) { + seen := map[event.Type]bool{} + for _, row := range syscallMatrix() { + assert.True(t, row.typ.Exists(), row.name) + assert.Equal(t, row.name, row.typ.String()) + assert.NotEmpty(t, row.syscalls) + assert.NotEmpty(t, row.hook) + seen[row.typ] = true + raw := rawEvent{Type: uint32(row.typ), Retval: 0, Filename: [256]byte{'/'}, Filename2: [256]byte{'/'}} + if row.typ == event.Connect || row.typ == event.Accept { + raw.Filename2[0] = byte(unix.AF_INET) + raw.Filename2[1] = 0 + raw.Filename2[2] = 0 + raw.Filename2[3] = 80 + raw.Filename2[4] = 127 + raw.Filename2[5] = 0 + raw.Filename2[6] = 0 + raw.Filename2[7] = 1 + } + evt := raw.toEvent() + require.Equal(t, row.typ, evt.Type, row.name) + for _, name := range row.params { + _, err := evt.Params.Get(name) + assert.NoErrorf(t, err, "%s missing param %s", row.name, name) + } + } + for _, typ := range event.All() { + assert.Truef(t, seen[typ], "event type %s missing from the syscall matrix", typ) + } +} + +func TestParseSockaddr(t *testing.T) { + var inet [256]byte + inet[0] = byte(unix.AF_INET) + inet[2] = 0x00 + inet[3] = 0x50 + inet[4] = 10 + inet[5] = 1 + inet[6] = 2 + inet[7] = 3 + family, ip, port, unixPath := parseSockaddr(inet[:]) + assert.Equal(t, uint16(unix.AF_INET), family) + assert.Equal(t, "10.1.2.3", ip.String()) + assert.Equal(t, uint16(80), port) + assert.Empty(t, unixPath) + + var un [256]byte + un[0] = byte(unix.AF_UNIX) + copy(un[2:], "/tmp/fibratus.sock") + family, ip, port, unixPath = parseSockaddr(un[:]) + assert.Equal(t, uint16(unix.AF_UNIX), family) + assert.Nil(t, ip) + assert.Equal(t, "/tmp/fibratus.sock", unixPath) + assert.Zero(t, port) +} + +func TestMmapUpdatesProcessState(t *testing.T) { + snap := ps.NewSnapshotter() + ps := &pstypes.PS{PID: 9, Name: "target", StartBootTime: 1, Threads: map[uint64]pstypes.Thread{}} + snap.Put(ps) + + raw := rawEvent{Type: uint32(event.Mmap), PID: 9, TGID: 9, Retval: 0x1000, Arg0: 4096, Arg1: 8192, Arg2: 3, Flags: 0x20} + evt := raw.toEvent() + applyProcessState(snap, evt) + ok, got := snap.Find(9) + require.True(t, ok) + require.Len(t, got.Mmaps, 1) + assert.Equal(t, uint64(0x1000), uint64(got.Mmaps[0].BaseAddress)) + assert.Equal(t, uint64(8192), got.Mmaps[0].Size) + assert.Equal(t, "anonymous", got.Mmaps[0].Type) +} + +func TestFailedSyscallKeepsProcessState(t *testing.T) { + snap := ps.NewSnapshotter() + snap.Put(&pstypes.PS{PID: 11, Name: "keep", StartBootTime: 4}) + raw := rawEvent{Type: uint32(event.Openat), PID: 11, TGID: 11, Retval: -2} + copy(raw.Filename[:], "/no/such") + evt := raw.toEvent() + applyProcessState(snap, evt) + ok, got := snap.Find(11) + require.True(t, ok) + assert.Equal(t, "keep", got.Name) + assert.Empty(t, got.Mmaps) +} diff --git a/internal/ebpf/source_integration_test.go b/internal/ebpf/source_integration_test.go index a33c43f56..f43c1feac 100644 --- a/internal/ebpf/source_integration_test.go +++ b/internal/ebpf/source_integration_test.go @@ -22,6 +22,8 @@ package ebpf import ( "os" + "os/exec" + "path/filepath" "testing" "time" @@ -81,3 +83,45 @@ func execLookPath() string { } return "/bin/sh" } + +func TestLiveSyscallTelemetry(t *testing.T) { + cfg := testConfig() + es := NewEventSource(ps.NewSnapshotter(), cfg, nil).(*EventSource) + if err := es.Open(cfg); err != nil { + t.Fatalf("opening process source: %v", err) + } + t.Cleanup(func() { _ = es.Close() }) + + dir := t.TempDir() + path := filepath.Join(dir, "x") + script := "echo hi > \"$1\" && mv \"$1\" \"$1.new\" && rm -f \"$1.new\" && kill -0 $$" + cmd := exec.Command("/bin/sh", "-c", script, "sh", path) + require.NoError(t, cmd.Run()) + + deadline := time.Now().Add(5 * time.Second) + saw := map[event.Type]bool{} + for time.Now().Before(deadline) && (!saw[event.Openat] || !saw[event.Rename] || !saw[event.Unlink] || !saw[event.Kill]) { + select { + case evt := <-es.Events(): + switch evt.Type { + case event.Openat, event.Rename, event.Unlink, event.Kill, event.Mmap: + saw[evt.Type] = true + } + case err := <-es.Errors(): + t.Fatalf("event source error: %v", err) + case <-time.After(50 * time.Millisecond): + } + } + if !saw[event.Openat] { + t.Fatal("did not observe openat") + } + if !saw[event.Rename] { + t.Fatal("did not observe rename") + } + if !saw[event.Unlink] { + t.Fatal("did not observe unlink") + } + if !saw[event.Kill] { + t.Fatal("did not observe kill") + } +} From 096ac66f6294190be0579d2341de859e657ca363 Mon Sep 17 00:00:00 2001 From: Mostafa Moradian Date: Tue, 15 Sep 2026 16:05:42 +0200 Subject: [PATCH 5/5] refactor(ebpf): Capture process-control syscalls at exit tp_btf/sys_exit supplies pt_regs, so kill/ptrace/prctl no longer need an enter probe or scratch slot. Rename filename2 to aux, document the truncation bits and padding, and keep only file-backed mmaps in process state until munmap is hooked. --- internal/ebpf/c/common/events.h | 72 +++++++++++++++-- internal/ebpf/c/ctl.bpf.c | 134 +++++++++----------------------- internal/ebpf/c/file.bpf.c | 4 +- internal/ebpf/c/net.bpf.c | 8 +- internal/ebpf/clone_bpfeb.go | 2 +- internal/ebpf/clone_bpfeb.o | Bin 45216 -> 45192 bytes internal/ebpf/clone_bpfel.go | 2 +- internal/ebpf/clone_bpfel.o | Bin 44832 -> 44808 bytes internal/ebpf/consumer.go | 29 +++++-- internal/ebpf/ctl_bpfeb.go | 35 +-------- internal/ebpf/ctl_bpfeb.o | Bin 47768 -> 22144 bytes internal/ebpf/ctl_bpfel.go | 35 +-------- internal/ebpf/ctl_bpfel.o | Bin 47288 -> 21760 bytes internal/ebpf/events.go | 10 +-- internal/ebpf/execve_bpfeb.go | 2 +- internal/ebpf/execve_bpfeb.o | Bin 22792 -> 22768 bytes internal/ebpf/execve_bpfel.go | 2 +- internal/ebpf/execve_bpfel.o | Bin 22600 -> 22576 bytes internal/ebpf/exit_bpfeb.go | 2 +- internal/ebpf/exit_bpfeb.o | Bin 7880 -> 7872 bytes internal/ebpf/exit_bpfel.go | 2 +- internal/ebpf/exit_bpfel.o | Bin 7880 -> 7872 bytes internal/ebpf/file_bpfeb.go | 2 +- internal/ebpf/file_bpfeb.o | Bin 77952 -> 77912 bytes internal/ebpf/file_bpfel.go | 2 +- internal/ebpf/file_bpfel.o | Bin 77184 -> 77144 bytes internal/ebpf/loader.go | 14 +--- internal/ebpf/matrix_test.go | 41 ++++++---- internal/ebpf/mem_bpfeb.go | 2 +- internal/ebpf/mem_bpfeb.o | Bin 32240 -> 32216 bytes internal/ebpf/mem_bpfel.go | 2 +- internal/ebpf/mem_bpfel.o | Bin 31952 -> 31928 bytes internal/ebpf/net.go | 2 +- internal/ebpf/net_bpfeb.go | 2 +- internal/ebpf/net_bpfeb.o | Bin 33648 -> 33600 bytes internal/ebpf/net_bpfel.go | 2 +- internal/ebpf/net_bpfel.o | Bin 33360 -> 33312 bytes internal/ebpf/prociter_bpfeb.go | 2 +- internal/ebpf/prociter_bpfeb.o | Bin 7136 -> 7136 bytes internal/ebpf/prociter_bpfel.go | 2 +- internal/ebpf/prociter_bpfel.o | Bin 7136 -> 7136 bytes internal/ebpf/spike/c/vmlinux.h | 10 +++ 42 files changed, 199 insertions(+), 223 deletions(-) diff --git a/internal/ebpf/c/common/events.h b/internal/ebpf/c/common/events.h index 912371a90..185eea59c 100644 --- a/internal/ebpf/c/common/events.h +++ b/internal/ebpf/c/common/events.h @@ -13,8 +13,9 @@ #define EVT_FILENAME_LEN 256 #define EVT_TYPE_MAX 32 -#define TRUNC_FILENAME (1u << 0) -#define TRUNC_FILENAME2 (1u << 1) +/* Set when a userspace copy was longer than the destination and was cut off. */ +#define TRUNC_FILENAME (1u << 0) /* filename[]: exec path, open/unlink/rename source */ +#define TRUNC_AUX (1u << 1) /* aux[]: rename destination or sockaddr bytes */ /* UAPI openat2 argument; not a CO-RE kernel type. */ struct open_how { @@ -73,6 +74,7 @@ struct syscall_event { s64 retval; /* Interpreted per event type: clone flags, open flags, mmap flags, accept flags. */ u64 flags; + /* Generic argument slots, interpreted per event type. */ u64 arg0; u64 arg1; u64 arg2; @@ -80,10 +82,10 @@ struct syscall_event { u64 start_boottime; u64 timestamp_ns; u32 truncated; - u32 pad; + u32 pad; /* keeps comm[] 8-byte aligned; no semantic value */ u8 comm[TASK_COMM_LEN]; - u8 filename[EVT_FILENAME_LEN]; - u8 filename2[EVT_FILENAME_LEN]; + u8 filename[EVT_FILENAME_LEN]; /* exec path, open/unlink/rename source */ + u8 aux[EVT_FILENAME_LEN]; /* rename destination or sockaddr bytes */ }; struct scratch_value { @@ -95,7 +97,7 @@ struct scratch_value { u32 truncated; u32 pad; u8 filename[EVT_FILENAME_LEN]; - u8 filename2[EVT_FILENAME_LEN]; + u8 aux[EVT_FILENAME_LEN]; }; struct { @@ -227,7 +229,7 @@ static __always_inline void copy_scratch(struct syscall_event *e, struct scratch e->flags = val->flags; e->truncated = val->truncated; __builtin_memcpy(&e->filename, val->filename, sizeof(e->filename)); - __builtin_memcpy(&e->filename2, val->filename2, sizeof(e->filename2)); + __builtin_memcpy(&e->aux, val->aux, sizeof(e->aux)); } static __always_inline struct scratch_value *borrow_scratch(void) @@ -277,3 +279,59 @@ static __always_inline int submit_from_scratch(u32 type, long ret, u32 syscall_i bpf_ringbuf_submit(e, 0); return 0; } + +/* x86-64 syscall ABI. arg3 is r10, not rcx. */ +static __always_inline u64 syscall_nr(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, orig_ax); +} + +static __always_inline u64 syscall_arg0(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, di); +} + +static __always_inline u64 syscall_arg1(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, si); +} + +static __always_inline u64 syscall_arg2(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, dx); +} + +static __always_inline u64 syscall_arg3(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, r10); +} + +static __always_inline u64 syscall_arg4(struct pt_regs *regs) +{ + return BPF_CORE_READ(regs, r8); +} + +static __always_inline int submit_args(u32 type, long ret, u32 syscall_id, + u64 arg0, u64 arg1, u64 arg2, u64 arg3, u64 flags) +{ + struct syscall_event *e; + + if (!type_enabled(type)) + return 0; + + e = reserve_event(); + if (!e) + return 0; + + e->type = type; + e->syscall_id = syscall_id; + e->retval = ret; + e->arg0 = arg0; + e->arg1 = arg1; + e->arg2 = arg2; + e->arg3 = arg3; + e->flags = flags; + fill_current_task(e); + bpf_ringbuf_submit(e, 0); + return 0; +} diff --git a/internal/ebpf/c/ctl.bpf.c b/internal/ebpf/c/ctl.bpf.c index a237c8360..02cbb3ffe 100644 --- a/internal/ebpf/c/ctl.bpf.c +++ b/internal/ebpf/c/ctl.bpf.c @@ -5,102 +5,44 @@ char LICENSE[] SEC("license") = "Dual MIT/GPL"; -static __always_inline int handle_kill_enter(u64 pid, u64 sig) -{ - struct scratch_value *val; - - if (!type_enabled(EVT_TYPE_KILL)) - return 0; - val = borrow_scratch(); - if (!val) - return 0; - val->arg0 = pid; - val->arg1 = sig; - store_scratch(val); - return 0; -} - -SEC("tp/syscalls/sys_enter_kill") -int handle_sys_enter_kill(struct trace_event_raw_sys_enter *ctx) -{ - return handle_kill_enter(ctx->args[0], ctx->args[1]); -} - -SEC("tp/syscalls/sys_exit_kill") -int handle_sys_exit_kill(struct trace_event_raw_sys_exit *ctx) -{ - return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); -} - -SEC("tp/syscalls/sys_enter_tkill") -int handle_sys_enter_tkill(struct trace_event_raw_sys_enter *ctx) -{ - return handle_kill_enter(ctx->args[0], ctx->args[1]); -} - -SEC("tp/syscalls/sys_exit_tkill") -int handle_sys_exit_tkill(struct trace_event_raw_sys_exit *ctx) -{ - return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); -} - -SEC("tp/syscalls/sys_enter_tgkill") -int handle_sys_enter_tgkill(struct trace_event_raw_sys_enter *ctx) -{ - return handle_kill_enter(ctx->args[0], ctx->args[2]); -} - -SEC("tp/syscalls/sys_exit_tgkill") -int handle_sys_exit_tgkill(struct trace_event_raw_sys_exit *ctx) -{ - return submit_from_scratch(EVT_TYPE_KILL, ctx->ret, (u32)ctx->id); -} - -SEC("tp/syscalls/sys_enter_ptrace") -int handle_sys_enter_ptrace(struct trace_event_raw_sys_enter *ctx) -{ - struct scratch_value *val; - - if (!type_enabled(EVT_TYPE_PTRACE)) +/* x86-64 syscall numbers. Register-only syscalls are captured at + * tp_btf/sys_exit, which supplies pt_regs (args + retval) so there is + * no enter probe or scratch slot. The per-syscall sys_exit tracepoint + * only carries id and ret. + */ +#define NR_PTRACE 101 +#define NR_KILL 62 +#define NR_TKILL 200 +#define NR_TGKILL 234 +#define NR_PRCTL 157 + +SEC("tp_btf/sys_exit") +int BPF_PROG(handle_sys_exit, struct pt_regs *regs, long ret) +{ + u64 id; + + if (!regs) return 0; - val = borrow_scratch(); - if (!val) + id = syscall_nr(regs); + switch (id) { + case NR_KILL: + case NR_TKILL: + return submit_args(EVT_TYPE_KILL, ret, (u32)id, + syscall_arg0(regs), syscall_arg1(regs), 0, 0, 0); + case NR_TGKILL: + /* pid, tid, sig: emit the thread-group id and the signal. */ + return submit_args(EVT_TYPE_KILL, ret, (u32)id, + syscall_arg0(regs), syscall_arg2(regs), 0, 0, 0); + case NR_PTRACE: + return submit_args(EVT_TYPE_PTRACE, ret, (u32)id, + syscall_arg0(regs), syscall_arg1(regs), + syscall_arg2(regs), syscall_arg3(regs), 0); + case NR_PRCTL: + return submit_args(EVT_TYPE_PRCTL, ret, (u32)id, + syscall_arg0(regs), syscall_arg1(regs), + syscall_arg2(regs), syscall_arg3(regs), + syscall_arg4(regs)); + default: return 0; - val->arg0 = ctx->args[0]; /* request */ - val->arg1 = ctx->args[1]; /* pid */ - val->arg2 = ctx->args[2]; /* addr */ - val->arg3 = ctx->args[3]; /* data */ - store_scratch(val); - return 0; -} - -SEC("tp/syscalls/sys_exit_ptrace") -int handle_sys_exit_ptrace(struct trace_event_raw_sys_exit *ctx) -{ - return submit_from_scratch(EVT_TYPE_PTRACE, ctx->ret, (u32)ctx->id); -} - -SEC("tp/syscalls/sys_enter_prctl") -int handle_sys_enter_prctl(struct trace_event_raw_sys_enter *ctx) -{ - struct scratch_value *val; - - if (!type_enabled(EVT_TYPE_PRCTL)) - return 0; - val = borrow_scratch(); - if (!val) - return 0; - val->arg0 = ctx->args[0]; - val->arg1 = ctx->args[1]; - val->arg2 = ctx->args[2]; - val->arg3 = ctx->args[3]; - val->flags = ctx->args[4]; - store_scratch(val); - return 0; -} - -SEC("tp/syscalls/sys_exit_prctl") -int handle_sys_exit_prctl(struct trace_event_raw_sys_exit *ctx) -{ - return submit_from_scratch(EVT_TYPE_PRCTL, ctx->ret, (u32)ctx->id); + } } diff --git a/internal/ebpf/c/file.bpf.c b/internal/ebpf/c/file.bpf.c index fe991bbd6..5e5353780 100644 --- a/internal/ebpf/c/file.bpf.c +++ b/internal/ebpf/c/file.bpf.c @@ -115,8 +115,8 @@ static __always_inline int handle_rename_enter(s64 olddirfd, const char *oldpath val->arg1 = (u64)newdirfd; val->flags = flags; val->truncated |= read_user_str(val->filename, sizeof(val->filename), oldpath); - if (read_user_str(val->filename2, sizeof(val->filename2), newpath)) - val->truncated |= TRUNC_FILENAME2; + if (read_user_str(val->aux, sizeof(val->aux), newpath)) + val->truncated |= TRUNC_AUX; store_scratch(val); return 0; } diff --git a/internal/ebpf/c/net.bpf.c b/internal/ebpf/c/net.bpf.c index 8f4269daa..9df0001eb 100644 --- a/internal/ebpf/c/net.bpf.c +++ b/internal/ebpf/c/net.bpf.c @@ -12,12 +12,12 @@ static __always_inline void read_sockaddr(struct scratch_value *val, const void { u64 len = addrlen; - if (len > sizeof(val->filename2)) { - len = sizeof(val->filename2); - val->truncated |= TRUNC_FILENAME2; + if (len > sizeof(val->aux)) { + len = sizeof(val->aux); + val->truncated |= TRUNC_AUX; } if (addr && len) - bpf_probe_read_user(val->filename2, len, addr); + bpf_probe_read_user(val->aux, len, addr); } SEC("tp/syscalls/sys_enter_connect") diff --git a/internal/ebpf/clone_bpfeb.go b/internal/ebpf/clone_bpfeb.go index a99c432ca..bca4d7573 100644 --- a/internal/ebpf/clone_bpfeb.go +++ b/internal/ebpf/clone_bpfeb.go @@ -23,7 +23,7 @@ type cloneScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadClone returns the embedded CollectionSpec for clone. diff --git a/internal/ebpf/clone_bpfeb.o b/internal/ebpf/clone_bpfeb.o index 6e64435e0e43ef1428988face98b3da432c06ef1..091806274ed82a70ee62dc001f3623229903dcce 100644 GIT binary patch literal 45192 zcmeI5eQ;yfdEO5I5(Iap6&y=4?8wqp>?l}ywZe+}fMt0LeXI<{Yl)H9Hf^f~uq3o# z#U&w+@C&m`tf)?X8K3W{BO8J z9(@ZOzfrVQ;OARSY^7q-LMzXkl<2EX`7~y_bLG!OFW)Jj#*78VT)A@P&oVZ&^|BwI zcFx!bnCGZ5XTKe68U8T0DO=^Q$r`D)t>J)X7TBH`Jd1{WDr3TatHBC)XMNogUN8P3Ns5{hc z>K1jA+NEw#*Qp)q8nsPbrM9R|YJ*y*)~IFb6m^nXq!y@oYL1$v2Gk5SO-)fn%*8R+ zA1@|NAbhzjpT@Ai9l5x6Wlvc3&pq8gFW)br(60+teEj&U4$VKH`u@N233oq)^4XOj z)n=@W{(t3FTUwKt{anZq!E_R%Ciawse|1$pjnUy= z4a7Izcr_>5Z?8}J_WMBD91{QO-}wH@f0McLEs4ka$NrEb%&5826aR~|@jA6eEmK`T znT=19i_`+u^^@7SEiux`(m$ZOeliN^Mb_)CRRqtx?O=De5G(NG(wF)EqTS4X7Dvnwp}Dp#B^uX3Z|SN8O=rQ@5y_ z)Gl>{x=!s-*QjmkDz!yzQXAAdwMH#dr>K+EBDFxxQ*+cTHK1mwX=;ip;_v6ti)G{T zsk!lD`kc8%?EU+-BGeCm;%i@T36R?MV?WIE~ZJDmqzIydF`9N@}5@?FX?;>%HCIi~qM!EyvQJb&$a_;UJm zRzA*h)Xk5C>XY)}{x8a7uMf*}-FGR^h|kBDCsZ$YU8B!K2aVIQn~eEIDgTOVM}zB= zBfI`vF?q5L0egXL^8wrYWaVaK?+45icHTgGfrNwI`d89U(e7pOhu!7_dxLEA0XNA7 zQE-cF^8v4tCuwh!r^svMGPy&pk=My}@&>s&F8MP4OuliTDS@*25E?vQuM z>*PK1hU1usv`<&`VkMRm1#gnm2OfOz$c;**petZtExcM6KB^cT(UUcC( z-&W!U@~$ZCd2)}OBkz!HIakuLZE_$A-Xhy_fj7yvT;MJ_B?{gkiwLhfcI5(h$h)+! zk$dDed5648w&g&Oh5Ut$o=DpB(krIE54|YEMUY|4l{Kfgk&$E~GbMxhjq>g!~?)2i9uI!3y<$m`Z zt>&*?HGkDtKI7(_mA~!cO@Hb8doJC#?rhp}1RtYb9OL~k#`|E5{eO(llVj}fW9;W+ z?B8R2o*awyB*lwku^s9*b&I-5?NT?W>(mZ)joPNJQd`s})m}&BS0~q~W$F}ll3Jt| zsCjCRnxzKR3^h$nQAK3kwMX5h_NY75ZR!?vliHKe68U8T0DO=^Q$r`D)t z>J)X7TBH`Jd1{WDr3TatHBC)XMP%LWc)0Gg?ZM}u;kt8{!VMccMcK*PU*?H(YlP*PV90thjXq)`_d+ZPDSnQ(D0!zSni9e_!)z z*~T-|U;Hb6Uzy~(G0AmflKnTybz_pxgGoLQCb@1*a^0BZx-rRhW0LzGN$z(fxzCa0 z{zj7f8cFVFB)N}~jIBuxFD7Gcs_QpN?o%XVP5L*eb!v@Trn={pWNeaLq!y@oYL1$v z2Gk5SP31btjc<5Qx99xLF11J9p>9*RsGHO-b%VN2?NHaKZR#quMQu_W)H=0BEmNnc zlhh)$K+RKg)GRfiW~gauiYhXEUuj##Hii8dt{XW{4A+hBKAGh>F??Ss_s8hP;rmKE z4iDc~+Trr~(0j(=x)Dt>TsIEajdEw;{iA#Cs>I7=_xx2EzOQucF??T%b{MW3hwH|5 zxgW3&?NHaKZR#quMQu_W)H=0BEmNnclhh)$K+RKg)GRfiW~gauiYhW(H`-RQO<_NV z>&D@_(cTxc?)zEzey{Bp!|%D;W*Dv;hu?FRj&QZ_-454{Xqe%;aky@j8)Ud{>GrxC(iQy>a6>IKl}@{yLIAh z%&ik=V{V-|8w+T6>%`fZTPF^mf89EHR$8b3yRH87Z~uO)I6HZyl6Ak!Iu}^~;NMa& zo;B9x?bBynIIumyHouVlIx(zd`FonPW>T2nU(a8*SJRjq?h#*vdz*`oeCn37?)N?5 z8rfdgn*w7e=u!S&`tnbR73tjWv|@ktWWTR(!>?pqxo=9dytli2P+t4IS9yc6<;3^< zZU3p*yA;0z_=#vcJjL`c{`&X#{d)Y4$^JwZ-(Ru^p09G^0K4lm{2kLK+oL6l_Sqt@ zlDEli@(y{8+#`3$yX1B99(lvD?LN}}U2=-{O>&yNMb417$pLwXoF(_jIr1(!Pu?RJ z9J_K1f5+s$AB693vAx~<3NWvS+s^@aUHiH34S_evBDkKz-!ZxNh&5b$aGbmP@0Rxc z&fo7Fey`sjd+b7GE_mM)XYPK_IJg6xK8>WfbsUD3$dX1H=bLeQ?_1%<^koV-?>vGJ9Ah}G zon^CsV?d{iFxJd4cHX*5m~c9h{D~AkaNL0NKDwn$?_zhJi7I0Q^UXQbhQ=UfNfU}Epfpy0e8L7LyW>=|~O`CPM z&)ECJxRNrA{9f-M1zm3oW^Xb6+eYy+KU!=PU{Uy4)(3hRt*7(=qMsZ^W=$Gj( zL)UQz@NYtY+quWZ{S~&Ev_qHf+u;5kwx5Xg4%OkU@I!H32srRh(zbnvPbIcprJV~n zrCp^hn>eLirJr_j{zta!?Qq+~*dA{O@9V4ZvVBDk;9Vptbt}Lm_tSBlIAS;B zL#_qxftb`&+~{+$JXFdU!2KxnZkz?UABW0c6KKNyUYm&vC-FZ*PC+GX$uq)(BlXV# zrJlCEaYIN@+JqCRqH?;WOgHsH0+=momtcR5GFHw(#+%rPlI||tKM(hVF014(!~GE41^E9O z+_)FzzDdeGbQ10^)Mq5u!n@xkZaW|v^EX2NA41%JE|tI`5LseOz|{{rnlc@?|F@6vwy zDt3wgr?fvQ_PBf)w{B8poiygUw=?WdNuY#$xWiuuL^<*r@7MRkgnAwM8YZPthGSFN z`BLstIRczNCJr0{&O5|`Bfx3*dz|~o?;{`r!|k z-v7i$PLL6Y_D7 zd`y^U=PKux%<|%e`RU4Xb;i^yGv?XZx$1o7eAQGgG|Yv(lfYSl{J zAkx`6q_MnMnXZ;>T}q3UkCm2ImZXN&MKir{{`|sx$<~{0R{%nNv06P}UuNmO=j@EZ zKNJ@&KO zdpn{XHRGky*$cCC%d_*P^VRc9)#WU_j|I77!P4x0(r5@rP zuuTq&Rd}LD1?WC3*SRX%|H9%Tu2`u)J5yRdH#?J+MA;_3>=)`Y=rPfd8|_j|Labc$Il9&d#4Z zd*RvAVs)vy_(C;%hwB`Jt5!XVizr#ybgMS9bQ^a~q}SNH`Jf^X?swPx{giAh+ijLs z=BG=~R%Ix_tx>AX%w(e6!Me7!Wk#L_$`ekJKM z^GmjuAQ&1N9RLB~K;T>&4n50|I&M=BHd^VJP`-j@an-h|FYMArZpo;ZkwlE;**_v(l-{n1HK(*GX~o zFFV<`?Q&)5IZ1vA1M&27AXuXN&Z9axu}V{iLK&3UNS#g9-X{w)Roq*Zxl+9%_pv#* zxPW11u3DMFAZ!iOix{Zqm+FfPjTM7yy0~0AyRfh8T91tZ`M&D~)_@jt?!i-Dbsk^HY&C!KA7D%0K zPWRy^L6xqRkJx=K){UFgHUlo7v27=gs<@tmtF$chsd297;0q7;nS1b_2Xn4)uQ`bg{76mqjZStL2{)9V?`AMdUwyulP9>rI zK)-b1?0L*aGKj)-^@ov(Ydwuj7(DLzhYyrD{G>9`A0!TX$_nnp0}1LT{rKJrLiF{~f(aKzNqQ&G4D z`qTJT8X#l~N0BGT(z6ST&mGWY)^v?R;rZyh6zJ-SOL44aUtwOjdIVcgXA4J>bPk9y zF!>16wd#yqrRnO@lCN~>?DDgBFYUKTCy`-s^697ElRYp28JPFaDt-XHnr*r^J2!(4 zWN&*5!HX{jxBHRV`Cs$##||X@#{ipzo0HLda8J4sJ>s2{5mJT^J3!Kea4rI;^GFPP z=SHR+j5rJtor+{8${#TJxG9;@4xFDu^VA@dkS9thjTQ1i^T|A*LW>u|O3~fSAs%;~ z^m7GGZjzvh(*jKHaWI?3eSOqj3qI#O^bj6#js`EfZthL4@oX!(MGsa0D9*m|&5jGQ z7`f&EclwD(Pd)kmQ|35AE}6O6>FWHFY>aWQJ8%nK^AZ&2Tc5$Xi>)!B|_{-#Pd- z@&s1sSl{>8%nx9PMb_NjehO=U*>m*#9`F+(hWqdrL;POwH$wbA><7sHk&pir7<)W@ zej0A<%h)nu=`Kg?^EiJCA!OfH%IjImDSKakg7Z5j@rvx9Wt|-^cjTNse%K_svX4+C zzuP2Ulkih2e2w;^Nqi048u7NX$DhX*5VkSmYviBBmKF99;_D3mIg@x@>>D9Q`teN{ z-W3MCMf>lX#JAB7@jYj^^+SHP?PU)HhtxCil!;~T2B7SH4#3hzu*W}V%rnT>wu5J> z7sA-^pERZ+TmYk;`Ul$~@eBBq#DQ>;K< zGx0A=yD|Tf-@zrh5!|I+82gEdO)%PLllZLIS7{d(dz;)fiB;jX5KH+wxICEc4MM812@df6C4di#ux0-k*P(WIz9`s_<*H z`}t?f+57Vk+b#aHoPT-@@8_T05Tm{cltS9WABhz0oPQEIXFnwMlXjK4UClpd?uMVl zLpsvlX995A@o@eb&Ob8$4(A_tUk&Gw#ffUz?? z9^3f`_Wt}(aQ!Im=Z8rZzD&EHA6A{cKR>j|etzgMyq_P|LyY+$-gV&(kN76-etoj* z?6y8q&o3gNnjbEy`QcK4FliTWI6n;MhvED%T%Y_fuTL(?xG8&JYJPb6ui5+{>p;7= zr{;%O)co+uaDEu>UroB_jN$&(aR2IuegEne88_t}$m2M1$ok;ADHD55HdVRra^0&Y z_B!@W{d0BS&i$;uJ@4)-Nyi=q$Nhc&DYD<^uZ0-+t)5L^s6P*YxiJuD{;I(-L3GhxnGU&z#sM#r?YJI=H0({sV?Sr&k4gBJ<0JTA&5DxVYKT$35w_QncbNETv9HlCEcOoh zaTA|90bUO=>Tll@pngZhj&~&^-H`pqz?&hK@~}N^cu8-^*|BdPe z<>mUPxNkm+Fnvb(Mp0+W+&3T1gjnnWnfvDcy+cY^>^a)GZ$6q2vDgdbuG=>sErwXi zH%aEc`RG)L(Z5E^WbT{$_ZTT*++U-0XZQQ&W1hKhJ}xZnd(p&e=s)9)5M!TzycJD< ze3kZpXyS9&>>cko9{(e}*F*mr?>g>}7isj-dkr@5(e_O!>Yx0VP#kjYEbm#gZ7n>8 z-x|mvb+>%hq8V*N@xA-8E%J`zltZ_d{Da8ni^%W?kdJ+~{Xyg-a{<;0i8W}b{bg*6 zFt3-tJ~DQR{ra~-uu z$%l`$+aC=4BklIZfq$gkWZlm4MA}X6JNoZyH+g1MM?%IE?=N-ak$3_Q`tNHu%x(IJ zzYRY0kF?t(1OG^Wll#c0(}bHxT*e3QA8NPQm4Sbx-TuSCKhkdhXy6}dxAzYGBklI{ z1OI*P_D0y$5y$hCq5pVyV2uCMfxr8k7tR)wv5w(msX_R}?+*M&!sFyuL;mGZc>lzH8 zq~pg`dLPci|Mx=S>x1y-wva!)Wu0Vh4EYPo5ui-tNZ*f#))RgOjH|y7e?KnK-{va| z1wRh>@S-}Bet zE`)d+ZfSpSe;sZqkLT~eeR{z1J7$|V?dBocJWE*FANP#!QQ3RN^Bh>lN6#<9eQSt6 z3%B$MZ+{tXnRh*Z8E$#*^xTD8+QPH6SD1Gc??%}+V<>zqt?Yr~oZ^DwNyTNwb;V7^ ztBThY%l$5OWqo6Ezl2$?XPA46<^B)Z<0-`%#r|3_zj$8Ri;AZd*AzDtw-mP(cNA|Z z-c-D;xTkn8%67a9wMQbO>{-Qm#YM$aiff7+id%}?iaUxo6mKftR@_s(7v+(Z;*8>~ z;=JOb;wi;7#SO(R#cjnM#T$w@6>lr`R632ib>;a8_|%aZ&M<;+o=y;+EpJ z;*R1C#hZ$^755bHMLC&LoKc)roL5{_Jf*m%xS_bExUIOOcti1~;%&vd;LvK*D&AJyQ@j`D@s#3>;;iDl;-cay#WlqZ#Vy5c#T~^PiZ>N+EAA=Y zi}InA;*8>~;=JOb;wi;7#SO(R#cjnM#T$w@6>lrN+EAA=Yi}H0T#Tms}#d*a=#Z!uFiW`bsirb1iiZ>K*D&AJyQ@j`D z>r;v|inEIIii?V;6xYF__09E7#jA?f6t64pD&A7Oqj)#UGS!94gZGJ14ix7U7Zgi< zL+iC8HN_3ZEyZoc9mN}pHx+Ly?kV1j@(n4)8O2$}dBsJ=Q;KVf8;V8O2$}dBsJ= zQ;KVf8;VlrQZ%Qf7 zD9$R*D=sRYQe0EqP~1}7R@_m%p?FjAw&I@Ry(ni=iZhC{it~z#il-FU6gL#N6t@+3 z6mKZrRJ^UYr+6>QZ%!%BD9$R*D=sRYQe0EqP~1}7R=f@ly}x*KSMiqO9mTs*ehV<1 z-doa&1I0PT1;vw!%ZlrYn~GNzuPI(v+*Q1#ct`PWlx3+EuK$mw6$grQiVKP-6_*v) z6*m>HDqd5(uDGjsOYx54-6-Dz4A=jbwBkTbigSt!iYFD971tFv6|X8@Q@pOYt9VQCj^f=Y%Thdi{cn{H5qh6> z>oLU-DL$?E8O3voFM&h*!MDDo`16Y8eRMedYl^?F_}k#n{=%)_iSljNDVF+%!ryjG zvD7zgKLZXuuiiGJcv-R3Hyr*Y#Zup}{a=AY#@toop6@S)q@x4z?{?ya&Kl6bPzVFGOeB!h@zFciAo8ybsx#N$VdHlG* z;BTb*zp?E8kX86^?neGn-{3E^Njm%fa`3?H|L$7)=**Z2c*_Akm^HIif% z`7?C;{}7yuchH}S+gHMa^BVlAJvNLvJ~#KmdHI8}i}*v-{lEJaPEyL}{=V{o#dqd# zB%9GSVukGfuSy@spQ>A~oHfUnR?b`H^)>!albwF#k$fp{AP+dX&&h<76HfA_6Aa_@ zKJoPaA`S3ILioU72&KR-2E=xeIoajtV}pL;pBnR2^yUu4a-QwYQA)@OTx;1 zjwYO(fP`DF-`o?nhhMd4+J>EoL>n~d0rA2CY!gmMk?t>9xzEYHP9~h(soD(z$ zBi!1`Kq85& zC-epRE-sG5|8Uy>v|rF6iQBV$S2lbU!Vq$g4BWAQ2KRS~Z@&*Rh%)#RyhN4nZ~E^Q z7Q%sy`J_DO%Msv|G1}KN1-Be&#Q!_c1M*MEx&w#(9-(u(Pahu?TfxUc`EM{%87lev z?_K)%$UpJp@IN5`BTd+FBnnmrA3na=ZpX&~`F|?IC;?RR_utF(@sWT0zr+84{NK=p z4ac?WAOB+nI4J+Tjc!aCD*5|xq5NZa!vBE$Z`p$lhreu&@af~j8M^}?KHUP`q2p6+ zLI9Qg50ia-)Zcs+=K=ZO#{92Ue`TOt9hVy?v{13?gIPzQFkXe(Q~)^2YuP XJmcOF)r)1vV{#oO&Pm7p{4@UtnTfN= literal 45216 zcmeI54RB-Ed7ck0ND$nWR#5a~*pa2HIF_;UYK7g^4=gJi=x1dpT1&LFQs`I-fF+>? zD=rC&7jBhzV@5(_E?&I&=V=?;n(W(W zT`=|}%N#c5l$g%ctRsAZdOjIs!~zYeX{yZ;c3VDF%!n7;p>9*RsGHOdb%VN2U8Am2 zSEz03GPOlrqBf}wYMol6R;eZGICYF#pysJLYL=RzhSW4QMNLvg(0;Q+-KK6)H>n-! z26dgfMqQ<@P}|gHYKyu=ZBiT5I<-cvQcKiv>KL^^%~NyKEHy(7scCA8nxu-D^CNCN zo==!i_(DnEjp2AZaDMsXj<6b^J9>OxxJzPTT<5L$^uZer%|E32@xSRbi6l0 zu?F=wvZCGo`i$?tCrf6Z*eAaH?&^P?x%gd4$M(nmJ!hCfR~p6bTQRA6h2d@{6$R5wnhf)qJP6+yY2C#GWC0o4QPG zQJ1JqYJ*y*)~Ho#i8@XlqZX)nYL1$vW~d=GO-)ggR1vhF^Td?dCT~$UsU7MDb)C9K zU8Sy2+tg)hi@HQ@QXAAdwMMN{OVn}d7_~snQ*+cTHA4-lX=;j^q>A|KdH8(ExN@p) zzL+>;ZV-R>dMyie;~%(SYm4jdJvrAaX#uOIOBU_G-J?sn;}I^y)g`+E6c`q^PVN#^t1 z;``ine7CcHt{)A~PnPV) zZ`tI?HU|88vMmQ}uam{=jlCYQPS|w=`Gpb>erqqMoTA@LVu#CHS#LCPF^E7$m`@Ld4s$}?vPvLP4Y5%i`*t}lUK+) zx}gk~hg2@)kKu-X`bBJLJ4$R}Yk5ASdY`Bd5sY z~^7kHg)>jhpTCq==lWD(&N$F5%BHhG)=W%3re zMcyPYk!`(@zDeGozd>Fn*U4+-8rjwh>8s=w`b*?Cd7QjV9wWEN1@aO(Pi~TP z-cOFiwj{^%Be6|thq^&sr>;>~sVmerb(z|tE>WA*2GyQNlvg8HsU_+-b&Oh|=BYVq zmYSi4)HF3kO;SbVxod~IP2HkyQajWQ>N<6ex=LN4wyDe17Ilf*q&BE^YK>Z@mZ;;@ zF=~ODr{<_xYK9t8)6^6-NfnXjZpVY?PTL>64;nmoPH~=?;yf{U?%c80%iy`w%}0ah zP8kk^=g!`9@Zh-<17h&p>7Mrn&z*zkPP<-~-E#z<6PL&x(ZO@4^n!`M)8|hAdCeOo zo6byp@vr&w$^@Sq6MSw=aQr6t+?e3~V1oC92|hO__}rM_b7O+fjS231B)H#^;66u! z`x^=FYb3azk>EZ?BDO3oJfDcQsBYXOxKELYHE6F>Yt$;WM0NKmiP#vqK+RKg)GRea z4XJ5ripu9CH^1R?x*caX+te-UCbdJ|psrKbsH@Z!YMZ)DZBdt~O=^Q$r`D)dYKb~d z9itYgd1{WDrDmuhHBC)XlT?wx=asfsY**N~!E+<$iNSNDyH2J!PYgbtf1%KMUXQwc}#&Jy+WegXhM<_grNlTvFQ_?%#-)(j8f4kRP+4;#s<&67X)|t@S z!+%LVf7;lP_fMR5@xb-~+wvm*E5xyw;qPfqn=xU2e?51>o=sz}Ix1Gg`+!T2a%z?{ z?)N?5D%qab>q27}=wbd|`of3Ai+pZ&TDHG>vftOY@fXvs-q)pA-D_?DF zJ@Ng1JATUcD#h;rKGfe2k1_xAzw_?CUyt80*`LVb`%Ct~{Z&>1V0V57zhhcwe>6qW zKO5vFa);a^Z<3eETjVx*o4i8aA+I{N!$>$F3fO-!ZxG2jTl$>~HsZ1(@frW64S`q5A~>Ie-!ZxVh}B(xaGtyL z@0ND`&fo7FzSHlIJ$SA>9e(`bQ@4L??4*?U|Jw20FWBoV?dmmxYfoMWzAx;)ac1HO z#@tnChM=MN#K=RU$#0Z@60cz&58)6mpGQK%It}AWV#y`Y0SL3yY*DTwPC9<#W_MBa! zT{dsF-QHvGj^k>|IP!bF7g0H+vws_*3Fh5_`BjGV(BELV0sT#e*PySuux;`0AdKq9 z^3bm`T!OCP6~f+t{!Ry#9=3%dg6#W#0z=3uG#7%flt( z{V-lQVlpn|T)<|Z5haW<7dsA>I)(^8480w%Ji;=+$zKy_Ap8kih>IubOXMU};#NE( zKDe*_S)jDj_BSpFiHh=K^Uy=k7jQv~?I>R2kmF9|Fv5079sdgLh=<5e+SI^HF34#4 zcm|LEG|R{HdEysQCaxP(Kv>2WtCKj(a0vSx!+C^XLii(iH4ttxyoRvc``+VK{?obp&ym7oe+)r*@*q;k@lanzhxfR*VE4+E}9|d zdE~bd@Zm4Qmd6Xn$XD=oKVBiizX#2`*T~nPVlTnIiiA=OWaI+$KD=;@_-hR{N3kdf13V>F5yS|{g2R(^K{AdU#9=(F5#E-9r{mR z!jCa=#eVu96@MUa#yvNwx{e|4y^Q+_i4?i+{dqu=18A@cce$VbkR9H*Q}cP73d3#&b*W)@7bc;DlX-}lMl6A%Bw ziQ=hGj-4nL&B9`>V$PQ9#mdaW+*D=WRGvp@-kdvj6!GQ#+|2ycnVHIDC|R7l>kcvF zy=$JHojDWAn|ZdfXr3=mpR1V3x!GEAV)h(T%umdf7bdDj=P1ve$r`*Jk+-ArcFa68 zT|P5!7Us^)Oq3TYlcrXlG|x;;S7yp*E8PITfc#mek6nOh~Aq=DK>9zj`ba&c zs}O^T^*U2Q|DT(i!x<~qrY4IEXQn1Ik}3Pd*Zo{=662=7?x;30IuzP^-9PqF@xDht ziKLet5cR1AgDm?_7HoT+tDehOr2pi=@6HYK+;v`TC&CdP$5}u}&d%(05;%s@5E-PA zW+TZhw}iLO&Y&mkDG@)$gdOsk6HlFTm-YiEAA9t~!Gqy>Gg@I8b5k>CPM>?GI9Hjk z%spSp+~NjD@2pi0;v`B@Hs6X(EW^f~6B#x3n%=9*y{q1Je>W$a$_|_P#hHoXGZmQ- zaA_3Flam?iJQN<0*t^D6rEgSK?3k+Dc6?##Y-N6-e707cnP+XD6?m_P zH#O<(GKQl$!cp|Y9H}wvk(k-IN+O0Y!{y@4E<5Jyi_*EvoPe`_+i?kWPdnN6?Lv9} zS;>AL)A7VYC|G3p)`L1b@k&=mVj0xfNSjT?UMI7Y60+%c*ReS>H;ZXzx>BCR zBy1fMbC{@S=4*4a^+khoI=4_fJv+M~XVcEo#!mCud+v7UuP*{>D%bV{k3D{(`1pzY z9?VEh(5}8ns9^Sn`I{H!T;vYofBW6^_PR*T-{t{iRL!q?UmUJgB5;W;@ z<%r*xV#BydZ8zZb8QXUfs7UBpgo+EYsu~x17FHPCd-k5A_hen=;N4ZEV#rh=E zDqNSoJvnx{`;%h^w}Jk41oe&HyBzCI8++Y%g}34s1#OcV)t@(6R-}rU0Zv!2HkBuf z=deCyZm|)%y=DpP6V{8F`GxTLSq$J?-5n2af~2jO==Zo?Vs7d_DcS?wh5Zs85b;Hm z$h~Conc2B#_vkX~x=f{T$Mi!gbm`2cI@YtRGS6Q+fvu?XMUzNAd!*>Oe1eH;Wm3-4 zL}h;7H@bLw;hEd#cY9=z$V55z_+uZ-?3sZ~)w|ajKc!yEH&LCMp2PsM6M=>BrI*5+ z{ao$rm%SmfQ%m>8z-HlAX^b9RnQo5nGiPPalnKR7nRFqZOTY!bFNM8w`xYV0L5$JA zILX?S+haO%i!_t%xnf6Fu3jM#BWfv~6|tcEWMxpX#e}$0b+?v?;kM&`^`Ofw8+37@ zfXm$=W-_?054v-~JD+>+#ZAw_@Fh3Qy~}l;?IrgZgl7U&XV?5@=LLB@x$FdY^5F+g zJo>~5a~Lt_&GghnWoBMB%(w?0x(8tM3KXyRKaJNmp5{LX#`Z+)*P#B{`52zuv0u~W zyRk=cIKn5eXCQk>KK{qR#J?*0Y8mI3boR)C#ecPluOhANXIXy0#Q#9zkE{4q z`X4p%H?iFjw46V90b4`Z-Uyb-OW4Z7{z9fYrLoN^qzX3Wzl*Y*SATb6bqj*Z_mrY@WZ zZ$tf2a2)?l6Vzmjq(uHh6D&x6wFt|3sDq_G-!bN8$q)GocMrBZ{sR*%iGRzbA3AJ; zSAPZ-2@Lx{4DviCOC6#j)$>r_j(GvNygY*LHTjkfB0S#tl@KvxSS`{ zfA};`ApOhT1m8mc3?Yv`KkGmI_f7Do_%q6%C4bEX-9-x@kN(9|=$~PuI7vQi;@9H*4QI$dYvO5KH^X_wg$PT2Rr0in-+=ZGHx)0D zUor7e@@M@=-g4X6!yEK_?nD^pcX%hl7!Sz8p1fZp zW8~AutRu6;IOETlcpab7BuWvM^lV@9WfOl%{5AT8#a}1?mWemS--xjI*&oRj6MtF! zOY{qizeWCri8qCpBP{i6lfPr)pSuRU5@BioD*1aRzJ&3SSc@>mb7I}`=v5~E3dUQ~ z^C=T=f%gf21s@^2YRm@C=e~^yW4_tfA^&4zzKzeA_H9NO<9**Y`QIAz7V_JlBLAf^ zZwqG}+xbz-lQjzCR1PV3-y+c`k&~RJ|MMo6lg|~Hk3_XcHsVLVCQtqo z6T9~|a3R7sfXBe7Yj^!AIX^t^sM7D(p9a~lKT9h9GW~x2*>L{u`on$;kj}0@Ta545 zAJoOxM;PsuU3lpaf5emYbNz{DoqwOSPx|$C#8m6gDX~d9t-57wW-`XlS_ zVEu8|)nNVk@mqgR$-G&{oXC$hWuDysl8NDCA~#QBPVTM`m^-8Mv0Z<}@7IUC8%Kd( zAI4Pt68(OCSaSaE`p_c7Zr6u4|YJ`uYTP3uU?mV^C_$k58;JFo)505nb@1MsmgtqEB?sD-p0PEzpw84 zxu4bb=iGHA`Pd`xxVz6kPWJo!)d*jO6g9AvkNu!OmHn~?{eEA6#c_9Ef0fLAeZ%Jm zq;$sy{oL2@elEa$efgWWvR^gi_w}W{!hT=BLH7Il%?M+kFx~>AzQZ@0Ah{3Rc6{Z2 z6I^i}crC)R?=SU3{3}0bf|R6}`gz7abG$>&o8VgUZ$?=BTjZxqkjB1g9Cfwng{6FH zkK{LFf*bJN_965_mt`M4B!AunAACkFm?mu@(3X4BWKljata}gGQp3Hso;X;I^eq&_rn-7mi7~^ZW zMCQJ^{~RMJjO%N-=KOx&e8e;N%}0g5g8uynCa7ZkjMgKJeg4sAfBvIO^#2nROk=Zm zwC#BGFY#ZPVtkFRIquFEDU4D1d{@p*1B&)1)}T1#+*$r#7HwY(kJ#_uyS7`d(%*vO z`}iZ@A#XZPB5yhDUhpEq8Z96&O1(UJjmQ*^Q%H}$XpXW|1!4-`|~ezNwhvP zmqhCW+T*}LmJcq}fi!3e^Z$|75 zZ^ho3wBP41ZQ~Kh=TNlA^4^Nt{Fk0x<`I9yf4^r>MCubv^z8e#d~B5arJh|rr|TW) zG<>$EkN6TS-Y#Jt@d^U8%jZD71NmUC*GF&+7TWvz?U#D?zJ7Z%Vs9YKBlt7|KK~VO zMZ4twhW5UG`;R?)U%&lc&)(N>pX%BB`t1un`>uY&XO#Mg{|YSLKGyTbf4*lAwtIFv z-lPrc2tEu0?S1_wdHVRZUZUV%MC^@-{l$oVC1S^%yGwa{U-N}>WKd`4Bjqn^d>RPz z2xNZn_DH|QF81tw{r0bW_P&1me9zw3Z;$lsef{?9J^QYHy9PdW1h}6vw2!X!oWVcp z*-f=)kI7ue__1Wq9{)zqJ`|lNzaFudBJpKhF&{f;(-l0>v&(&jKZ0j__TiGZ;y$A# zH_SbjkbK^34x#g}r`?Z-5b;k$>{G|O|6xi(@K zmLo)+Mv=dt53LclJm#N&1G}G>Xt(9cgMyz2e0)3Y|EzK z$UUlrJxg5KANTw;!g8&6o<>;aN6#-Id}D+^hp?Oz?|&6xS$92u72!K0yoRv!h4)K; zMR`;4c0b#0jKsIU%Z_rW;%61-6^|({DXuAQC|**$tXQshX)D_slj|kQaz3NHrC6^2 zh(AawPAm53g5?D{pdTvyyw+)~_DysCIzaYyl%;+=lB&yJDy52ckqqd2FypmIdVPH{o;xZpdTvyyw z+)~_DysCIzaYyl%;+=lppH!SyoKc)pTu?l&xT?6WxT(0MxUG0q@w(!U;w{BH{d`4I zaawUkaZYhT@wnou;=1Cd;+EpJ;#I}#iaUz86z}x&l}W{E#Tmsp#RbLVifiD=^UakF z#Y>8p6|X2>Q@o*gQ}K2`%TgDu&w-TUP;pjqUa_<{^1ODSs<^JWsko)Mt$0=Oy5f%F zEyX+id{t6$T5(2kPH{o;xZxw&yw-oR6^L0tZX~h}EImHFVx!F-TZ-F?R~4@-?kL_;ywlIuCl#j^ zXB6iY7Zi^xt}3o8ZYpjmZYy3@yso&TcuVn4KffobIITFNIH$OvcwBK+ab0m!aZ7Pq z@v7o=#T~_4ig)@som8AwoKc)pTu?l&xT?6WxT(0MxUG0q@w(!U;w{BH{rujf;8p?FjAc0a!l7|ri}DaE1Utm3@lF~udtHN_3Z zONy5juP9zqyrFng@peDUqgJ&2KbcY-D$Xj-D;`r^Qe0EqP`spgS@DYEHN_i>Hx+O9 z^9{gg`)^1o4i#q==M|4BE-9`lZYW+-ysUUd@tWcd#hZ$^`x#%Y>}&t~Q;I{yS;cw9 zV~R_PYl<6+mlQ86UQxWJcti1~;_ZHxNAc+SzflH6x4=KJ^@kzx`E1p*TGB~my zeB&#Me^;@59vzMUrs8ia{!?&df8oX-^z%(uD3tNl|Lanhd)r={kvb$ETw+#FD~y{edmrQvISixRmAWA&h%mYsk(*o zX>)jf@vK#zU*rEY*~$Cw&lPh9a<`K^og8y=#7VArgmIkSNj^qBLPfm0U0zNR&obg! zMLesBcbAKIr^uZ}E61E1adLO@2%S!mhh^kpHCMdDWntw`N5`BTfkb<*+ug_P2*2dW zv>kh_FIlfc_ed9wV7u^`ROzmwl{=l>;pCW;qfU-E$vQ!IFyT>2e@D^EQ72g^=niW| zms&-4SVebOMIJ{aF*NJ?#VO)jMtrM?pT!*T*KoxC9WseuI-}QSojv|%%5T4*Lz{#> z%Xej?M?MOX@K7%t`x?SOB)$DUNG}P#1mA<0e1Fq_uQ1=UOX!znU6&)oOXg_bPMUlpp^f?0b}dpaCC_c-~6y z&8HXN&3N0R{Lf^WB!o)&{(G4|J<1RMJM4RufAt!CI4;-z;J+fmUgeM3peEv5+{(H00@}Gcx zkMa*Q{bk$#7}D=m{uq36l<<=B<(^ZHX!(Bu-lP1FRBdb{-`DLse0ni{AFsX2Utub# zhm`NX2kg_QQ1qu@_vNdOejvy6{=5;p@r7ml?Ula31WQyezI;jgU3v44etn?h_&q_t z-S1nAHTEZX+oSz5H0)8ryR`p3miqf&u8BR$|An_){P0z#^AefA?VPe#`6Z?ok@DsL zACkkjU;6*!vlma=es5S;^zF40$&Xv_jMO*wpJ3Ge!+7WGE-)hJQPLcz!CSlM8u)e5`Zl@LkZLLVzb@mgY}wGG>90WOGL zu;P+1$z6kj+Q5qJK{9H?WE>hv)rPiH8WljOAsfN{VSUH7E7NoJP}frkWN> z)RxnDT>RmQ`n=~n2fTaXr!;tc++S8r`aO! zYE1JRTlS>2Cd~&Ba$$JL(!woKtCyUZ+%J6pEpfQ~RqJf7i5Ta`<~MvBY^|iSxt~=ZU4ZZIANOCbdP~psrKbs7>lBwLx8>)~UklxnDL+n=aEwME^au2a{jP3kJO zL0zHNsms(Fb&*=7R;VRvky@Z;scGsMHAPKQ6Vy00Mh&PV)FEn=YQ>K4t6?nW|>3kN)!dKjRS{@#= z0VN$t{~f3EHJ8r*epgRPM{0Pba)`e#$2iN8d%EQvT z=&wH4zUAQrS$a$SlU5h{Tt4ODl;iQ3)sOet=@0P(%jIF`KHldvH=MQZ3wA2g_}tcI80-k~v=wkC8c#52wkT--okgSB~;#!*C4xcE%dFBUAY$e>SR~0g}!C7E7w9_jqJ*`(6>l-gl3lqL z`YL2su7$o5*_CUduSjlKUFa*2SIAj%ot!2wlgG$4a*Di2PLiwS1i3DMn=Z^X!a_yP`nU3{7A<|VF|MFHCU7^;g%hVcmk?Q)jT&$2w)FQP&%~I3UF=~pMq$a3wYK$6CN2o*8 zDAiCoUlloz6^hYC9jbe$?N1A zd4s%6ZjtNcP4Wu4O>U6gbyM%YlGoM4S>EUI`nq>tX|Jn$_m%GX#M`~E^v_!^@wra! z@BJTs-k9ZmVV3uWS&rW<$8DDPg<0MgX4~%mD7#5*Q8%dT)HQ08x=L+OSEzOBGPOos zq*kdFYKdB;7N}WjnmR^JQIpgJHBOCD1L_EMh#I9Ds+;%9SvMb+vu>U&XE)qDm|dr? zQJd6ND(A~A=g}es6}dlnx&?xW7HHiNlj4W)EG6Oj!=iFQL2^R z^F})gTwBPe+z^*Ok=b>D$ zd-sKQ9_>AEaqTnWp5N?`9?a2<)ucL z8{{P`n1!Q!o_nC^_<0G1`Sd`6JY;o$#C9v{;`H*Ybv8G+*OAQlZI1nWP79w8ti%33 zmUo}aCwIWTcQk&ZD`#$a#D*J}m$qQWXScV*6HLE+$2>YwsEP_ZYjq zSJdr2d;firxBLCCM=p#{1s{9t^xYpBJ7rI-|Ia>t{V)5>2+P#I2JhzL`1kUHh%*tn z)^sa~u`5H+L3{3TwYTG(q3r^z5^vg!Hr=y05bvru8ctRhF5%`M(w>C=GVK-U zmuX*xzC^ne?yIm%TP9(Dnf5H~vcd#7DzN{)wV26oHU$2S{_8-H?A6cuhzxEP! zcKNh*_y8>SiUVnh3AZa>(YEa>?VQ9R?J8|q!6EG`<8&3rzrz7@{cZSQQo@nj<tIKK}upp<{Ne)ReMnG1XUPe8-@#h3^az_oMO(=9>6|D zdlL4Gu>Taag5!DGS7HA}*zbc%!oLdp1F$Ax{|fAKE>>V)f&B#RtFY5V65fWaIZuhp zp1&P(|0L|ci?}fUeDW#S_Wm$Dq`jq|{xK$4*zH`r40{r8VtxbmhoAwDI^C17{}$b| zu>TJ1NcbvA>-S-Q5Gv*s*kPhFFZ@dt=3(n)%)btW5htXxtf$f?{}ufor#~bj>wuVWUSr_f_qwwF zjP^ZE0|d6wQgPEHv7p}1%n-yU;?nb~<`Yu<6Ql$$S^ z!ua&WRDLVpOb%XoGhe(LMahj%P0fkLm5F}2yKR`mXNqSJ=gi=2e*VJjbijnHmkS<4 z`gfg>vV11~cMb(HbkafVG&ynbeuGqO4exdxdAMK(5g>RrKRXkAIEdeG2GJ9+A(zbg z@nU9bX6Bg-#Y}!Ge?E4=cb2r}q2Pc-LXv}%XM@;nh<4BnW-@0kOis;DPG`>N&(G!O zV{kqc#192?lh5X7&c^PLU=jyv3wZ>2vC5gr3GZQ>96nazh!GWF_^@2(@@W4Hv$N>2 zOmT7|GkwqXt&Ko4Tt+U{^ zTVHK?`GRck9QeDwL7F@I#Wo^5f)nTkG~~?mZk@m}jEcx04OJUa4jc&Xn3+aP*e(%& zj0rpBV<$gx+MU!7pL*i)lLrq5Wiyy(9o0-keCDet<2@KLMA>onn!`GHy0@-uco(LP|cW%gs5v*v#LjAZJLpyfP=C*Y7$ZmQJ^mZQIU|&pji_&tW3Y%?E-R+V421 zlM`QQ>QE?y5*w+C$=mZ}W+IPsYkVqG9GCOhoSU7&G&7YSpTHz+J#w>{sHf+Ovooay zgFc;|&zzZ=nU~(Qv$V0(eEhz9UH@$hfRf6&{qPe{p3FRX^1(-9QWDf_TObrLe&47W zbS2m&N~nx})VlBo5&4K2l(AEEy|Fz<7wS+Tb+$Pj$4P=JT`3>&_qkX*PEy+p=ssiH zPAqw`Jp)^2Ue;6NY|p?I4(>C4-_iTxu5j?(k)@=0D9FR>FcNU>;KL(<-NM6*;ort0 zvHeV!Z0w9mjxl$QG|8#(p@L)f`JJ|y2URd zHch{hz`b)R;nV0iAfas&O|H0L&kBFJVV4ag%&U*^iQ?Vt$wQ)g2d4M)n zrxIJ!kJMzx>||$$a6|d^ZUU=x_w`N&m4xyW{oI8!=dl{eBnq$Y7bBxrx*8cZxZLv> zA1H75N@cV&N$hr&72JUf64Xs*M&C=ah)5A}zMsisB^sZ|T)=7+J75EJn%WXpBdiY7 zbMwK)84TAu-1QAFd8DqG)_1u$VruHDDBJ>_WxPuRg#5x$Ylh1$NKCj%*E~zY(br0IEtjRON=cqA0b!BPe?E2@^f>((wQ^!XYZcd=_7+g zrp2)*pZG{@*92r@-npvy3ACGEt}r<@fdOPsdkevH&jq*nnc2Bt@$$zm8lB4kn}l0x zF?wW5x3l0j=eW#}GJS--5Y9#5D!na+J#)7$Ihb)6V*64gD^X&X$;U0pjJE6g99pNg zG6^}Nl+sus7c`%&11hvQA*>YLtsLTT*9pH?(910n^y0DrFLyZ@i{ZRJ==y?}FAqF` zE0=@8b8eV>FV}dsmE27a?f_7n9rK%=7vyH-iWA(a#~wcU_){m%VT7DBQ36}eODU-eVhy6ET{~a8+q7+hI&&R;B z_w^U>`yq~jZ}yuQ{UO%G@hSe-N?lj`?f$j!hrt7{_M0^PB|UEnu!w&O{*l-EO${pk zpM~yC8naCP1?Y9yv|52m_+Jo}Q6tR1*lHaKC1E@6Y;qu5gGK3$5 z{~k1cK$b`C1E(TJzS$xEKMRhWj@Z3I;bq~MBc_3Th5rbAGdcxb-Qj)UCRob*Cj9rJ zuu>1k%_TUKQRz{m9<~?|UO+q@5%^;X!bm?CX~#|9ALDS`jlwz76|WKQ`2FDk^-H z{B8IT-;8mrSkjgJ#Q$daH&y&K@(2Sm41^9@g8uB{13$cg?=*@;yvIr`Agzo z?KjyF?*SLczbXDN_M2je_kc^}Rrv2&ME{3)09+-n!T+W&^_#^I?*-S$e-8iQTEAHi z@eSZQc@X>1k(a;-C++jN@G=-{g0#;I;A__~4~F;}aD)77@c-ao%KNG|5b)Zveq=|@8^G6FC>4d zPXzUmd$S$${|jpV2lwWG*UoaC+?)S<_ZPkU3wJ)q{l{0EQ|6h8K&Ht#6 z?7i)n|G%l`e{gU9@6G>mUDMlNa{Eoa`TspU|6{(BXAqC_8d|QG)8MOL-I^CKfvV6;IU-x1w)5iDv>e!m>u} zA>IRSlRp9f58R5IAGDL?FMKmNAb$}Y3Gf_&{DioMI?Q@PyI;5ROvs2i-}uO5wjR#d9ES*@Dlz`@jn%@&o4ah0oUpODEyD4BW5MU zgWyJp-w$35@sER>Aszs)hgj0vAlrTIr_o+yyRV%^dvTw`?`!*gePP+x9-_bB*B%M6 z>}&gdf4{Ho_x*)sUpvn5eqTEgV%gVDlKsB6e@@`9JICnn_qEd@mVNCk+3#!n=L*8I zuU(|S-`6hUd4ilDeqXzY{b%WqGTQ$G1w8i(@r~drSi<}C7wP{`5Was3{YSR@*d_E2 z+0PepU3Cm&6x-`2i?)~f;tvF1r0<2>_Z+V$PYN7e##r&&fnNqhVDm$@y>GM9x}<}TseF*k^jxhm{0bCa;|?C1T( zHor&rD9=0Zmt#6jJUa=SZ_r(yp=s04R|>-JcpL|Fjadvk!k(wQJfqR3zw^f2md~io zcW_6${aqV>a7Vkn%J7w~B&_Z8bl2@>UqC^=Nz89y^BvsDn)7S0x zi*)baZt@1}cJqE4{wBL-hkbsV?uD=;>}^~An~YpDhs__`a^7Upm~X@8+jN(8KWv_* zyUf>N^Dy(3Yl^UWhVEH4kJV6)eW7_fYSVS^5Z;J4r^c8_Ks|}@;vQG-Ih)Q_;v-n! z#e9e1iw;ddm3Jm39dCwck>~Z|?m3|QAj-8bG*2d3&ObrD_J!s>pRfFC%f9gZ!0`VJ z>Fo=h?>_vrbq}2v3@`5??z3;kx`O!d>(+g1Jgl+3H*J08Eo5i7On2G~-fsQ1{o%eN zmxNo&1(&Zl*>?yRL!5-Y5#ono_v1&xKZ0X~>xys^$2!*^&wd;V%lhy8+57+B&Oe4c z#rXW2?{fYBU+15+wRiP@2=+>dr9am~Ed9B`^V;{1+%t&r{7qiJOE8JQ8e)n6T8NY2 z^$<({zY$_7&ksX<3VaBM7)f99#Mc(B5tc*3h!MM7_u}h=)(Fe0Fy+wt%e&prg;?Ij zelf(-H!p?wPS{@#vAnmu8e%DrZ!gJDcmszR&zlZAYy*Y-WquIj!v~7-wV-YONyTG| zvx*^G)n>j3|yNPAE<(PAe`bE-9`mt|_i7 zZYXXlURT^w+*a)8yH5Q%zk7};PAE<(PAe`bE-9`mt|_i7ZYXXlURT^w+*U02jbeO# zM-;~tClsd?`|A{OmZPBjONy(CYl`cN8;YBX*A=%Ew-w8tlo)ZAL-wG=c$Ph&tawH7s^T@p z8;Um-`~4j0PpLnD9@CC@S)XH3e87mma6)lPaaytL?TYd7ONy(CYl`cN8;YBX*A=%E zw-rZuz2wU`qBy2Fp*W>Dt+=3A_I$(bQB_=1Tvyys+*G`-xTUzQILhn)PW=_f6ekp? z6sHvz6qgiN71tEk6*m+&6|XC9DQ+v4?}CT>!{4|0_J}F}gyNLqwBmx|lH#i3n&P_R zhT^8;b;T{kZN<^Os{V>&iW7=cise~ExIGJsONy(CYl`cN8;YBX*A=%Ew-rZuMQjbkx3s$SnjuCiW7=c ziqnbxvtSn~K*Jw-mP(N9705!u_u}rZ}NEr8up)ptz*Cs<@`O zuDGGNsd!y+OL1Fqlv}Z#{#P6iaSZL0R6M3QtGKARqIgm9vf>rRtBThYZz$eW>|bn? z`bvF9_@bNeo#LiAp*W>Dt+=4Lq`0cMrns)Sp}47dU2#isTXB?I?7qGuierisic^Zy ziVKQMimQriitCCSikphp6}J?(6-W8#q*H&zF~teRDaC2U1;r)BRmC;Mb;S+EO~vbq zTZ-F?qx=!mPW=_f6ekp?6sHvz6qgiN71tEk6*m+&6|XC9DQ+u{j^HGR>C|6wOmRYS zN^x3oL2*fORdG#mU2#KkQ}Mdumg2VJsQhqkxc-XcAwG_9NyTG|vxvM`4^An5TJeRJ=Dp zC1Ct`OMUc-v7dSJsnZ|-#K#{0>Bml)!}Iylyg59ZpE~@|=|>L>Z2d;4|BYeyLr&q} zoZa?Ibz8qoCh6?><=icA|GQ(IU#W9Hb=Ec36@DPi{-RpfNRrjIpJChiLufAEZaYSw*;eT)5*R$1_$&og8s;Z{`R+ogxj(NW*F(bIc`S<+!6!Cr2RRmg_Y4s2$;5 zN2YDq(QVPT8g!R<;Q+P?N2N&jWUL%_a?Hu7lcP?KIEgz!b1>pjiGM6(<*1Xm6Euf) zMUz@Zb67=lSVbB~Br-Ja+QlitTSj=R2p@Md!Qbrjd-y&GzXGr=q3?ao;eS(}{Q5{I ztgsw>tlDu;c5K@%GH->=zd+9bIPLto&QsC>sJ4@yIjN{RsSattXuvG=AU)R7|CCT zl+OPLaO;+TE8!yg@5?&citqVDgGPOi4QghS{HBC)Xlhgz?PK{AR>KJu|8l?u*jx-nAYm>S`U8lCG zYt$BXmD;4PP#e@`YMr`Btx>DgGPOi4QghS{HBC)Xlhgz?PK{AR>KJu|8l@TuDkX9* zG!B=Bth1CWZ1GZxRdA8Z39+HmadqwcDiTUcVEw~*;)-Io~ zBKb0oS0ylv#QRMguKk`E+9%FI{xk2a{D*=+H|-$xmje7-+e|3WhH7Il@{q^?jK z)MaX&x=5{2tJE^JL@iQt)C@IEO;MB71T{{LQA6q&b%YwF2Gow}Pt>2fL0zY|scY00 zb(Pwru237)Won(eNUc$;)H1b1EmCvT3^h$nQIpgJHBOCDL+TiHgc_w9G2{CRSSv%! z=eI)Rk$>g}quuj$)SwA3^T#EuOJd~wxCTe%8Jn(Kukz2>2_rvrodgS>#S!Aj583iu z8VA7aMK2Vga^6V^B|WF_hu!5P<&YX)n!^XoHP>3b^m(h2j?7<@j+8{w`3)QkpSR~} zWi)L9N;;DMJ5J||Hl0I*ww{uX)bMiU5Pw&Wah4;`>jjA)O8o2b0kc~@Tsd7j3twhA z_8v6xBpoS{3-`{;WBW(a*^hKCS01U4%g2>xt6uEaFPLJP>z&=^VPq8?3VzoFTo8b% zj7smKzXojkRz?$K=`Hb38eJH$`BX+zmd9g8pBOOHAL56GE2GwZe86gcG-uow25df+ z(K6ZQQyHz2lSV6}HFAo)NKTXMXb z0yc{ALbmHJ#uqt9f3BOOb{)p}q<@ zE!V<8m2AtkFiMjY;=6w zu4`NKMbwPf{HS$*yVsF!{gU-YjLe5G;?UQ{m$+`e%Js7HoV^}i$d5?0ZS%g&m;U-y zg8xF%mT%!pHeUX@cXr*mP1V+3{2Z< zHmMubb!wZsMr~17sZHt%wLx8`)~SnB+pm>Um0YHls6}dynxUqtDQc3MpvI{&YDgWU zj!>i2fXex*#Cfc=f!4(OR9dHUJ}j+~Thvu*le$7}P?xE7>LRs9ty0U>617OpQ8Uyu zHAPKQ6Vy00Mh&TB)DdcwY6SPw>rI`^c{rgIDe)R7vIUn`! zD|_Fc_U|jreRTi6lI!(o-OL*c13Yg=m&rM!mC**dNM0eA$W3yYyh^T;TjUyfjl4*1 zlk4Pl@-lgY+#qj~SI8Z5lWeb>`uCN*t{%*W9D|KaD2Io=oMcwd;~_|0+L=6GM2<9%VSWABf0o74^JI<-w*qqeB4)FyR>+Mq5| z>(oVRjasFasU>QWnxkf@X=;j^q$a3wYK$6E$EYLJC^ewkd9RYQ^I;`t=gCTL-Ohu# zHg%2KqOMXoU*dgMDz!{4QH#_ZHA78PQ`96iL5)*m)Q~zx9ic|4 zM*7bi%_y*KA)j(T+<)GPeUbk2Mms+&ah_P}m_gFNFXVjGzc1|H7vhZQ_58E{yiuNq za=q@~7n*sr|Gbgc+x_Q_91pziA6+H$`hT=Z=6%5E3OQ#K`zYiLd6}Fh*U2gJA~{K} zkrU)9IZiGceYc-C_U{XAzf^LzKPoxf50zZW_Dilv%~3N{_Ir-~ont@e*uOdUYc9s{ zA$5#8LXA=bDzEqY_l4%VxBtAbe_tpAp?_b zEZ_f^=N13^?`7R=(sA!)9U3@d(|y;!5BHvKeZ;c$p4Iinz5kvS?}L|$Y!BWCFY!Kj ziTA-vDf;t1c!~GHOS}(WiqW6T5-!_iu@-#z|< zdLv+utj;tbe-&!}wLwKBSD z6z^@2TjUyfjl4*1lk4Pl@-lgY+#qj~SI8Z5lWYf0|NCJ5?}N#JsEn?giR7p4JtOxX zW3Ts$dc9}wzAy52zyI~X#qp`|!w;Rk^+V}1=EVB{?BjEPJ`jwtOr5=WHy6i` zko1x`Zo&a`HHzlSA{?=A_=|OWx=7ENh+VY|Zp)i>5|4;f_qYiXMCBdn+i90F-EHkV z>Lkltis9rHXLfE>R?Ek%yLm%4Y3*{&uqT9F>c~rNQ^za8NgM?nSK+AQn8a}a$108) z957cO!iQgG*Jp6vRxg(}+#~P72hFxH=0#-d5s|m)p2LB7d*Wy~SzWk<2Y-+DB=mP_ zuR=df`zrKh+NE$`fL+=$3HvLw=U|r=Cd5&N{hvBJGW;g&Fj492Zy9S4{aNU@t=;_E zOVrxs)70U8u$U_jq$S30SH7Zc+Ev;)i9^~|+Omp6+EvEsDvm$H0dw_@_+V1Pkq^kH zHQUg`Ta*5_UaEp{rqA~1F|i@aLYX+br$32?fO~r{&^fp9C{2L zf!ivMzrX==wVX$O-nW4N5(nzGCkd51f@4rIH^44^A?JYHA&Onb+$q>GOo9-{L$Kcp zP2xBMyPQK+93O!l#=Pk*@pEM9%OuL^@KZDh@Gz{_h7#ZDhYoM_IqGW!v1C0_?2R`PkMEvIe{^jfL~|aeN?t@CNt_+yaWDoI_%yzj#X;gs}e{4lyB)!(xF6aoj8x zm=MQ*K{^9W=d3uwNPaTrU~Df;PR|F~?7fdYcJIfsk3aOQr?Y22mOh=$2J;K0LU3Wc zoGnbx&rTNRg2FSf%>@@vo8z@!55rnwdTy%17{YVIg>C zeClE$n3$a@W%Dx^5o0btJ3gN;X06Bg?D;ruF3%sAj}!87GI(lg{QO)nKYMXHKR#cW z2ukAOYUJ4NP+!RuppB>K^vZhAa+3{zy za|?4)&%$hwpSf^hW;$zXPrEG!p)^}4Tqw=64$g6MBETOCjrMV^GFP0Loexa?yKaW^ z^W~s8K0Ps2*vdDXhgTt(FWriw(t z8$5>eZ#gAp`FQ--j)pOG)e++~IdSCf0I8T7-fFw^STPtzfbhA(>`eHJVf^l382teo za>-s8FJ-4@W}d!S$`+;y7h;E9mq}Y54G&8sBso0!R2aJv(T)Ve+3dNClT-7P)7cA! z3v-3}7@UuW@uT6~-g*=YDSmo^Gg!3>>4j-d%#JCDEh*+-k1+@Rg z*;({hwlq1Boj*T05tBsOCa&xkOA{D3+slq(BcY?ADc61J2ebD+@-am1IUvfD^8u3F z)>&}dt*^GcTtT*X4*YH3Ak7{9Vj2-1;VJY28ggcOw@%;~Mnz^MnH zGobqd({^Ghi0x_Evh%X42G;g8T;X6p<9D67D{c!1-yK;>nn%L|ypACO+YT-~64)&~ zycqs%EE3z#bjildIA+q1BL}!xyB(%juVg83uE)EsCp=dUez`dCTu&mbotJJoWflxf zDAFx%5ix1Hl?3kH3ksJ;*8vG_n`rW-1#?!oiw?7FAYopE_$P{UGbhVs6FH$$0dsMb zGBfEDCY^4zwk9O0+m89l%ol#sxfO5%>vr!IP==X=a#R1@#d8<1KFPESuilp@Cogw> zax%bWpt~GFdHrjblig`!x9hI(CS0PRZZcQ8ev@TIiijEDTmfs-_(b+1)~DEE6QJ8_ zhOjWYbem&+xlrmmCx7U(YQJsQCC^P|YMWcI0<*{64D zGUIibLg9+(Clsi6;!+&rv!gK2^p0Q(YW@5ulFlwMw!B<~e6cVgy_7G^&ACcv&&@w| z>)cKs86+}MrXPFsL$O^Gkg0m-I^(9)UVi!Fweh_BD0Ki zFAPi)cJamNkxAani`$&zGH1$!;(H;Sjlgw#TMTpNZd-&f2QkF<#Yxtt#4gj3U8EUp z*A?4axwbO#98pSXEYAhaCo6*rElvn4MYn5-INWl|tseBU%Lcu;P{7MxAjV=iuaDTi z;04V+_uyLQNcg-R=FZDDo@pg}8-#lT6lcf$X66OCJ-O@zcjlq{Pe1bb>EIYb&IMDG z`NH&^?3u|Pcqn(kFrVV_IyOd2*m!#hn>upO{X4jE#-A}K@p+fs2QqvoK9AWw3d5)I zd8^$sF#I8Wj(hwN_!}NS4E~|V9|qrO_X%JNf=6+D)Z@p%a{n)7GMfUh{{iex95!o~{{g9MbI|N-3*Rr{zdjgb;4kSpQ-nqQAAx`5 zwZWhc75`_U`;$SiOkRXuh0UxLsD%H0@qc|VXnH&ZZh`&u*XaKp=#f&ZKyQz_RAyR z)DZp<{P!gzK}ar3_y;0Eocu{}y7U1n*l3f(^#M2YlsfBE@&9fl7$bj6xQ+Ue{~h??>yaSl@h~_}cJ)h={~N+b)+0fh{PWn~`q}7UP*ve; zam?c@ z;h!Q;A^h+SgF#VoiTo)^9~;+o^6TLJ*r;An-1K-K{M#N&_;vDroJjj)IPVn82D_AB z{P)3s1T5p_4si4}{O&LL9C)aO@2@cYH26SyFi3j551b;uDE`k625FD?fivXKh<|l3 z$a%aETqLiE|BHh`$>V+CGWlEZ-&aHbdprb|J$R|l_uzl+OM}6p$NRx`@(C1c{%(D#lHK~U2$uAmS%yWzyY)rZ z1Mzq33#JCcm_p6^vH_LwZhhJGSk{*Se}4K=&QorEiPK-|6G44s?cTAzoK@=!*tKha zeL=hR*O&hK;;kqB_2s8*eZhPu_b~R+q@7Qn2OpWT^PoTfhnT9 z{qV!*=wSRwM*Teq(g&iO6ex!eYVcSFQH~!k)UtqqIJ*pk^|I0sR^FQh% zdv81D|F5d~AKah+`}4nC_w@Id?0!>!f61N?vfuPmx4(q>PM$$Lh--5(a=lyvU-8=3 zy!fZ!tKQg}7oGnY!#n>3Sk4<~lCTK7efA95?X$c6BVpNRFTr2(|32~?`oTa@W%xJY zFZ=2%WVf%5t!$IN+gERqA;zrXQ}TEF>KkOYuihcMeRa1F@2-2X6=~wT>t1Xvc3Jk- zu@z{_Yxd2fk)T1o5?{VNwBPQ-OMQg*gIo0fAo$=&q`MCHkjhM|W%Li(%@=ZACC~Vm_!r4#uzVl>d*oH} z5b7#M_Ilrqd}L4I-N;9-UEhs-WGz5<2FvItX>Zs5GPn6GbD7UFcM0EvxkHT1RldK> zO~R|}-zfX{GYlVBoK)kXOm_WW1N;47C%gW4H49qlHMsj+GX)vY9q?Gtp@?Pgv~LHH!*H{bkwrmx%W59zMk?c+>e zx7+9F-n-o}i74~iCjBeTGdSPtSLiN#o7xPTw?4MJ-fY5MwWHnACY`HxwA(*p`0Dm# zg6HV2+ii&My4~cv61ZwK^R}PVm*}qB?Qy1~+wIeI@7-?hTQXZYykOG5W=Fd{MEBn9 zc3>+3+TL&SJ+PzQ?lb8e*wJoZWB95{X^!r?-QF_e?7)uk_Ai;f9&eweyKc9KnZ9nf zzfbqx?Iv%wZa42W;jcAow(s*tbT9gjuy;)PuMO<4jBI&+%arrlAcOhVH{YPUtoy!s zj_xvF`$nE2;40T#Q~2&r(>WM7K4x~?@vlP&Wz9^&+EnAaY*-JlW7ZbLg>M`8t?{siYc?@*op%8LCD<7*)7|!hw^@JJ zOn=z#&?VuPVg&KO567a%N!Xhn-w(SRKN9`{9AjKpgp)YhTz?$9aVRY7zw2k`|9?CG z81fY3@^8J%_5XjJf6~<6)?fO!>aq0an#apZVr|HwUq7{_1b^}7U<_^TdE{O@?2 z1h+kw{(r+`DbJf8p8+4mAx6@dJn^+fV}#|9Fk-|m*S+}qpfSR-Doj~4{_@WE^B&7P z+An!5ee<%%H^csl$MQb&s>f0u*ItsJ@H!4LjyElK*#z?ZWquIj!iS3Eij#`digSuf zimQqj6)!7pdMssZDQ+v?P;A#3TR({(<@qLdImQ&n6ekp?6lW9{6_*v)6xS6u6gL&O z6t@*`DDEhB^If<8oZlVC6ekp?6lW9{6_*v)6xS6u6gL&O6t@*`DDEhh`$jRYzGI4G ziW7=cirsaJILlE~{$<5A#dXCE#ZAR6#cjnKiaUyBPfCn9%OQJEVjRn!lh3lpg%o-9LIS5;5eZ;r8uLwsJN`S zrns)Sp}47d&0|?_))j9m4!reD!jC8p6~`4P6{i*F6w98V7->Jruc~-a@v`C-#jA?f z6t64ZRBXQd@0Eu?n`z1?>vJrM4;U%0a6)lPaYk`baanOqab0mkaZ_li+D3tduLvd4a zOL1HAhT@Lm=zdjy#WBSR#VN%Z#YM$s#Wlrs#SO(x#Vy5c#T$w{ile;ocKto3IPS6B zpUAU9F%n)ltvIK+q`0bhQSq|k6~(KH*A%ZS-c)QB9k2XjvIvpoeoLM$ijn#WClsd? zXA~C|mlf9(*A+JuHx;)Ow-s+F?kF}tROi)ij9WRbzA?oK#VN%Z#YM$s#Wlrs#SO(x z#Vy5c#T$w{ilZZ_ykCFCF~teRDa9GZMa5;sHN|zs4aH5xEyZoc8;U!Mquh#i{XM2Q zrZ}NEr8uLwsJN`Srns)Sp}48IrMRtlLvcrORDKxE?|;QH#R?itCCSikpgCirb1e z6n7Ly`QxVD`YVnpPAE<(&L}P_E-S7nt}AXRZYpjmZY$nU+)*4I!$}U)t-s=!;)LRq z;*8>=; zRlKHnUGb*kfInU={VnwwQ5-6cD^4m-E6yn{DXuDBRJ^QsMe(ZQHO1?SHx-+kGWNHr zzucsG94d}0PAX0-&M7V_t}0$sysUUd@v7oA#p{YU72}6Yw$*n;ai}=1IH@?TIH$Oz zxT<(j@v`C-#jA?f6t64ZR2=X}pS$BC>qd;rud4WEk0s12iodS- zJBnXd`~$^%lA-L@okD9P<&SLl*eLyUhzwcUsn8z;;$?IuE%mc`i9~k zE8Zht2!WCMO8Dy(e?aj)9?N`iM)8x1rxZW0_$9?JD}F`s*A;(9@#~6zp!iM2`$JR$ z#*Mes!;hvv^4Q~NpZMs9ANl2n&IHHi3+4IX*lc0y*nMXoJSMR9tD)|$GX2#XMgIfXROQoK$`hQwVshAt8G8Sw)2P3Y`oomCT&Lv zch76r&!Lg~SXD-N3sLtXCn!CSy-u_^Gz} z@pHkkxrGZx*}sANX|6N(-IvHF0?3_KZntvM%5f`+>~V&%dOP_f^*9yb?zCxHML5F< zXB6R#BHSG|-0dQ_XN{b+a@@+D+2i!IiZl!(4Wo(dZ8ixbw_7@CNh#7DStGYwxy{N+D<`ZRw-UF4=3vAV692ZWkrP(pR?r;A z6-{as&0!SHVH9Z`m&nk#Z5OKuZy4c?B7EG=1b?;9e}nIX@GAh@68hm6E&he_GT& zF!)=$NMc9(<+yL{zQ4$1y73*~ zi1@wokH26;gbXP8%cEbN|9{2zUwY-g%zeY3RR8~s_`UK^Gyj~Izl78I--OJ2<=^CW zogSPnK9da&BXY0&S9;W6y3)mW{r?TP^~|5^?oX=!A0vLR{MUNaUmnHi{C|6w{MT-R zhZv4S3tRCWe-f5n`Nx0Lh6ou@no}MH==>jtTd(@B-C`sDr20RKV7>BBGyj}TCXoDP zNa_6l5^lZn-$>Yq?)$Qqw&FYf5iGs(Ut#`f29*3|YgFg|abzy}t7Z3MU3Xp9{{V+b*LTZOe$Ltx{Jx9CJB7pL&uyaMe*p?3xjX;> diff --git a/internal/ebpf/consumer.go b/internal/ebpf/consumer.go index 1c5e57168..ea5ea037b 100644 --- a/internal/ebpf/consumer.go +++ b/internal/ebpf/consumer.go @@ -67,12 +67,14 @@ func applyProcessState(psnap ps.Snapshotter, evt *event.Event) { ok, existing := psnap.Find(evt.PID) if ok && existing != nil { evt.PS = existing - existing.AddMmap(pstypes.Mmap{ - BaseAddress: va.Address(evt.GetParamAsUint64(params.MemBaseAddress)), - Size: evt.GetParamAsUint64(params.MemRegionSize), - Protection: evt.GetParamAsUint32(params.MemProtect), - Type: mmapKind(evt.GetParamAsUint64(params.MmapFlags)), - }) + if retainMmap(evt) { + existing.AddMmap(pstypes.Mmap{ + BaseAddress: va.Address(evt.GetParamAsUint64(params.MemBaseAddress)), + Size: evt.GetParamAsUint64(params.MemRegionSize), + Protection: evt.GetParamAsUint32(params.MemProtect), + Type: mmapKind(evt.GetParamAsUint64(params.MmapFlags)), + }) + } } case evt.Type == event.Exit: ok, existing := psnap.Find(evt.PID) @@ -190,6 +192,21 @@ func mmapKind(flags uint64) string { return "file" } +// retainMmap reports whether the mapping should be stored on process state. +// Anonymous mappings are frequent (heap, stacks, JIT) and we do not yet +// hook munmap, so keeping them would grow without bound. File-backed +// mappings are the useful set (shared objects, mapped files). +func retainMmap(evt *event.Event) bool { + if mmapKind(evt.GetParamAsUint64(params.MmapFlags)) != "file" { + return false + } + fd, err := evt.Params.GetInt64(params.FD) + if err != nil { + return false + } + return fd >= 0 +} + func enrichEvent(evt *event.Event) { if evt == nil { return diff --git a/internal/ebpf/ctl_bpfeb.go b/internal/ebpf/ctl_bpfeb.go index 7771745ab..c41298b34 100644 --- a/internal/ebpf/ctl_bpfeb.go +++ b/internal/ebpf/ctl_bpfeb.go @@ -23,7 +23,7 @@ type ctlScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadCtl returns the embedded CollectionSpec for ctl. @@ -68,16 +68,7 @@ type ctlSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type ctlProgramSpecs struct { - HandleSysEnterKill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_kill"` - HandleSysEnterPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_enter_prctl"` - HandleSysEnterPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_enter_ptrace"` - HandleSysEnterTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tgkill"` - HandleSysEnterTkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tkill"` - HandleSysExitKill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_kill"` - HandleSysExitPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_exit_prctl"` - HandleSysExitPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_exit_ptrace"` - HandleSysExitTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tgkill"` - HandleSysExitTkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tkill"` + HandleSysExit *ebpf.ProgramSpec `ebpf:"handle_sys_exit"` } // ctlMapSpecs contains maps before they are loaded into the kernel. @@ -144,30 +135,12 @@ type ctlVariables struct { // // It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. type ctlPrograms struct { - HandleSysEnterKill *ebpf.Program `ebpf:"handle_sys_enter_kill"` - HandleSysEnterPrctl *ebpf.Program `ebpf:"handle_sys_enter_prctl"` - HandleSysEnterPtrace *ebpf.Program `ebpf:"handle_sys_enter_ptrace"` - HandleSysEnterTgkill *ebpf.Program `ebpf:"handle_sys_enter_tgkill"` - HandleSysEnterTkill *ebpf.Program `ebpf:"handle_sys_enter_tkill"` - HandleSysExitKill *ebpf.Program `ebpf:"handle_sys_exit_kill"` - HandleSysExitPrctl *ebpf.Program `ebpf:"handle_sys_exit_prctl"` - HandleSysExitPtrace *ebpf.Program `ebpf:"handle_sys_exit_ptrace"` - HandleSysExitTgkill *ebpf.Program `ebpf:"handle_sys_exit_tgkill"` - HandleSysExitTkill *ebpf.Program `ebpf:"handle_sys_exit_tkill"` + HandleSysExit *ebpf.Program `ebpf:"handle_sys_exit"` } func (p *ctlPrograms) Close() error { return _CtlClose( - p.HandleSysEnterKill, - p.HandleSysEnterPrctl, - p.HandleSysEnterPtrace, - p.HandleSysEnterTgkill, - p.HandleSysEnterTkill, - p.HandleSysExitKill, - p.HandleSysExitPrctl, - p.HandleSysExitPtrace, - p.HandleSysExitTgkill, - p.HandleSysExitTkill, + p.HandleSysExit, ) } diff --git a/internal/ebpf/ctl_bpfeb.o b/internal/ebpf/ctl_bpfeb.o index d6052ea8643f8f168329f571194e3a8d8027ffc2..effa49e8736e42cdea0645b66000cf9549fadd43 100644 GIT binary patch literal 22144 zcmeI3eT-aJdB)Ft?XJDf?l{>cvnG@q2w@zY&G;i>ae_Mu7&es)gA>qFL1)Ih*hY_F{t=fN|@*!P~T7RYWtyoDP3>l)2{zl@{{$GFR8ze z{(tW3w)poGwqr&)kAD2us^|Ob&DTd=fAr^;+0W5`yBfv}25z2HZau^$d$4}w{l@&R zWF$=F`=XfN*Fru6eGl||@2^Mx1A2+=-|#&5#`g;I`wHXRa|7eEL&f<17UTH8kCz); z@9V`)NBq3j`ula~dKf=n{`%V3@#pfZXlJOmKD_>})xYo0`{Az_`ZIC^>tlBWtk37g z-=8whk~ch#{_E&Q;_No@ALIBf(IZEZ zy4n%_Dg2Us>PGx}OzOd}TSY^D<%Hpv-N$d-FSA?PxqJ&9YO;ZDEikhSjQAN;i?0<}fm zq&BJNs152_YMr`Htxy-J1?mhnN1di-sZ-PpHBAkuDQc2BL>0mK%@t~wx=rm+FH^Uu zm#A&(1!{}BNo`WkQ5)2=)H-#YTA?mb3)C5Ejyg@vQm3dHYML5QQ`97Nh$><}Za+=p zOu@K*=8bI+-#go4I#V>ZU2vBih|VsU@cr7JS>EqpKC@zndOxOx+0V$uiV(gJZ+ALx zy)wZ^Tz+uT?yknX_g9^r^+wMuxckuAc@r1QY{86)endWu31$n%j`QMcEE~BW#j)V_ zW0Pb%Uf<~b;PsffXm?ffli%0+@8zP&Nk?oa`KsGF>h|67Oy7NW+<*UH<9j>K@jO|i zADDkTV*h(mN$fm)!>P;=C2YL+@h%}~?SfSRHvsY6r|jGz0`yy=p+sU7NN>K649wN1T1 zZBaL=P3k#ngL;-)r>;{g)CFpRIz!D-r>R-$6g5LlQv+&>nxqa*D5q70B$Go#*+Vz5UAG=W$(!{JwSr z`=|XrVLN+XVgHQ#e*FF!+J|ji`|lxs|M+#*=M~twFN^hM?)&E1{zC75Z(GXYxzzR(y8pZ0zEx8D)-5;h_hc5Y{e0-} zYc_u7?)QHDE%7^He*BlB?_4V`2EX{|^TrH3?#{u_OJ-C) zjEUil*iy#Cp@Gj7#UaJyornA#C*jK>9pLnB3`klU;$iEstW*}3Z>kBLKKtj8#$&$8 z;=E@BA2lm~KO#b!qF` z=aGiHku3B%rVG#(&H(v!=%2gvE=m6d=S=3I&GhS${yOJR#Ab)a@H*tdT~`7L{FAnA z?A#8OL)w#h&f=7LmAS0rlzEjnZR7kK&g-2>+r~H_cY$9nUTh4j{@y5Maa?a5eShC! ze{VwhaDQoOAT&O4!;i_wnv7X8eZG#NH^ZF8sbgqA^4d7J*|+?aHr%&;rbN(5p7h(r zc>w2sVA)Ixjzs7VM>2Dx?80|w6@^`HJkA_E<9r0U^ zV@_m0OMF{4ZF`iLYbKw6_~gllKbU{)(O){AfBb{FgVi!00Xfqa-JN*m^>;^JD#%vDz^`Pr2< z)L5OZ7HhK$d1okA=Q9Q$2j%0Cd>l5X7mM?&rdC~Bo-Ni&bEZ<9GpEaorRCyM$rRVt z&DxaoIknT}>_V~X8}^!CC>1LPl};_9joI3|Stu^gEtc}D8>{)!dbwt5mHesN>HB&- zd*5traq?8<^yI9;*n&rL@5<*+zW3c}Rq;Tu3g>2PL8X?jmgZN3d*t(g9dl4E)%KfR z<PRZSGSjbclW=wU;%&nW%vY9KJm1=oDU&LViblNG)9KGMbkCmmRmF4@~)K4y$ zU1)W!x@d56+m((IeNbI9EoU%+bTw zEwt(i9lCCzxpmu8=DLM2e(`Z-Ie2@3InFN?EBVEhl_%CJ`O;!(DSbDW>OgR}#GsVr zs8QwayMudHmc`wJy=++?JsH(0sb^@93}z8m52=jHkinoKOg1h_WFg^laAC|A7Z>y8IpppD`^EGk zTPC*G;9=L`VV7YqW8_#x7B-2%HYKYs-p#I6tJquemGWG^Hea6ezSeB1G^Trhd5*oo zjHd8$>{xL45L;U-&$)cvA`JOZgXjR2WwMaz8bk?X**;t=F55N7c70d6b-6kbG4~#m zL~lvR`(?sw#nmUIdF~T}d8Y5#ubUIA3_VoJz+)rM8ri6@an6-YwNzZpSBf%YX1=k^G4nh&9# z$b-ht1=i5m36w-hQcob2ugMpZaj7SeiwyUfIeO?QHZW-n)|dDoZ5{|pFioNXxPXn* zmq!EFDi0IO?~-Nr+s^9Rsim^Jq|wxgN8fS$J&zqXlh_hh&0=}Bw7e=ek9-~s+!wa} z8#e9{leisBA}b;i9aLtw-k3&`EAD-OT3Bl^8Q`=?=haM zEFU!SKNEY}F?%zSjIz_;s4rho5u4T z$KD@#(h2($qyN7D80X*Dj|FU>>lIV}#&WcC{$mBlz4{Bv-cWpw%=L+Fs`@Qu=lG(& zd`FevX8Es}`14qAd#Ol#c@Fx^$I~p&`HW}DoX>bgm0x%4=QB?Kd#wDAd;d8<@k?yq zGyV1R74Once-cAv`jg=LM1|$if#ZojZ{jcF`c7n6{s$&{PPpJWmNwC6g%`+&P4ppQ zj>q?(sMG$iiB97&EWz=`swR3u%5SoL-@hN9@4rpE@1Nu8^?#+m{{fEA_dk&A?|&do zX8!|IY@huPWXbG*V1~^82hOrS$3M^@bNmBM$G!eJz8J?p&}Mnx|CVDv{{xrFzJHE4 z%Kirf)@T2Nemv}dkmK?F4`x}O{SR_He*Om+X#bdrK92o(aGl&V(dWRs*njNnCfdS2 zwd)G)!gvOkCu_O>V=tIQ8nAna{68jfmvG8)d<3C|{cbn?jRz)iM-n_m``b+-CFSXF z{5=Rg;c43QCUFGs)^_K}-abRdd|nd!0{NVYUdHvhd!77c6a5zAdv{&g8|1c$epBq{ zl)Xv*u8GR^zk8GXqKS5dTaFXAndm>ud|U{z*xQa{oX_1`w7jBe z!!5-ZLM-iFCjX&{-G%WEU+HJL#gOtQ#Fw$gu z-!O>-h>sEa=i_gr&H9YLkuAqQ{zkURjK2~38)y6>1gyVt#@px+nejE6A~U{5(`3fi zXhzwyWX9L%w6f>OjIYrdGUIEs;Mm94=t77w-=h`BKE6ilv@^a&8)U}UXj_%PL_6ba z^s?ekh!J1Oq5k^Gq+=gna$jlJoAH)RlNn#hX)@z0Sx~$XV#HVSESd3@+*I5mGrp4a zfADq_JAmLzcAdS)S3->V*_#S6%I~HBgYP!6jPMlgp0gpA`W(;TlP2*HuIIfn9?VlD zaQDl5E3Uj>pWC*{+)r<#e>VOR@3+xEAJ1sY&S#AAJT~Om$MYEak@@!f=~#x$cpjtw z{`wiq($4rEqyIg7j&{cTSb@xVALDr9jQ6p1Wj{-1ypJ`M{T!L`KGq~N-p4i_`*IJ6*A-fHEMjRy0iQJG<7z_h_4j=@#~#B$M(3NrnnwH z{!;YM$6u=L%KP|BalU>0rM78j{H5r>-%nHYKhF4?p#QkljB_6+Te zuZbzLub(9|z9y#0jIW8DV;^4=Ga*KNO%xpa_?oED&iIi87?Cx_;O<0#hD9#_csI*eq=C&}B6ef?-aJL^X=x8e4qEbrToWmul=$JWVg zKh`FnhvJB1Zo=)w&pM8>{_ZXqe>+P20E%OH3LjwK-*BDG_J-Sz{d|lz9sByD;%}&a zQv4NW{ba?lub-6pL!X0tp*XAvKkRsn?fLfcEB?Or$Jfbhe_Yx_f4=>RhGSoU;&Ole zeF2&E_Z1xb`k?C^F=O!WCC6VOhxvO8JJyH}&_CVD zmuI=&@pn7wr?%c_jdtHA-WDV*6 zV8Q2NZLmH*U+xwB5!t_!FMGT{BJwvz-_E+vMLXEreZGxLZ~E(EY{?eb0~%<_&T{9Bhq z9c(vpD2_xM9}_s)zPytN+vOcYpI!V3)gO@lLiGo;$}a7RJ&qH{z#aII`kuvq$@6>! z>DPrgi?od2+r^*P?y&t0f%s0l$s!%*oZ^DwisHKBhT^8;mg2VJEyW$h-F~*q5b|H% z8HdLc2^41(XBFoZ7Zg_%*A+JuHx;)Ow-s+G?kMi|vs|*_@ya{qJ`NOT6lWFZ6c-d% z6xS6u6gL&O6t@*`Defrl_OsoVLhBz(Dtn+fqd2QLr?{ZFqPVWOp}48IrMRtlOL0eW zx1a5092$Q-sqBH`jN+`~oZ^DwisHKBhT^8;mg2VJEyW$h-F~)T8=>(hlFA+^&M3|* z&M7V^t|+c6ZYXXlZYgdn-csCA-0f%k^&1+${XPnFpvq?yXBFoZ7Zg_%*A+JuHx;)O zw-s+G?kMi|v;75AXuN|-We*f*6lWFZ6c-d%6xS6u6gL&O6t@*`Defrl_VW-hyx$Kc z6$gqlinEGyiVKP>itCCSikpgCirb2}6n7MN`x%e>!42RZxB&qCy;*8>~;+*1w;)>$B;)dd;;+EpJ;w{A;#od0Ezww3F ze>AB$P@GYmRh&~?P+U=5SKLtCRNPYBR=lOSqqy78Nnm*V@;AIb4isk;pHTcE#fyrc zR{V_OXB9uE_^XP)srY%tFDQPopZD%je23x#iXT#ZLh*+bFDiao@iU5_Rs5XduPXkg z;^!5=p!mgpzIBh{I}{&K{E+86-}J`2?tb$d%w(;!UNe)`(&FSJkH2eDVCVPBFZq?c zl+(YI=l=FC-Gz0TJe;bT-{i*N?&?E zg*@@dBbof$jFrRGL)3%RBU8@)RwqZOhpC6C2fh6Pmb;(LQV&rNQjf6MVHTqvq8{{m z2-EsgAHR+k)O%Ln=KFr=Qjte}4psJke@NQ1e=qB8S)Wkq-vdfE{(sIZ)wl0`!%f%+ z5N6=-N5FdkBwTjdG@9oHvV_(;){eO5&TJhxtegUUvRbO6# z+N0qURNuegr*QiEG<$h1>y7Zg==l8JdsNBzB+hG$|L5yc07n6*jNd-ELVf=-ez}>w zM*sVpu;IA%gwx(Sc!YxUo8HExxDq<>#7+<$51>IpkNnI?8i1OYrL+?Z_)b=ssAix}8}Z6r(@6jQ({*hX!qZ4j_^ z(vFKH9iR{O|DE%{n7eV-ltp{|6 z+@)?)JJc;|o4QGDQ8%bf>N>SSU8B~iHENYwp_ZvdYMwex%~7+|3^h$nQ3Gm{I!R4X zMNogUOWmP%soT^Jb&J}jZcu+rQUA@o6dnG#%Kl+M8^Cc>-ADiFh&${b}*MsD< zBSF3o*Hcu|39qM5P8wS?bzSZZxh`YlCh}vp9BcAvj1KooAl7L072CSK>-nd{cKc+} z?3WO;|KN?aTR0!wYF_(}#AE#6DUq~@v9)EqTS%}~?S6g8kGsgu+MRRs0td@yfz$X)6-wL{&awyB%c7IlN# zq^?sN)HQ0ITBBB}6>6DUq~@v9)EqTS%}~?S6g8kGsgu+MRV17T#;+8O%cpDtvCm#G z?-A`?uQNiu@CUEj(qcZj-PteL)J^b$vjTQ-y+@)J~*QJ?cI-&k(SPqsmef549@1`lISKrl7N7iemlVCc}Uw)Un zj<3v^X$i@6Cco!&9&qX0ns)VLI%BU>jLn-Bb}WSbATM$U?Y>tve`c#S+w z{{}fvUMCmHO>&vML9UQn+6hLuMuB@p}nFx7oO|wOf*a05ruz- z+$E>U+hkkL%adG>XI#0!TlBZ(0=LPwT;NS|LKNI0iwJKxcI5&$$vgC4CwIvW@-}&m z+#%P=TjUzKO|FtR$rZ9K7xFKYH|Sp^H_3VOI(eGhAm_+y9qvYWopdqrdGp zaD`l^7O8paG}VodL?lbjP~A94L{j8{nxsxr6I7AWezItrAsqjs{iGcwu1)0A%@3pf zB=(ux(jL$bb&J}jZc(SFjlf*I{6NBc<`3D?@+j`ou>PmK1HcBUBZCrA5983@?VZ;N98w2QYo==XRPbTbjG0*$lqvw;-9Haf@Xg?|AV6>kcJ)hi=fq?z< zt|<18Eyr%Y9PKAZ`$>+6ZPC$wQd*(+{c_Lq$*VKYpYL}ZcoXlr&Pqz*dwF=z)u#MP z#ic*{)$i?nIq&`1yrgg?&gb%RK97%coX7cITb$3`<9yy8=X3Tr-)oEWy|y@?L&W(U zBF=qeocqW)pG(I1Tr$q*l5swljPtocB-99SL=aTVAhW0eo?W5w6fSjaGQr-8)IKMZ>-TZhZZg!l%=~B0;9qJafP2Hrn zs2kKKb)DLvu2JjM8nsHTP|MUJHBX(U=BQa}hMK0Pr~x%eounqHA_njMIJ;{OVHZB) z-p>LD67EXGg$v&k0^4xm`<{G{>96X!=9{@5?S&9tkE8cw-TO6oKh}+>(R;G)dYX^8 z>tH_Ou8;YMyKd&)`(1cmE0@XWxu$J}*WHI6zpw%zy`J=c_W;JWyF`_O}LVjo(Pe8TU&*oWGE>GxqD z`jn(Q+K2M}*wH>TaN~jd$~gC%;q%P6_`dmlDE6gkNeBDVK=f_0FMTuD=V)Il{W%}a zLPRrE*UzJUY09-nB%mg#lhg!NWVA1}t?;`0(u1RYscWb>M$t9@4s^6Hl?EE^OGo?C zEg1-S|I*I8*vEFrfhc%e6#jOe26xGJ{Q~ch?YaiuC1*wPJWfR7=S0D7KA&;VLBO~| zt$&{WNpg`Kkjvy0x#D>A_nT}F+Ye~Zb#m9W51(6&-nW(J;NNEr-k@aWU>~E>)bP>jSGYsmqH*b}W zBtK;*5@T+H`y|~`rVp?{QpW&iSSR^?gdD@Y1MahQ%ipJ*V;nJMaY`M-_)^DxV#6VI zya8txr`&fqfU|~k9_P(CH*qep?)XWAfx6p1yGGq@+N`_%^@_b=TuB*5ey8I_6b|w1 zv#mPV{`Ld(=jqNuf06DQ^zYKW3H=r4wl)5HaHF`9Ec9!17oi(C1K4ZOf9~A-#QjaS znY6=i(|rfr|AOr&V$EJ1ei$|s*M)!s|0HcYc5a8tA?ZmwXK_lqN?X=&O1sK9-NgBC z*sh1*wu!Ml?gH-_t1#Iytn&L&35(-;{TSx=ADQ1@LwG;GlqBHQPl^%NDI9B3XEBC$ zJ%-*3?<`I|h7QBFiSxfPZ~65xKkxU0{{o3h-LmkK@qQF1j);s4=?mB*l8(4B<{}S5 zrHldGk3sLnnT1>CH~H0+8r+|-nYeHgzer9%C2T2Vga;4QKMj<6+V;i;AwiK}WCeNz z`T{O!u^q!H9&(&S3Qw^fQpPt?kC@~mb*kZ%3)0X31o8>E49pv ze*-G^BJ3?hlx!gJtI&sV;)sXWIEG;ScU7227-q{B%FZ2o+8lkp?+@AMrzQN}KG}be z{*PY6AMy8pnEvReYsUX|`hWBq{u2M+)Bo%>{4pkOyq*4!U&9~qZ(O7Q^fmku|G+<{ z|2gsZ=7O+qQ00T~MFYxl9w*xQ;JsL=#;t{Y3b%~=+h_}*cY5x-J@@?hj`W)x zcx}oa$Zz7yve?>VesR?l3J;w-_t2AtCmwt1OyT^K(`O0=vwFEwG8bp6h0@~c@_cE< zls*I3in(K$5t0-w83}vu9pdTD%a*hk34a*?eYZ;Zn)WEiY9H zvrCr{V`X-EW_7k)a2_+u7t#hFQ}S_4K8~Ab7iKQ3nAPP=i?cJUr8!fXnKRGMFO(K% zE|z)@lp`ZKXZjh>mS>j3mr55atE@w4oS!rJheD%$!d6)+FD@ZVAx%=+mo~1>Y=AR8xhr}P*+lEb@`P6wgfPU<;vu6(HeNi*!U}#p1Fw7&n_=rEHL-M zCTFK3iz7h_ZGYH~f%&;!OAhpw?b^e^6|=9zc37TYyztDWXA8@vmD2KON*D+Bs_!>( z=`dQnms-h2mOge(DP3%@ZYH;9SoN=e*J{0#Y%JTyE0-5%3(uBhYQRNOn3HQC`&R;C8tj=7l6c$%ln&-q;kgi@_v7L)xXesm?0>FXPVc`{6 zn4g2S56)9s3}z7+WDMD0GCYP3AzK(p%yx(!d}6`~gAE@KJ{TN7#?&s&&pEqJ5gvtb zOd>YMC?Yc%S2TnO^Khv+vrCTYhFR&^t z>kh+NaM62TCqloT0saG%%WUPcy(Yr19Cn6B!u$r}UnZf=UMkm3q|57wjSFJS=-?zy)gP_B`Fz$q6{CLceL zTr&MY$6O$+qRRuJ)$4voah1Q$x0Jm-wu~>n z!#d3RUAw=;>-*AO=N>t4zsU~mt?Tqp-)m2=^u6|U1--%|>9ddHjhp<|rnl6|*ouTUuO^`%#AXm;<|)H0CQ%oOjIOb^^BjQEYwX zo{-3~}{C7Nl0&eWBZ5iJIHxBuGp2%++Q$7rk@`o(<`%;c2oITQD{C;=j|Cne+ zw$(Yu(ZeRXD)q-b8u7P`?YP`ek@TXt50sYsU={ioOzdmIHOFwdqfY-t6Kf@4S|_iY z*w-ce2Km=b>|0T!y9Ji?zm1|G|7eH&$Htr%?lSzYiM=Yk<1x~cI~2COOfQB!g=2S^ z*dO73SS$@j`nG+LpY2O~Z^YSSzlJJgk%+`YILmVHa1t!-fP8nQU6LM4Ju)slT<*v^ z|6aTL?I`ifj4$mh?OJgh`>$p!A?ei|!{v?*$72&Fx+ebHJIl%b@LI9rF9k*a_qx+a`a|L^p2$?~tFt5I{eTvApA#O!W8B zK4S^x&+?Cd-bBA8{()E#}n^0u>|fvk2O^Ib^3qH#BRiWFQjAJb0XxH$7s*7Z56-k7=QE^n?(DJ z?GEy|As;odThM>w0r|rwmc%`>@r>fE$4GCyNM10p_n^MxHN|!E7fmdX^jZG+t0s0A z`ggod|B$ylM*oiQcr4*remuvErN9%D&cDY=j}d<&MZV9Bolbyr97MV12Odd>7hCtq&X7e!I!~urURmbnQP{ zAFv*b)`!vh!1<}SUTnGR!!qW}(fZ)pBk?v^A2wwDkUfgGKI~sLrtPf{mPhMDZ+)=s zA?@}Jw3}KVwzIHtU6u7=d$c}`_7D7iIzHMzjP?)zpY0!HziaPNB{8qzkozJxV6E5@ z2po&k9x1o3_3nFQ9rx}hO?xc&J>O69}ew2_e~R-mRT=w^PxEH!TI!iU2hKHze_Ft0N0xXhfQQv){|{lUdytc zbjhbpq$>V99*aNMn*#+Cc}dn2R8s11S=JNI^9Nouk(&6+JTLyj;-4gc$wWSf_0_IF z;xCN*!uI)xzaE9_k33J2^(cq<;vcR@XmsJ;dQ^4k%X+ki^~gSpdfat|EysT{k*_=i z4$CQg3@qgwtw+YLKco9&qx)lRcRh^mk750J8$UleAoCa2BbmSKvtrDVW0(WwdGEv~ z6vx;mK7{|T5WZVr?h}sNzk2{cO2X2zHr+22i}T&zJbi% zf_&_rvDL+@D505Hyfc<6oKWz zuR6x=gdwzZj7gB#fA;KEvA84FfQI3lp%vk!oV4H2H=F2x=-cJJfbfWZy>GW;oE~G- zefvZ}BP51<%3=EZH$A)jO%C&&(DjvfQq(af_n||(*PhY;)wd6{=c9f5p7z|Q5(kc9 zeeV4oq~D&edUn4(|F&oM+w)N0KG2?>zI~uQ|7qVo(4M)zeV{!T`u2hLe5G&S)1H1o z5KN9Sd@r;Qj0ODm{IkA&pgl2n^}_4^lC;!;cUJI4kw(8g|G=~R?fH4n?zgA>Z6VX~ zs}cQIefvOrzTCGDv}d+&A860HzI~uQ|54w*r#)Qv~^Q(RPKzmC0na)6a z{zTtC(4Jm8d)kxFpb)cn#J&q>X!qOmkNftRU*D;|eNTJd+Do?Qz&lsQgm%9@f5)@? z>A&RJ{q~f(gy{^l=QsQIf%aVQ+Xvb+-M0_4=lQ;Upgq6bxBKlG`AvB-3x3`a%VKZ$ z0y-;6V}%+(k9hX5oneps7tbzblOurrvq(Q&N30Rk!XzAbc;RW6?@#6y&n_%Sfb-uX zowz{%kaC*854)P5CH+VacE5oURKiDYhCQ5TV3R|_M<0YeydIqyFAc#ShaE-o4_p34 z*u(J_hOfhM3ifcE&~DRjAd%bsRNxNFk%l{mGeUn!=dnJ^e%^ev&n64E4)6PK!2fJN zyiN9FeV&l~yzu+C2HA|tbN%*7p}qX}uYvvk%7VT2{ekz_>y>Bvtu0Tyjr?T%jp4)* z|295k{Dr&?x3o{le*(9(U&y;~OZ$=&lW>2k&+>Ql_FAF8`5;*4n2;rJxt2qgHAb%0 zkQdxwrNZz|qWysda=kfRB(*MCu2cYK!d?Q=%4 zj1}KMuehwZs<^JWp}48IrMRuQqqwVhcaZJ;?v-Ee&-(R=r4(lr=M?7^mlanP*A+Ju zHx;)Ow-t93cNOmr@>oJ~QgKRgMsZGYUU6A*RdHQ$Lvd4aOL1FqM{!s2?jYNHL0
      ; zthlPUuDGGNsko)Mt+=DOt9W;i_a_u56{i$u6z3G@6_*uP71tFv6gL&O6t@+36n7Qx z4)P5N#Yx2}#Tmsp#d*bL#Z|?1#SO(x#Vy5c#T~_6#k+%iV?uFKaY}JUaZYhwaanOy zab0mkaZ_hoKl=o zoKu`vTvl9FTvyys+*I6B+*aIC+*Q0g$dd`hNyRC}8O1rpdBtVLRmFA14aH5xEyZoc z9mQS6yMuglLUB@YN^wSUPH|pwS#ecyU2#KkQ*ldiTX9EmSMly3|4>44QgKRgMsZGY zUU6A*RdHQ$Lvd4aOL1FqM{!s2?jXM-p*X2n<~#3x(>t#ncL-D5KEydf4cLv$Mg6*aMu1Vz|C{8QRDxOwcR9sP9Q@o~lUGawEO~qS^ zw-xUUvb<{Kx9__r6$gsbilx83=ST0B{`Oh=+h^%-pQXQjZYXXlZYgdn?kMgm-W}xk zBorqVrxa%t=M?7^mlanP*A+JuHx;)Ow-t93cNOmr@((8zCl#j@XB6iY=M|R~R~6S4 zHxxG&w-mP(cNBLO?+)^hBorqVrxa%t=M?7^mlanP*A+JuHx;)Ow-t93cNOmr@*N4q zNyRC}8O1rpdBtVLRmFA14aH5xEyZoc9mQS6yMr7g6eks*0DI53g42rSoh9FYPVuVZ z&ncGY^WO7@y!%gwWP{`LU5cf?zW-^(QeWSH0qpG$ z4!xxK3yP(_e)z8`miqes-v)c@!=XP?{AYuFr_|RAf9EZVrM}kx6Q9gK`P8R>;_1I$ zD1Pe4&p&a_99=C{SIyDo(!$Y)&p&!pp#Ou&;Sa34pV;$%4SVmeG1?#YlXUj{VtD^| z|AzdM;x%Kr-^R45`qAt!Y1-fOyk@Mvw;##<4CwG!p1&W>Cgy(8b9iRX-;d@}yG}em zfFDuv8(zqsuOG!GH9St=o1JHlE-ZZJqWpsOGJb`;_p6D1l9CU9KXYiU>F-CgSzRxl zA0YhE`=j{1=GB>J%+Zz07p-y}n()UR&p!O{slq7(x!=i2C&!&kIXP9h-vzO9($R4z zQ%*94`y|MHPEI&E<|OUpRAI`7xu1HHdYn2%%@j_$q^z89bj(TG36ip&NXjabvWldv zA}On<3MX8_t(k9 z7(Oe9tu-TAlvf23htM@_+e+^$g=< zKN9(6*oWjFtHBS4eXrFy-Demd6!|;&7?%IG3vP-~$zRrTIl}nJ-~2hwA^9I%lfdr% zT<79v7+>(aIEUo_`K$!M5!OF^PdJP(`Cr93B>$VYB=Ys^Z+;5_hUH(e(M_-ZVK^`U z$Q;59$^SjuE`BWQwD%dthapnLN0@FFZtwU!%ipVi_}+6EAN7wML4+as2Z2lMy8WL* zm?8Q9O&7gi|M0zLFaPLM2s9-B_oZC|{`>jX62=Ea<^9iL`4?^Ie*fP@4&$T#QTh9) zA^9I|y71Sle^kcxu>9AUUlA(d@T#{xy!_42!7?QOQ!N)fR(IO_4C9O8XK)V7e}^%o z9VLJHt}90vAN4m+;2e_whqCa)alQJRk0Zd4{J#)LY#c?Ll7IOAyO)3DHQ2-a!}$p& zIdaoZd+);&d*Oxe#yKp0Q3BvtbJF_^^M@h&OZW)m_X0RaZpZ0uGs?r8zoWkZzhU*S zF?P45~`b+-yh7{DxKl0tB s*Us8@ufb#Rc)3EBa{7l?-ssQ5BkFth-Jh*Hw|#F*;(UaDVgAYg2bE*hUH||9 diff --git a/internal/ebpf/ctl_bpfel.go b/internal/ebpf/ctl_bpfel.go index cf523a9f9..d28873580 100644 --- a/internal/ebpf/ctl_bpfel.go +++ b/internal/ebpf/ctl_bpfel.go @@ -23,7 +23,7 @@ type ctlScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadCtl returns the embedded CollectionSpec for ctl. @@ -68,16 +68,7 @@ type ctlSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type ctlProgramSpecs struct { - HandleSysEnterKill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_kill"` - HandleSysEnterPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_enter_prctl"` - HandleSysEnterPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_enter_ptrace"` - HandleSysEnterTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tgkill"` - HandleSysEnterTkill *ebpf.ProgramSpec `ebpf:"handle_sys_enter_tkill"` - HandleSysExitKill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_kill"` - HandleSysExitPrctl *ebpf.ProgramSpec `ebpf:"handle_sys_exit_prctl"` - HandleSysExitPtrace *ebpf.ProgramSpec `ebpf:"handle_sys_exit_ptrace"` - HandleSysExitTgkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tgkill"` - HandleSysExitTkill *ebpf.ProgramSpec `ebpf:"handle_sys_exit_tkill"` + HandleSysExit *ebpf.ProgramSpec `ebpf:"handle_sys_exit"` } // ctlMapSpecs contains maps before they are loaded into the kernel. @@ -144,30 +135,12 @@ type ctlVariables struct { // // It can be passed to loadCtlObjects or ebpf.CollectionSpec.LoadAndAssign. type ctlPrograms struct { - HandleSysEnterKill *ebpf.Program `ebpf:"handle_sys_enter_kill"` - HandleSysEnterPrctl *ebpf.Program `ebpf:"handle_sys_enter_prctl"` - HandleSysEnterPtrace *ebpf.Program `ebpf:"handle_sys_enter_ptrace"` - HandleSysEnterTgkill *ebpf.Program `ebpf:"handle_sys_enter_tgkill"` - HandleSysEnterTkill *ebpf.Program `ebpf:"handle_sys_enter_tkill"` - HandleSysExitKill *ebpf.Program `ebpf:"handle_sys_exit_kill"` - HandleSysExitPrctl *ebpf.Program `ebpf:"handle_sys_exit_prctl"` - HandleSysExitPtrace *ebpf.Program `ebpf:"handle_sys_exit_ptrace"` - HandleSysExitTgkill *ebpf.Program `ebpf:"handle_sys_exit_tgkill"` - HandleSysExitTkill *ebpf.Program `ebpf:"handle_sys_exit_tkill"` + HandleSysExit *ebpf.Program `ebpf:"handle_sys_exit"` } func (p *ctlPrograms) Close() error { return _CtlClose( - p.HandleSysEnterKill, - p.HandleSysEnterPrctl, - p.HandleSysEnterPtrace, - p.HandleSysEnterTgkill, - p.HandleSysEnterTkill, - p.HandleSysExitKill, - p.HandleSysExitPrctl, - p.HandleSysExitPtrace, - p.HandleSysExitTgkill, - p.HandleSysExitTkill, + p.HandleSysExit, ) } diff --git a/internal/ebpf/ctl_bpfel.o b/internal/ebpf/ctl_bpfel.o index fdbcf24fe6cd34db9a4bd6986ddbbf4d34cf97fe..21888bdd0b057624dd1badfe4f840d7159558746 100644 GIT binary patch literal 21760 zcmeI3eQaCTdB%?^$)Oy_X42Tz(rmqH)09pfh5ksRx@kbCb*pS%%em>GcI`-6qAf1^ zU@3}`q5$RAE)ceC;MPqOf(&Ka0@JWyAhrSV(5~Sy6!6es;Ih${)yLLHsyWIb{ZPHlh+CQ@$ z&iY{1-6T1e4u<#xyWf&PXz7hfAMw0Yl9td56CU0EHw1m**`PN_`sORIyz;!1LWy4% z|4H#n>zl72$MWMnuf^m&?it|&$$Q;{UU#{o=zzP`w}*Bj;cION<%V9R+|uud_J2@6 zQ9ku*<)3B$Z`<(w|6%HpYTSO#qmKVd<#e1|^Ywe7J@n@$sb}Ig_W$#!)wvsFmN3sl zk{)*`kEoBhU-!`i?%O`cf#jRq?@G*pP#_XFnlYUA50{kZn= zVWhB^zw+aIz2ngSsXZ^fhVy-OyXjt&-CVgpmwxDaaQ$taA6|bywEgjXVqW)2J=cDI zZo}!3^YirUK0lb(*F28cb@bZoEG%#X?ic+yKIxBg9qsy57}pJcn9g2@SpOEqKi?P9 zVXdDQ|HAITAKCraJ}~k4wO!W-T-mof;O_V3xBD{_`ZE~nzxMu|_vI&^zSjQyJp1!D z)1RO7@ykyKyMO*Q_v@cuW50fi{kp~UYn1&8>-cN$*B)Q*wa?dxZy(nc0^fjfiyLtF zg?_D;#cJd}xjIEHP{*h_>L@i!9ie8ZX=+3rqNb=xs-teQ{T_9L+NEBicBmJrZR!PT zi@Hv2QrD;r>I$_^U8I(&Q`7==jGCj4QnS<%YKEGoM${o{ikhT4>L#XL=DkPVpmwR3 zs2wWqp2**(UZA$9>(nN7joP5DQ0vr1YMDAkEl|g(IqE1iOC6zRsA+0M9ipbFNvapW zPaBZn@@}?M3-v8M8?KY(gQ4D~XT$z&`C#M=PCR+LSJ<;(U%B5|Ud{UWNyfE&g9rl}362y9ok)b}-w@O&s zLH{s<7v|+4PVe(qx*wt*zi-ujz`>j^hk8)|HP`cnu&y5H3*$sR7~$3WfpqQ1IQubi z5Up?T+xEZFqr1{Lw4Ykf67PoxZup`vIN*N6>vE0jPL1nMjq6U0>rRd9PL1nMjq6U0 z>rRd9PL1nMjq6U0>rRd9PL1nMjq6TrQ)U9^zenAmcBz-B9qL7Dn|guTqOMb$)HP~@ zxLqH2dXd_uUZA$9 z>(nN7joP5DQ0vr1YMDAkEl|g(IqE1iOC6zRsA+0M9ipbFNvfC2*PSOr{Y%e=eeUwX ztk1agY}iLE9}MmNpmhn?7oK+}4sNecejmHFK81eby12d`h4tkBcRdRGG@LhBh^|}L zzCMQg1?s{5=xXaD#;fh<`nbK$2D{b!4DK&*$oCoX&jZB$b`aSIaQ(c#Zwu?%D%a0d zuAi%1KUcYau5$fc<@&kG^>dZ$=PK9FRj!|_Tt8R2ey(!;T;23%;QGF8EX)JSk`V8Cqv(V1={_V=^ zQc+6A*Cqen`}%$@Jcs_stwS$;A18Xi{iWCUEsRe`KmG6{_kJLE+8e-+*x_^kw#$DP zLbo1~cd+oE=Q{|AO5ioEUqD2#FO0U(`8T-O{vrNN;s?Zw(|m!X4!+t2?IFQT##@}!jbs8g#T2-(%_#-SX>h4x{Z*8 z-z^jE}-+l6zR75~|RV1J_${+xu-7q~Al97%Yc;jD!J zNWw=&>*Bw{a9hG(lkhQ74D#2Dc~N zp*_A3K$Qd@)~~tyW6Kc~`7SXx=RxJ1Y5cT$r6Nou4gE zMyO)poyQR^$F1n;x!Lm(4(`$7lBcmt&B#c+iXPg|4 z;BXX&WA5Da`1yHPtt`w=j8}`3t~@^J&XuN%v*R;GH@>jw7DmwK$aa$xQ{xq_ST#RY z94|X5baq0*9H$35FY|%rx z_vdqGKJ z9*&M6cRqi1p)_4B&E{u{GxNo2x+oor_Yawh_dHlF%@pUW<1^*_>^yt(DB|+xi&cqA zGaD{3Nrr@S63T=K3`Q!F$(Bn}q9hPv3()Sg)7D|(XQq<;@guG_-V@Ia6oR>qT zNp>p~l+q7A7#%wrBBcSzhXRrsqNFA*8d?j{p)}jq8f-6cb&AE@^B@9Sr-Xb66J8yk ze-zboodD(;zWb1^4yhP=ESHlWJ9O4zp^}Ajvgj(s@#%bd95d$5SLWohnJ$h`7AqlP zq9Tjj?0mU0x47iQ9xB!R*}1tYEWx3h&M%Rf6ZiXby)%RKbmz5%o?wxS*Meb%)~}E~ z)<5LMbrbT7wZp#3;VkTIDdadDVXP>HVO*_#q-*UyjO$V=7i&H$>VWNhQ(vQfVfRWh`Uw7k@$gJ$PdP^VRjcn-gtUe@;@VKe<*%%vENCN z9XuwC{9hNJn3jGpUBtU}IimbGQU0lZ*D>5Bi+HyoN94y?2Alm3Z_ne5x9Z>{NdJ?5 zhqvxvb$A;ePtO@HnEZJAhWtN^`Y!hSJ!qVpCjUBlQS#p)hc@|(!h4@cxQ=jqKJe8z z-amXz2J3v_nJ&&*lOJELk*@PmFkCnJSIFAGCV8uWCjTX}_6JWn@%|*q+Wrt(=Q}d# zqlR;2JzoV=e#)db46l*({H&YuEtB3c+%@?($X}9i559z_fG}R=h^*sFlXX6`WS!5l z$uF14j`>?Nyl(Qh$T~k_g1)@+hRNR}Yk!imf5-XK{tU%`L zn`CW2DbH1?PhEfBJAX)9nxQx^gZbTmn8o$_|5@0MBXQMxL1rTO~!STx_!Wnkl!P`M~pE`{vcS4 zZI#&}S;N!Iylk>4Tt6C1MLlRqK+=2V~Snf#mN?@Ic?Tl-v6UOZtw zl~XakRnkYu+Fq7?T`2eul_uKM`5&CmmzhPll}Xl_jhFlY|T@PC^hCN>(tG%|#YOfc`YOh_g+G~%j_PR;d>jN8jw6FGy4-{ZcPm$H0BeL3a znymJmA*(%)kky{EWVPo}vf6Vl#<1rxvd-5OS?zg|toFQa^0&xp&uzmOV+?!lnev-t zwdbUKXudmoviZ_$%me}{iI_I`^k{?e2$QH zJuL4=^Ymuz>wL(_=YLL~Q*2ro<>twZ`7Fq4*0$J^+O;-E4NLKslkkx)J z#TfR}CF^|k$Z9|M;D-5A`^k_s{|H&_XVh>m#;~77Q@&1CdubS6Bdh&fAgld!3}1>d z>}Qj#_A?|O^)Mdgh^+P_%a?x^k3?lE+`Z!0BtKkTJUIO4h;tXnN!gacZHh;yE z1D_#pkhOdy@krP5*xtqKm+j1sbXh(~D=VZc-`wP!~{=ODZy3N~ApMU=l zkN+C;!#3jXpBP_{M@smQ8IR|vxchs?!-nGS+l+@T#N8JekLRJd`vb&Zg$&~k8gu;pAe7wGoH5V&oLef7x|-n2lo9B?;o+gtYQRz`WP58Xog?aU8G zI^H+Hf$`f6+*jbh_#Hqt#u%^m2kCDTkMH+zVDu>~9!^>3Q@P+%x6{jp>xLVKn}%D4 z+lD)ayM}v){U9Vx`-}IraLSQkyq}GyXAR?hZ9KhTxNNv?xM8?yxMjF)xMR3$xM$eW zzID7Q!;#^P;jH1D;ez3^;kx05;ilo1;kMz9;jZDHVO^58#?M=pa%32LjQIJ@8qOIm z7%m&G8*UhG8g3bG8}1nH8txhPhAsor@um=nab!4SIBQt%qlkv76-;{BaNTgjaMN(h zaNBUlaMy6pu--BdjsB*%J}XCtb$!?LtVz!qE*LHwt{ZL`ZW?YGZX50x?i%hHmRqBD zI-dCb1M?A?^o-&7{Q~)OCcR*|Y`AW?VYq3yWw>p)W4LR$XV~%nxix;nk>QMCz5i+%()W z+&0`X+%?=YtUs33@uv90N9D+H#&Fhf&TzqS*>K%(!*J7Z%W&Ip$8gth&#;qc-1zxU z8IBBR3}+4J3>OTS4c84f3^xt847Uw;40jFp3_Cs_>G@6>jtplEXAS2J7YvsT*9|ue zHx0K8w+(j;cMbOp`+wGqUGJ&AJMAGdoH3j=oHJZ7TsB-c+%ViU+%nuY+%eoW+%xQd zL>eDI9~{*lBEuQOS;INQ1;b^-b;AwAO~Wn2ZNnYIUBf-YPQEX}>3CCyBf}ZPS;INQ z1;b^-b;AwAO~Wn2ZNnYIUBf-YPTs-o7{B4jFusq)^Jfj?`&c|3?*QXmHe5H{Fx)iU zGW??9mkhsb_X~Q2kJZ<<1!%rE0#_)57zijx9x4rewyWaj5H(V_)R^4!=I6eH( zBkvyuZ2w;OvR{cKpZ%pce-j^mu%|z0_rEtMxZ&yP+6;cwTah2jZ~dlEe~msYKL)Li zpLN6YOEX^Cm#v=yo_^?|O#WTY%Q5Ov>JjSkk&u3WkmJ;2)T7iRn*L7ayN}gUk5Z3N zk2BjbW}_aZ9#O@AeY`&RX(`S}>>U+7mJ9eW9+G0tpnnEM93NA*a%Q(eI|H!WxH~3r zwetGjRm*TYtmwaoV2haDiV1->{-Hx$+aKjywkXD_<#}1Td5J^&b`HvT`6!OJp8#^S z1MBuK$6;eNV&C&x(Jw@z?oJCk12@hw#?MH_sLEMYHegj?JKI(k6_PcDq!SZMy`E2_|iR(N4%A81D{FW=z{`mN} h6>t0ctCGT3WLtR<=$#0t@7GWc{|~3_<6SY_{{gOka~c2u literal 47288 zcmeI54{W37ecvBa=R4k6KFf|zQEIPwou&@Yx!h6r$EF>}q5qsir$ z3f4)Cq_auWL%G)NxU^l>&e4dVXq42gi8aVH)SEdpzzK`dvRzSVfID!jw`p53XluJE z!`cy8Ht+j;p6^4x`bj!Faq0vJAKc6D^LhUNf8Kw3@2Ah6dmtK#7;hrxf15seS7W-X zeS6AUQ|7%0S$X%ErON1t)mIRC7`DkD>AoQjm%nPA&4DP=c;k&X##G`z2XAqDn7LkM zK5HXISt#U8lCGYt$BXmD;4PP#e@GYMol6mZ>Fbk(#GwsTpdTnxZDD32K}gP{*hvPD?ST zc`N4fey1`{596pFdTZnF@}!IR%D#Sl8Bnh{G+(4v-tF?MjJf>#`E1$w^Y-VH9mdAb zr-vi1Lg9J2wa2_1LK&|zAG71&m4mLpZnUuQkXMj=8OJLU7)Hwfvp9UaJ-q*rIGf2Y zy|s4p>%kH8=e_z%0shoA56ZJ?-K)zbTe0eLk(#GwsTpdTnxZDD2`blvWv&OyTo0DH z9xQV`Smt`L+;#I}d5gM9-Jo`;>(n-NjoPBFQk&EjYJ<8&ty62%GPOi4QuEX-HA78P zQ`96iL5))b>KJu|8lxI&*Y;<1d5gM9-Jo`;>(n-NjoPBFQk&EjYJ<8&ty62%GPOi4 zQuEX-HA78PQ`96iL5))b>KJu|8lzgVnd65muRZQbL(8UVjXBpO2J7 zYIu18KQPz6%jxB>IF)o{KbCZ)B$CeOaa6wI=4o{_V*^S$lKyv`&TqJMjtseaN;*=* zE0sh1eK{srj>*t@MIiCtjUSl3>fy`j)2Y0~avZqc#*=bLiF~;4ygaUdBpo@=xl(zg zK0Y5`o_@X9uV1yrvgb#8t;5L595H|22CN9cR7a(E(O(hQzSYqrS$a$SQ&uYxmrr#x z?RX+?_2GzJ{t!Q~Tpe}p6A`DAqj~FIiMV{Kqh+$or#f0Ar>s^->*O?fiJT!f$XW6V zIZtkqi{w>uiQFQW$!p{qxlOK<*U3xd4!J?zAg_=&$xZSWd6nEHx5#citVGtxZk?<| zTsf+vZvCu8Tsf+vZe6WJTsf+vf$hmkWP|bDI$Vjka-e_d@5+JxCA)H(LCE>-cDv%=LXVPj=;~juy$T9M#d1XFE{9Rxw`4Zr{cDBIoJPeRI_9!x*3R&(NRy z=xCbUwfUevr_mnd1pPP2adL<3%7ykOyKhTm8%jdky})&e4^=q}}`meQv>Q4 zb%YwD8YtBuQVvXx%ZH@jd>MFHKU77i~Mpd>>pd;=F5cz3A3~Wv&OyT{lk#*Nd(lem<}| zxL#D(orCK|dwo2(UgW+!+OYGa63M!GGrB^~lbdAj@1v{a68&4`GI@<$Be%(Q@;Z5m z+#xr}8{`%8Cb>!8BCnFW%6{d zQ`e|1>MFHKU7<$5r;CgZQ=ahr%#liI=W=JKHar0zwy=d3Z!Sltz^F^5u z)zLP`1NZaMH8S`0(H6OAwK}>=&Xb$uEO~{TAvefr@)9{ku9K7G8aY8OTm4=?U%brs zZsh%pYtRng{d=gBc3tuB%^itMSbpVz6*KwlclJJ8|NYjiO`uwG&#$W`_uRT#;(d`4 zpP!f9^XY1d9qKx@OT_oRZFhls--gBOVlDY zPt8&@)HF3kO;QuoI5nV-QAemTs-g0{u*B=clDq#_Ep4zpJJfY*o4Q7AQCF$FZ&z9& zH>gY0I<-bEQ%lq$HBZe_Gt@LSMNLu@)HpSuj!{RbF{%|)nV`E9FvE|yaFvO`g&%PN zDtynUI^x3l_c7%;-S_J~*0(nw-HQc&J`Ubvb??Vim)(0Y)n%?HgZEh7da=y)WSQ&9 zGS`#Ab4j~S$U1Npjw`*#YUk_VJyv@^Ztxzf9X7kXpUeH_tIl8k&S&r*t6Y~BZG+&v z+A7}bBe%$9@*25DZjIgMPweq&FGbYQyY95}b#UD|xbDP|8N3ghar0^LeAC|78$90}Jl~WF@x%Ij z^ZrW{Gr=bwyl~=UnR9kw_yPO*@}EbHyTZWV$7Ac4<0G=6I}??^5wjB+B7Ywr^w9qK zm>t~Wej^S!Pk`~^92pbkCs~9gxn3MtZPGYV-6v-s@9_@MAH^Z*rEuJe1Lm+i%4J!E zqwY&3V%?suy8^K8QTdyHnr(T9(~;_qyFfAd*25XvrA!}o_8oPSuM?yhPCnJZ&W*{} z2F^Qo`_64v@9r2>jPLP`7<4s62T)4i$3~?9vx92aeJ%WA1L)F-%N=<3ZR@KvOu*!7g*ChU3$) z!`LrYNc=om`Z5Lg!ghwMHMafjpVlg%Q5IPQ2ZM{>AdAPD)aSG#FlzU z8Q)Gl7LbnAsfI&LIRDe&XW%dS-v;|*$PoRoFAe)N>{3oK7ikY*pQk+q`*X100j=Sv z)4m4#7h%5>DhYoX_PbzB!Tu8LG8b#G|1;R{hJ6ionrPD7kTusSaXIwSkb4&P-$h&) zKc9RGw!J?B4{2}dr>|gvh25^jzXf{=Zesos?Ds+g9ABq<3ijWjdmi={>_~W@q$S_9 zxd$rdo3O*gWL@|J73MzcWz2dgj5r~kZGHZyXk@qz-_P)2f9aFM*a*b`fnEG%%zTvo z(obS^{NJYk$DQ{!e~JI^>3?n)f64#d!!G|%?&2@;m*}6_#b4t86D<5v{`2&QZ0j4@ z7d{{jh^k(|55k%g;H&UC8*!9*B}V#?m*FOW{e3vZ1UPOH3rv9HgJOXRaGXIp5vKF7 zIKoJNG7e!}&rHuQnq2Ol^XKn*B=^vRkDkq4cqDT+motl%Qo&rDDCY{Zi}TZk1ygt$ zwgq$P)JcSw-%GO#(@)M8rUFUg(ru^38NWT}nYq~~1Nkve6)NWGiJ40UGc`X~%1zE) zLX3sU`H98JV$OL?%s-hh_!*aT+HaBepENPt9h7bi-&nYp>AE|qeHnZm{REo`Y{!7b7h zi0v~)lv{2IZk?Nj)ASQT{ATe-_O@Z;XFqen4WOTR@Z7nhN6kSDl;GLI{2cO0AO<>n zuN?h&kd8vO5=pYPc_13n%Hv_U3zJL9)lnU|J>q}(^K(Kt$iC^DotT1vW-|` z6cz~`3v6lb%{-91=aY{h>aJs~JiTbpd)xXSZhLfp&&N0Z!llPABJ>mUa~E^WeS4F$ z(~-roAda>_YRACzRIeqs^_K10qe0aiEU+Esr)Qsh{L&M-`NBeB{^VuryDJTTZ%qcENTof}y3*ZwLSjQils?U~YN} zu6=Nx(qeEHfrE@88%&1BoonpW6hRY0@o( zR}PF(grl!>LP|cW%gs5v*v#Ljpvx-@1N!_TaN zu3Rzb$@#_H<8yP1(ua1HHg=g$+cpkCVop@4}y zPnmYbWs#L(-y`;=c`lLST0k$2y7WUNRiziPYfAucN-ymp*pEMDOx!}*1y$TZy}M&BzOLC&ABab77C=jnH| zw|@R|QqEt(dD#-|kyXeq9K{x|WOwB~PPFKW(^-FN)jtVye!b;yuk**?R&2N!fmb*) z%3L^q&wXd*+{h1inGpSRwZvl|4o=*P{pj})p6CaZInoa}?gGl<6AmO(rXT2} z3xr*Cep@J+Lj6#uTqvB|Oh~A|y`!!7YBy??%7*c=%2pVj$Y||?dS@6`4z0+O{X8*ISWd=w~y@@>-E<9MQVA4 zZaMeheP=)U&{=aFXLJi@W_q$PyCAoujND@m!~*jok5_Tys)!p*!?*sr@IGW`7D0l@2<%$e+<7r8R7@Q|02Xc0siX{e*%2mU6aFR%%^a? z6yi^Vf8Sk`i??|Qhg@4r8RcHDm?rEm<2YJ$<@bCeI8J{X5I+eVXae(paU3W`?R{h6 zqp17vV${ez8qe2)^I%EuF8J?9Xpq?EP2q z|7~#e)giMEmGobO4yTRjkpGJ?ZnA7bC45)-^&ztr;{9N`I}uJVMt(2!;GYed1k|@j z6zw5>dCr#9x&Ib8RqMB#@Hkl7xR-Bt$Uc|wydNz0yChw2Qm}}>Z`W`;O1mO!>o4sr z?dsd{zahWA)^ zMo`EO`Gep?r}vo+@?GGo*P>>N{5bg9S5bcQFMtoqpg_8k|F4VxA4LtC$nx)q|7%e* zLjFBr44N_WzXM;C*YsWtqOuBKBfkp&(cvMp zq_`2{8{ogD;5 z4YWV@1mQ0UXE2}0Yr+>Wf55Wd$odqmxjksd`rqiUW3nII2##Yl2(MEKu;k;{sWkbA zV*N*Z$X>l;{l{X9?&!7eICzBZV)vcyVEu1#eU|-Tu>KF$|H1n2)=}9H-tqMx>yun# zgxCK?@X>aE9TUD09Ot?Qu_l4vAI9}x+9QhgkZZ9W>;Fc--R${4c(DGvaWXjn$GE}u z(BS;vjR$|dFj)V;kLy3yC%K0-hP7OboZr7oUi#W{?@@%$_htPLulFgkKi|)USnf+? z!4m&7NN+#xf)(lS@As6+5Nm4qmGu4n9-LxZUcn{2-0x|U{rw()f2WG{58n_mxb(L9 z2@iwievjn;qWI&ch1~D)JPeleap6A@e|a$s=cS&9!7=jx5dR=zaH(zmg@?ho^tI)) z=k>1-8C;t7Snek!$-cZPvcI2H1WSHLPX_msesJz5$@&z<`XtXB{5#sRZhaGMGVWQ4us7fBesUF_VeHTU&Fv>gk^bSu z{(d4n4EFoU{o-Hl?<1oscW-}wDSSoWJV{r!HEA^ZKN%=GPkvlOwW&U}`;QGalhr#vB_xJgQtWQy{Pk3yCYYbzuxTlInlW-Wh=l@RRBlnixiG1XJfp;PwdGFwz$j9~4?!QB_AuDqf z<3Tp+ta7)1AP9HabHnBnmfgDtVRx|)84MO>-e=Rl%3k}1z5cUJ=PFYUJHpHdHEgZ3G(#0;Au``3117o7Lm^snC0p8w01 z=jt8p`B9ti)qAujCZRI&PKf+vOi{W2iB0F49qsuAy6g6Q58ZWp{wrI~Yj(8f*Xgd? zGsW`g_MBq+x;_6f-FF|K_Rom6)$9!${#qmVs>0?kZF#OWa!)2~vpu~AJbjW_n)P^ZqMuJuG{kuZ8@*o(Vj2SUAJe_wkQ5lRL$SdF@4>h zFVTJX_ViDQ`gQ)64gank?J4hE$x|h{<_Mc{hS&9#Fhls?#kG-ln&f{S*W>f|>8{)J zIlAlg57J$?=QnLRkL+kqx#uYP>h?_7_Cz^VdtPArx;?*4cio;ZW4*o}HTEV&>odsr zI^2yd(IcQ9gNnN!x8D7~A{}v0Fr0V)J2w6P;=jdpUHU$BTTw^Lmuj8y|ia4%hdd zR^snX*>3Xpr`LzZj}PCl?dku5T2?w|e0!l-_PxbA-Gv{-A=m0+gg=fWg+t74;l+Q| z`Z|AmO)UXoL_UFIgyY4hx61zTJSdN}R=>S<`^24hul;Kwmj3eN%(rJMn9S!L{)C(Ew;IUHidUv`Zd0T^NVyZ`3|V1#eR@rwd5!XL!(YXUIBCvbdC07h8m z`Zok%gynC&*9BmNrFnoqy3{2Pj!id%}?iaUxo6?YZKq#!W9JY$OEirsl+ zKfJr{>9gE-38z<7Tvl9H+)&(9+)~_D+)=!#xT`qEQzLP<<6p5q@ALji<)2oZRa{hD zR$N!yP~249QruSDQM{?Rt2oB<5nsPC#c{<+#c9P^#YM$s#dXCE#ZAR6#p@xK{bob) zmSPjy-z5Bq;y`giaY}JUab9sraZT}(;uXcKiq{mcE8bANr8pLo+3Du1?8jq@xvtSn~GbC+lo7iHx+jk$9SnCxvtSn~GbC+lo7iHx+jk$M}K7Ui}rv z6(<#^6=xL}6_*v)6*m+&6}J?(6?YVGD()(d@exn2{)*#@lZw-dvxBio1$q@&RfXsjtKzQyf>ERGe0vRa{hDR$N!yP~249 zQruSDQM{?Rt2lO()IL;y#c{<+#c9P^#YM$s#dXCE#ZAR6#cjnM#hZ$|ieqw7AFjXR zxZ-(zy99d{ZFQ=VO6IyB>=FU5d{so(i#CA1^9?UhxZxUsU|E;y((p zoR7b*_%9THTk)_I3dZl}Hz__H;*TKQ{faLro>IK1_<6;jemMKcqo4iUV?UM4f95AI zJapb1Uo4at&GGrd%<+3KJaAl~|3P2>fpGVUxbWAUcYaOKewa?u+405e{&(y4_!8i* zvD~*EZK~mD_DhiVdz8Dz>U)PHxzAYc9V_G?j%E{cU!>eSGv^2-e|e;@ z^S=zY-SS`M{opsN|L-FHZuuvee;)o~r2Z04=RdVa`>*hP{mts1-=qDPcB#KS($x9m zvkAM_e}m^wZ&v^K9{I2BQvYjq$^TKzKP0hZ{;b~$N0_pjoWA_d7w=XgzO-w~J5Yl! zI7_(yjA}Ut?al*{T24`OBKNTmP>x|E<8ql>Fruh|d38$b9JB8*}ig;pmwq i?ti|V-b0u5@1p+rx5K1s&MD3eC7yJN&!4v+&Ho4MJ_Eo2 diff --git a/internal/ebpf/events.go b/internal/ebpf/events.go index c432d9b79..ec78e5add 100644 --- a/internal/ebpf/events.go +++ b/internal/ebpf/events.go @@ -62,7 +62,7 @@ type rawEvent struct { Pad uint32 Comm [commLen]byte Filename [filenameLen]byte - Filename2 [filenameLen]byte + Aux [filenameLen]byte } func decodeRawEvent(raw []byte) (rawEvent, error) { @@ -73,9 +73,9 @@ func decodeRawEvent(raw []byte) (rawEvent, error) { return ev, nil } -func (r rawEvent) comm() string { return cString(r.Comm[:]) } -func (r rawEvent) filename() string { return cString(r.Filename[:]) } -func (r rawEvent) filename2() string { return cString(r.Filename2[:]) } +func (r rawEvent) comm() string { return cString(r.Comm[:]) } +func (r rawEvent) filename() string { return cString(r.Filename[:]) } +func (r rawEvent) aux() string { return cString(r.Aux[:]) } func (r rawEvent) eventType() event.Type { typ := event.Type(r.Type) @@ -148,7 +148,7 @@ func (r rawEvent) toEvent() *event.Event { evt.Params.Append(params.DirFD, params.Int64, int64(r.Arg0)) evt.Params.Append(params.NewDirFD, params.Int64, int64(r.Arg1)) evt.Params.Append(params.FilePath, params.Path, r.filename()) - evt.Params.Append(params.FileNewPath, params.Path, r.filename2()) + evt.Params.Append(params.FileNewPath, params.Path, r.aux()) evt.Params.Append(params.FileFlags, params.Uint64, r.Flags) case event.Connect, event.Accept: appendSockParams(evt, r) diff --git a/internal/ebpf/execve_bpfeb.go b/internal/ebpf/execve_bpfeb.go index ecc537a2c..c0d9eb2ac 100644 --- a/internal/ebpf/execve_bpfeb.go +++ b/internal/ebpf/execve_bpfeb.go @@ -23,7 +23,7 @@ type execveScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadExecve returns the embedded CollectionSpec for execve. diff --git a/internal/ebpf/execve_bpfeb.o b/internal/ebpf/execve_bpfeb.o index 193a6f63082ceeca10f80d7c2783d38efb0acc33..87913ab3c3fffae0a004a9cad6f631ad3fcf5970 100644 GIT binary patch delta 4446 zcmc&$U2IfE6h3$6-rL(PVnHBn1YB*AML<>&sfcuoV5@*Bk)I7|VjF|55kif@)Sr0Q zpJ+8cG`S`=rVkBK(kO|AVr-0tC1Pxp2NF$eq7OA8xDPd1eNaRn{LakT^|}cUVss}v zcg{EG%sF$;nVGYLC!Er8XK0O+KA!$&iSxiju=Ekt{7FEjEycGW^mU*=iw2VqIbTJy z$wSV!QP1_ygvGg5@+J%plgi@N7)maYk1+#Q0^`l-XwD*hSX(3L7NMI!w}Iy6Nziv= zT!WqgeGkT4(DR_T86#E>>*qWBWFo-G!VgBd8`g#gA-)Re@j3W_z7^f*#;}e^zbRW| zv;SgidK~(An|XA)%G!bpp~D-v4Tet225v_vzK79z%y)tQ5hMGG=Kq8b(@D_32%RCS z14(zF=Rre_p$nj!L2t0O>NtKIL1!?(67+n~dD2w3AsT79(`k>UTb75*U>H9Rc)*E* zFt>mcvKc)Inj@64Jy?&C=X)`~5eqqj7y?d82Rd5NDaQi&4|Y_^upG<3)Df<#*86y&j zBQd-c=K1KB`JJHo7_*Lr=xEMS^bd%ND*zCH3hn^r^L7c@o`aLYS0lw|1q&)IEdtk) zHW#m3@D9>vctNjKSds4+ewOrE1;wM5ub#)TKycNV@ZTccjrD3=`0pUw%Yh3N+8zB$ zI?Dnxc7a|-x(B;grPzXbz!xpQya5e@9Z;+ge9a!iL%ojld2B#8#xV5jWR-j>6oDSn zv-J?@wgM)E@W`ZNr!~ih^bZI=A6zz6#^u+9F|KzH44Y7wu@8*bh2<+PW9_zFYJ_o7@W-S!GL}fff7|#> zap>GHNOj>+a+(DHPHH$g%SZy4M)U(ic}F1 zadU#-!#TtmafhqqM}b2usOuuV0AdsUtC<^~&(oKkvd-3nsBf%#~ zFGdQzq~K3+5%5@fZG8WE1LcWKOaKbKUcn{Ot?<~(SK&d6gC^1`HXsfJy`)zm$KI6i z%lKRjBgI}x?tf*0cn}PcPD6p;C=1HCDTblIPXQmrZTyJnSODB5_yW;5Hsp6(Ow#_l`0Jq`K%odDjZUG<0 zFEGNN4HP7UPZ>yF7h~N2x>=bR!q|><>=QgK_%(~ob9}{yE@KCO!^o=`iu#tcPW-Xy z-GyrBrD$x|Dd$|2+x?u{T#AajL#I2+?FpU!sJQ2I=fh}x?|QI{d)u9{D3xt@(ortE PN$o5}V*pc8F`N7oR;Ou6#41$qg0Tx@)K4?v-~#(ut*9epftfK5#!wl zi8aBv$t745O#0vhK^_Vv%{|lgvI!4jbWir& zGvCadnK^TQW=GFhy=SdLtCc;I{(hRZZ_sPnqo#c3QP`UBy&&{-&|d|;sa@9PU?g?G z`XSgh&? z&wyTsaRGWB^!m_=(Zl=(t5X;rMpo_$y6;}(AB6f`pclsD19~BPXdA=*MEY$Bjoto> z(DeJT$6@Bt={DmFOYkiYU@;t>lK>t-Dt?61IQUu6zhdOIqPf4}!*mMt??PvYVw}4N z(et1igf4;R+$}Y}Vw}H+Kxe?`96`^@lcrcEI5BgXwI&#vIm@2|$M|u=y);HBbMp`& ztwc|OZo`-{-CK^4`JLde#6->@29G!8VRSU_aXA*)e{W-r&MMJ)(&#Lu@R0nSo-jMu zoUALRScq#|R4JKlPUx+2WMH(T2*{|y-Am2+E!t^5Y# z7+!+l&qeSWgauwzz7{mHZLy8X=xEky^bd)KdCQQPD&~yh94ZW|f%IwK_7*-vm{4ul zwoqXP=^|$}CwL?2k9b0-F<8~_5%~_%=P^>*I*a*gK;-Y@6wCrH zk#8LSK|03@6*EE4A-xF!sL{xTiNM#5d@KMBf)}9JAmp0ofTx#{zJdUBGJ;`Wr)uu5sWiPJ;s2&gJ?e+%-0wk5d9;h3M{V({(#gm#>0X?CAFBb zWD@H)jn5pX&MuS6Bw!pXVC-0=R%3$IB6tF+br4usQ7CUE^$rLv0XUnm?UR6uB4>>E zLYGXy&S4_HkosbXeR5tWI*|lpNEA*H^&tRV5d#-+PR0R`3LYU<##Y$~E)3vLQkRe+ z+pCew0^CWY&a*sKBM%pZ^}EYSea8mVM#0UI8e%LfboY?Df)&^qkuzp_Rt!o8><*FR zOji(@-7WYG&Lz%>-B+XE56toluYzR&mix2r*J>S85Cli~J}KIx=KmzY#mI z%^8XnNl(HSIw`?ll5WH!=CtAdhYDkiOhf?&ole2mNKeIzoqP@MHP~w+oni;F0B<+x zX6&(ZQRHK|9KqOPXH@Qgb%LzGJ5IU<2Hd1f7{iSb3VNbp+HFL3~pkxt%S<(fZ zDYqQKxCQQz;BQGE!`}OzFcNo>?gJxHF&RiaMZ|A9vJ_@0afIj+<3@wSmyq?jKt+mA z;xe9&+2DCHkMT{44>Hf^Us~EkrvAU;gWCcBs&2&xzIpw+ruc*@>2s0&c^@3Wc?ikLGRFOn{UVG4#uX@Boq~r1GaoH{j&Iq~P5j_*7&%o(!Om&T zgIC*6O;#Hkg2JYct>GZI`DL}r3(A{)t2@YT@vYvVyyXk)>!5Gz5{S!NS6HPW*|EaP S2Dy%QwZRJt0F|KJk@^eQ4e1*I diff --git a/internal/ebpf/execve_bpfel.go b/internal/ebpf/execve_bpfel.go index bbedc2e6d..5f4f6e613 100644 --- a/internal/ebpf/execve_bpfel.go +++ b/internal/ebpf/execve_bpfel.go @@ -23,7 +23,7 @@ type execveScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadExecve returns the embedded CollectionSpec for execve. diff --git a/internal/ebpf/execve_bpfel.o b/internal/ebpf/execve_bpfel.o index 249deb439058a6c1e71712c69cd4f3f8d8032551..d1daca3055c0d4d9a903a7a3998a0c1a9b0a1195 100644 GIT binary patch delta 4328 zcmcJRU2GIp6oBu{z_Pnt=nsF}2zL7?TYjs6trcY})UG1h1cXXRq*1g+2sH*%m1OEq z6par}Mq{Hq6r%4EMmDlBNui`ev6)|R31{ue=8YyiNxIy%N0zDS>Oz zH=t(FSD;s*_gRE)@gAwY)7t30Q@hNqXWp~;NiLV8XOPlXqu+x}aowi<8T2OY--EsZ zo!GM&Z#JQ~BBiyX)1vdZZ7uNGkVyo7R)t_~`4)zZHQ2%sn3ChaUb6xvZ-R*17KJ~)h z15c#)`Z#o8&3emyg9s8t+FGt}^9$s26Za4DujF$Z_bMJ9__xE7Ly57__b}#T^v}2& zCP@Z;0k^`kmHxz*V9pVCLfRPDchIq>Q5|l=Av)ri4&|*f;H+czz!ETMJtz{e6T3a; zm_el2UqU9>2FH+Me-9bya7<3^A0d}z_)Kj#@9>8>bUJ1NDFf=sLUgxdra}YC8E{qY z!3!At`_?8uSX^>I;Jed5ja)gpLW%OXPMY#W~>g9LYtJyay+C@lL!3_uVw*) z)CyO@vJ7JPAG|xC>VP9~v)VP3$)L!Kx|M9?IlZ>&)Q&bdamY5^Aufd_)e^81dt_h! zBNPr=4#f{B_5s^WD4!HQVjJe-+rJdvV4JIXCjUVrm<0F+hj`XDN#(y}zyr2PD@SLO zneDcJ@QHte@Cn=G$b|5N@B$WkIK&k&+sU86LF|b^V@7@E`LEMacEp%*b@&jD4;V9{ z0Y>1GQQJ%@UxG`=n1OPs9Ao2b0A5sHpaw4e-ZoL?Cb9oyn=^Vsc4+hmnLfvebQy#@Y#%303AMGG9$U%&&fD{m|g3vd`I2r#Pr z8upT;W5x@3LitndktL*q%t*Yi;kj(}WC5o_T!K9_o9|x+Ofeu<$M>xc0e34W+3t}v zGf>_GCssP#Nt1$+%MxB`MhWA_aAgz4LQVdh>}{_}j`BXobSk&P@mI-6$R5Yut-MqG z4?CtO#BsP+dB51-a!g-{Z*!!EH~}A1K7oDF07q(w zOW|SVG3@pcm`un7%c&#wAbSic8EqFn%lc1f$A0M;ipLEvE_y%}))vW_O~#~@yVn$# z#(z@l7ZK0f~EKWvB=)IwzjbT#Val|s4XrBPSJ`BGrnGJaf?}8 zB<0tsEv_kIahXAFVf~9&T=L)lw6#UP|DqKaJ&LEREq?tMhhh|$8Pt}1{g+}>gyJ%N zZSfB_)?fZ&lPUk7Z8LH+e@3JY^6y6YW#vib)5>W+U9n$Q?twSLyQDJFhLzt`mgDxC z=WNCC#y!ZZUV6*Wp}QYnXtj73ww<;*yrbJ)tH-N;*tO1kN4Za-&-d2tIAwkA{j#G8 akLsNpt!}T2d(Jz`z0teCJ?m9>F8dqDyj_$4 delta 4349 zcmcJRU2GIp6oBu{z_Pnt+ERg*1n2@qw(?g5rGmhgpU^63mA`5Pi%=*5r3wBJF`0dk z*d`d844N7>>4OiTJS^5|gCXpc^ymiT4)+O&`@}Tvd zH)X~V_ou*Gd>7IRba~tJd0pp;7&9h~EXBA0DP=0U^j6AKt$GFeN^~2UYpsz+Id1|#jjlM$bo6%RJ z)AtzKn+Ehcq?C>5lxQ)pO?f_Re3LPc2R_SuC#j>O@v`b%<}hiI>38kILmgHIjP3`>W( z(k2SF9XxiwW4e)Ie+8M~c$`3rUFswCj>#g${yuU}+L%7u4IKUuhepQ?Bc;Jyq7dEe zm}}^{1`}v7qISH3f?wDkg{A#+Wa6@8N<$ohlX?CrR~?>0#=d98>L4Ms37Kri!#b7> z^dr204akL7xDu9a5W7F{6G5nR9D!@qu3ee5C`{C?G+XLK-#Lp*Jp3T107 z4c6KwrCbc#8*EdnyioXE+hmD^wBHO*WaBwLH@FP$gJr@;uqV2W8St6$U!|h-ZDWSi z;XOFsWz4X4a1Ji&v&}W-t8hs_D^Q*!*V`Z?GjW+f3NE=|o2c>%v43luQsqYBAr>g? z(qJzYWtVM}R0rW0oKnuMuvXc{ZV%h0Uima!$;msM=bur2i2HGJ!ZDqB+y%QbV{w>> zLtkD81Iov+7jcw_@_1Oe7kgwP;UF^7-+6d^g<~r6I2qz1?CG(LFAc8KAU2inTOD%T zsyvRRNez8svL77kFz0;V;>B$_zx++A?;Iq-edLq&sB_s9O5`c39THOJ{m+% z1$!%eRVKuduTeYe_Diku2=<~6jY)@i99*wlOg=2@HKtMaQX;U3iV24u)1Yt5B0@!%@|!r^af~Z9#0mI> z@(0)_cXFkMxCHK1{sy~!93~R7z;g14-NhM0N(7%2?q~mpwc@B$T;PgTmYdDyW|IUI zPA-?=YAy%qS2_}|gDYeM7$}rne7jUjsgW1VOdO_vq z7KxZm#3YrwHzk*vze4LL7r2y#NT~m9a=DG%;+g^`7uoTkFnQVgn{x~MU%2FQ8@a{h z!YNpCVa2z~Ep8!`i-i0Zxy3aFOfLSO=W@wE=N9(AaLFY&bfe}L`Th%*T=Xg)Ew}jj zUmOaNTy7(`5PuGdB%1;xm(g>Jf3Y#X{Kb|?HSuqz7Wn{wMx=Brw<}*!KC7JK(-r?; zl-uA{aI<74O0ROKvRt<}jk6KQ|8F2~#oTJ2tJi)&r+ qI<~lWbd49^dd~XVySQ~J=GeAXR>o`KJ>YfluJ_LKZuVkLbN&QqJlv}Q diff --git a/internal/ebpf/exit_bpfeb.go b/internal/ebpf/exit_bpfeb.go index 6750226fd..cb7458b1f 100644 --- a/internal/ebpf/exit_bpfeb.go +++ b/internal/ebpf/exit_bpfeb.go @@ -23,7 +23,7 @@ type exitScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadExit returns the embedded CollectionSpec for exit. diff --git a/internal/ebpf/exit_bpfeb.o b/internal/ebpf/exit_bpfeb.o index ddcef7823a22cd096baf0aae0883e8bef031d90a..0a2fc972b6eb391e6fc367ee6eccad2d85cc211e 100644 GIT binary patch delta 1420 zcmZ9LO-NKx6vxlK?>?IkGba+2#%Z8nrm&od(o%7D4HD$Sg_}St$wkpXUjqj3ksEgn zTotcvJNnorP{{Z|Yoe5nMD|#w)U3}3hJT7Y54X2z9p zD9nT+3d7IAzYi;+5TP-!pM+mBeir^i_!+1R|C#YC@E718hlLSK7*4=up`YOIg>|u< zsOog2TYS@(BPnME8{8BxI1Nq0UxVd%7XEiwjt|3M$3)(Vm-q?W1%;?z z<`5d-|JhM<#;>uZUn8kO=OfKcyNT>k)U$L$v8;VfcSX;N8`_OFizQu(zOhDb73MG2 zSCl>!OF3N4yR#gF;tK@F_-G*_4LwQJV*{|6$9ISZ>%d&g`E{bJt>Bgb<5u{qxAR<| z#j$aGOL9aG2V{a|VHcvqeu3;Kd6x_G0p0^H_zTJlL^pZCNt1U;mY81}o+CNUTrs>z zvWNMz&+vR%CCBSXeju5PAhuy9{3Uq~6Zl}bK`Tsh5D!S;i#@J7pq=ZL0bV06q!XffkuTdRgqH^ce00CT=( z_$$#PZU7(T&1dEYejA1@$MLYRzhA%sbfl6#s}vD`p~@N_C3=AkRnG7|oHkBK4H(AX z?Nt+aD8Nzhu;HgfZ*hfc%#2htlFIDhY|aEmOu>N9TOIQ8c?&!?`8@0?{Hu9kh;lJ7AJ#EDIp5y2P$wSf+WyyK kNSEX9#e~kcb&5${ZtD|qUBg(@=|rC>=`oBUT}~wb0me72WdHyG delta 1426 zcmZ9LPe{~36vyApZ+^CaOxH-%Qrm-ILgn^X%fvkd?V*E*f({)v%q+B8$b(Vw+b*HE zg|V=R*n`j>f{OJZ6trTLphVF{A;JtwD8f^PLG*pUndFzl&b;?|@6DSxZ+=_qoaxN9 zis2^-&lNX{kKI05Hyt8>G-7>e^=;5+bt2Rw7W8Q7lK7}q_^SA>v*Bj%2Yfp)SIdb6 z@DD6{3r(T0kRDfLoH!Bh#80e8ItWu=wBh(o`$}HjeHWP_zBsL ziJ^YmCR7l)VqMH36XS+VjHC*kiPThYL})+ad30bRt$SIwM~{jtIvcGKvwAE#6+U}@ zp!eeG3%z@ar^-u8Z>ehWHk)AHN4qd_55YEWFou9lAmL#bfFpgrPISBs%(3iWAsVOy z*9I7G!*^fvb9@rbLlf6VipXPwY$BQ20CU;|$ZnE@oFEh6O7M_LD0_$oIpMJN-z1r1 zp0qqka+JAbd79)t<~N3+nK4hEUy*!EG8uslH{pUDN%9Cb@Z7o$luS*1^lx7hp14GPYvgr05+f^6*sK#r+SDRs-)$9q6r+R zQkI9&ZFER=TgIR6SvB}%fTQ5F@Ha>vwRnFvNOofI`!GAVee|CrxPjaM zU;MJ+e+jw0{{B_7Uxf^-7R!lsoJ?6mpAEn*f(LT@nAIce&p;l)?QOv-Yq?cdx$$CC u_0ux(Kre26F48(*|4NMLa}8}Gr}GV6qDe1eUD5HzE|J%1tTCN$jQ<7H&9Gho diff --git a/internal/ebpf/exit_bpfel.go b/internal/ebpf/exit_bpfel.go index 960bbdcf8..af3511b69 100644 --- a/internal/ebpf/exit_bpfel.go +++ b/internal/ebpf/exit_bpfel.go @@ -23,7 +23,7 @@ type exitScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadExit returns the embedded CollectionSpec for exit. diff --git a/internal/ebpf/exit_bpfel.o b/internal/ebpf/exit_bpfel.o index 76a4c23c7e3469416681f27b45a4730e724f0428..8ca470c6d5ba61f285d65675ee0a819ea67fb9dc 100644 GIT binary patch delta 1414 zcmZ9LPe@cz6voee&Wvx~45K3>D(N(pF&dgin3amN%Ot3U3pasNNCibg{{~EE$j$7W zxCOHi(r96zQR*TnX%<>S27;S`402J3D+7a|7JcV=go}r{@B4n|-1pv{bMIU3Ds<%< zROU_Ns8Z?}%VYR78{PFZQYE2kB7>X#^ z3>}5>6M1^z$KWj}hZY}$&x=pMKZkFHW-wlfFTlTpKLOz42by{^%vfx7VEt`Bt}h3C;N-4-~f?&y&~m0HqI1B)fed#SlA!GcHEhwIZJ z%;9Mq$1!;6oa3HyG{CoEcssEM;Rj$}-|k$lZ(-EjB&wD=a}XRe*auF4gL|6+kNruz zi71k#DT@YVLN7S@(4rxO%fKlxzwk2ZzPm(Osb`q;7QGdoWgfTO1H>;}VD7YNRq7Bo zig>@ffX|rV^jNfwG~e)#Z@7R9{}YJ61WoRgZ<#5FwYB5;4~TR2X6|0gI2sC+BVn${}E=b zo#OuENbw3e5kVp*9EV!d*fZflXm}obCj1EML%%Nxk3lQn6ZIP$01pVyK+6`1t_y#J z`j+wjAxVUAZmU*^QU*KVjBpFrv4L5G9dJj=m1Vdj10;5M5#aQn^q+-|eZU1Z*Ya@bf5^ARXV>po7Lmqbz~a68Qha{HKH zN}aoP3T*FwdCrpRjW5}-PDJo O-72q>xY~L$8vhT>Ppo_Z delta 1401 zcmZ9LPe@cz6voee&5ZMpab_A(OKldG3E5a_Rwhmm)S`upf`S$!VisBnxiCte5yZHg zxEW1ExDawtM2rg;K@&y^N*FD2AfgN^C}LI>2GRG8S9o=p^Sk(gr{R6da$Q7g# z2{u8;V0zq7L<`SJ`R7^_$2%kd^2LMN_#!->>w?HnT=qa2zd0b{ z4dJ5P|IXQ0DxrvRgf0uzM*3HMs2u}%o?OtafkWz|9tl*cc|9I@<~wy}p!Zz&+1{PG zlfk@8Z-{JBF?}Gi-i~2Dd&$@i-;Q+e$Kwr;fIUY=_<5`sk<|ktRSph<;|}(Kli=vu zCctxF$o0swK}%ArY)cmgf;Zd*MAD{yjhwM$#_$aJh9!B!v*Z>_ z77as6v4krZ@CxZqT2d^rjgzttHyp$$Ud9RKVC#q_VZ+VjNlVgD){jABQgLGT>e#tkztkvk%bW&+s<9lc{0CYyh0n#Q;sVJra2#xNpb5shk3BOJ`k|3&?3v*-)PsI^86JmLJQg|b-~c#f zI0r3%CUV;F0@O1nGH5u4<65~OGVBt&v?31pF)(T-v~mJAkT2!}$$oIga2MEmixwMR zJG5bZBo8$IH}nbQH!!0LNe*EP8Qh)(-Y+*{7~Bu%4Q#*j2DaN-XM4#jP=*(aAvZ!9 z&HpjG%X*)wvzv()46Ln??c;=pW&+!_8yv#dGT0q*BBv_ec+@>z*!V=HbhhS&8q?ji cZ7QR)wVkS77jP}=>bg!fp-JCzX0}()mMqzgEyJ~J%PncO>fP0&B|m7bCA*Cmd5|U32Al5DY-_sF z>}+dhcHP4|aT5$~z_G`~;Kng#aExgvL#6_WIt0*E;XoItlBwVnow5s092eEZPGyp! zpp#H2-*?Xcbf5d*nU!S;B~JR*-u}+-JMYIm-#z!9x%+_!PQ4`_j|Jl+7W}oiJ;m5Z zw6E_Tor zb|5z(+mJ2DCS(J$23dhDLC!%IAq$Xs$Q)!AGK9=Prj4v)oWIf)lc91fc*KUX}{qoG$HAUA?Uy9lE zXM$&j>bg*mHy~?}6-Yb&>hU>n5wZYj$6q~eN-XJ^{uUX+-;TdJ=ASy|pSo#A$rtla z9rI5e^G`jtYvacTkUNll$Zg0TfOA9cvs7OZ}OM)lNw^75?rV9efkpw;X=jQf13Ad_PPwx zNXN-nyK++N2r@6KsRq?3Nm>D+76xjr|U z&n3C!vy>z0$}x{}EX+sld%~-qu;o9f9Z1NE<8h)v@cVZ{ZgeU2R zsu%yP%K5aF((V;y@i+O1e-mu-5pIDCDuvr%laKHQcn10H}w@GdwD z9)fe=J#Zd80v9aXa$J~?6~QU^&wrY; zD+rJL;>Zv7b>7-*iLb$Ayu^z(JnZd!ya3))DgJrz5S#<=f=xNs)3C?$wp_wH@HgcW z?t@Lagtx&dmBKx+3gs=!wp_wp@E-g(!9#EdybIm{55R5k4!8yGgPY)Oa06`0CHdFD zTkx-dyWkRd6Fdj*fQ#S_Z~@!~=fN#-4%}4vP0mjVXP;nCoE`n(Mfby)XXJi3)b!>4 zIAi3;BJ=$7S>G;cdhUK$*0(>be4&f`%IP|{W!j?_GyN;;>jv14vs$bIE!Z|9#n=AU}Z&OdeBFHP6E+Dy}R?sT22<6ysa z_jH{r4KrQm+WB(2&YiAvb)t~x47)02UAm!CcmQsLcfc)hAKV0QgB#!;xCY(=SHN9x z3A_oO19!kh@CLX5ZiDmS7B~lPs(hi>xlhe&s`C7_WrVIj_tZ6BhjyRYRbIc#u7lnC z7kOT4-`_-^)9zwjoxy!^WBsS>dSd;PNasA((T}}g>*#~t6YprbFZ{|g1C>uU^jDr+ z|H^ZF|Kq(sG84>95WH8@xv+@mO^bNWw213&5$|gj@jPh}&yg1K{AdyHYZmdoW)bge z7V&&&5zmDd@jPe|&w&>4{AUr*eHQV&XEC;E%MvH@9xtU#6^=OBxa1;{*P z4$_QoDR&6YK&By6kSeC{iA^g^*Uz#(GUIFdp4beCC%pH&)Ah5?6Vvy^W?)R$&(rm@ z4ut9Y*<22|UmWkZy7)bDbieb=^Vsif-mJOzM)E#*QA^;~-Lx6`PH+%_nndbpXPASyWGCw>HcQZEKkUD#*w|9#ER=RVl%WA@guHO=Sm;O};) z>sf8r>3-&{8DChR$~rXzPD7?t%KO(n!`RpC?lY(BS#6c^^R4MV=IP(-&gpoN_p3$7 z0;IK1^_aCw_33)nwu^l(Ci97%cc$yv>EG+hz?lBMF0PB|-|G%_o{;rv*UT65cK@63 z7I*~zp5^I!*0#s=JuJquYxxi=S(;J%pg>~#BUdKM-b&UIU>?2;sKH_!kBVNZo;&tpJUdKM- zb?oO`$9}$b>?2;se!g|==Uc~qzIE*9TgQIBb?oO`$9}$bjJI{{=UcbWB`&Pn=Mf?s zw*1&fydJB7OOW)1!U9?Qeu-bb$EK5{)4LZ5+5Lz?xQ@G6$K3 z3?Va+X_e#mu=qaH1?=;c`iAO%eGA{4!uMQw|L{{LxAApz@IK;CU?1_vG*#Irzi#>Z z3ic;Q(vOYzC%f-U;ksOTBnT4vDXaOH+4yfYwFu%1Pkf8}lJBHA&j zis}1Z%wu)TW7GApoyY3-`j&NYs8{R@v>u+FzTef>l<#KBJi709u%_>KwRxuBuS(nf z?ehM$qYWbK%aTgrO_jnGmBL+>!uGyp-mXK18}RSJzX{$3x4?aH8@vPF01v<&@Gf{0 zJOp>ad*Chb2;8%5@B5^D+u#)Z``|Qq2b=*9z#(`SoCOcTIq)7h4<3OFmT~_%{eD%5 z_CR~v^@{wRE&9W*TZFeYoO~ZEh44MF3K@UX?^oIOu+1nHR4KfxQvA*RmhcdqQz>ljbHqOn9>Kq0dAeSr9%%3BdKv9ewC!Wx zGs^RT0=Nx-Gp=NOwZLZF2{)Dh4%W+dT)Xc+zsjzgFMP({&&zw|j44O-`_Ip3{cKhy z-uih>)0cJgu92U!>*yydO7cGLbIFOOSJr zMaTkV9x?}+g$yAxkZH&iqzb7&-Z!7ee0Lu6;CalC=P_@d4|Wi~54jE5gWQ7bLT*BK zAU7b}kS)k2WCOAWS%EA;&OsI-3y^up9Ap+Ugv>yuRm%E#*YFc~Zshh&yY=+C`o4hc zXne2g9rHHb1$@s+*3m*)K>%`b)D`?iN~f9u>S&FBBNMsA4V5IJ*&-SU8NgH)H zR{r8JwxkH7|3BuBNZ}-&`8H8o*!-W1BL5-W1(81kcT40a;NBMbDeE>h{*1V#xUquB z&%<32xg}>P`j*IlY2Am_{kv#0ZHH~Rzf0Wz8ttdTsJ%M8Qgl*W8$ulNPt!JI2fMOO zyJ|ZZ%_YtCy$|I5P9DsZa?qag!d#-ty@97^m;lf zryQ}D%8&MiTmvz!r@Cd#ndjSD#!%dE7J0jz1#!PcjsbR~G zCA@H?{y9Odr)h7wAT+4t7ds>Jh{z}8f>zyeIn_gtJ0;3V)I-boJnE7BK}k>R)RI## zNI(BOB%d{RVLtME@~y%eAQ2&7nf`crQqEA^9gzilrhY-B>MNrEj6~FIM5KOIKDm4j{yGNPU*cc>WAK-Ly2xMp^ol=$ z|M%?UFY&KT!T;1g{u2L6SH1`L@t62l9YOrLef%Z?JA8 zK^5_maq^P17}^s-?4h>?DAr$Kf&YG_2B&c(z$AIdgW}Rym0oM z#8_QenO|F|m95A8%3>~%pJV!STz^gkk1fqFt_Eu>=av`d*Q%$3#{B8vvHDVVdHzf_ zm_OGH&gC`F{3OeT+Wd-3*vWFOI^PH+(xXd~#@fpKLbYt_QeK&VUwL(XRclyX2^P+t zIdgWoZ0ZfSEdZdgQmvk8tfBNySw9`fKPj%XjBAh8+S!%0z|?%KGqkYQ3~KYsr1b2oA4Q*Uqghhe$=^&ac_f+1rlg za^dZ_g!esMe#`xD{{H*JTW&uRW*5#budapKFySpXO95_slNR;|bMHM8PUu*Kj=%Tj z*9Qx?+bZ5}`~7GwIDB?Fd}Ao(D4&^cl$Xw)ef(UbTwSW3$=-z4Jrdre%_p&4IVH+X zH-)#HT^3dSu`v58^_TLR&d5ISu7~Y#d&k@Z58n6i%{K>!WnhIrQe8PKIprjd432~H zbmK?6S2ET}nz6}6qDfli@}uYKOKbJz@|o(H)#_SS)JMYHk#M#CBh|ByWpB}78b{=9 zZ!(=NnHlMn(pJYrcjoNrs;A0{Dl23C=F|0+$4}B1691sGlycE!IzGH5$g1>)msW({jn7chS<)$db^JP|A8F zJURE4@_i4!TcYlJMK$Ydfg~9j?V>wiu#bIQF;>q#dPYJ&wsQ7N8M*Ud!SIz#WRT0K zv17Y_+O zw`zuN^|m*y)z4H{*XGYO%FC-L&Eu*oYiBR7n(mcg(o)iM5%fg6RM`a1fcoXkw;A>Uw3UO2(Mzwt)5d9kFpz;5?e;8 zL`E_;K?&jVu&G$JO%Cb0tT=U@)TFO(dy_iGoeefEx;DT1xF#$!!sP*E>jb>DI` zC#SyJz+R|8N*rjNgQ||}1(`bJQkY*VH|F)S3l>+-%DlNGlY$r>OT6$vB-%-wq; zIBZLBKoqZxZminyH%sJW!C~#nhV6}LjyBYhQ0r`Rx>GI!>7P+rfpG1P%%> zUI_n9SfJ?jt=X7<64Rk}LfDvGoiL=3FepxYY^*)*h1F}shCShFPl(o7H}Nt?O7hWQ z&TyGDo%Is^#0a4jV}&FXnOqhc>*ku6m?fJQTPe*9I&-P)n~2<)85<#WRTpfnL=`l# z^cvFX^0eGL>~CXqWN0WiM_Y4{)%j1n_Pv9eU%SLTlz2MJvfqtUc2!LI!7>c@D{1B zj2}#FdLLP?oqb=Z=NrQde-A@#(kOCID5Fg~g>FN#H%XjvH;Y@$CR*?OS-Haen@)3M z`2zNYEGuoRdB{9_csJ3FnrV>dTKG&wzUK{NHSJHX$|qcs3u~Wby2zhG7O$n3#x+u`!WL z*DOnxtM79w6X!QxvYcHy9q}6*g>QAKA_?khMLNS+r|9~`X7AYnr;u4fN@*hM#A4Ku zqCEW2BM-j0eBUFbi|5pXI!n8l`s$Jc-nQU#8Spms{f3tr@MG^w4VC9O;3@d=OBkmU z7&ZRrp0vq+rH=Ue(IVB^XX+&X|8w=7Sg1SpGrz7!_Njtj_v68-x4rp+2jBTXa8&M0 zR)eMbLUnmnUl`yWU}ztf#q<%aoOgX82=4C7(>#6VD$nO)9}?-Fvz?H~ylWoIS7|Q$ zV~-z@XReDLzg1Y@6S??rlV`49_xSDdR5A4UdxihV<9En2P<^)R;(wp;z+-v#eziVc zbpDUXGtqzLu{@8zM#?z$f4A^|@mQYuU#rg-UHtb7|Aoh8am({@(*`$)TaMUg@O|)?g2dBtaSv_! z3F-G!^6WIe2bMAxr925qL-S7@34;5T(>8wMfgmv_=_NAomwL>-PB;ty&jg8*`WL~H z|9d2@M9B*;@8%K}>n|lUN1{gl4aDCK5?|B&n;vWWZ3@3({ga1+#5WF$ztn%+A5vd4 zcFnVTt51F;2-+tlYbl$CGc03V`%&91u`6#iBwv01HD+zcybUiddlanyxL-?P*RN79 z(+|qpuc%k@i$OB2>9wrCxa_fIIk^|aJLa55)?=g~SzeA3Dp1-tba+l%{;r|V}q@;b4qbSb= zmQ$G^af9^VObEU?NQ83T&g6*;9!q*N74W-)#A~F!GcDpa`0vXltm&itsXvfQU&jAT zAO4PaJeK~Q+4ES#qx`AA3KBWt*);qeXFQhpvsufB!yu{KDQ1h{Q$bSanb|q8l)okO z#%#%BjgR^rUJ4Q)RR0?MmDRri{s%H;sDIOA^+$Ug?gWVstA88*%Id!Xmj2vO?s%-_ z+XVk!kofpZgu5PV{kOn>8YDV0K4yC!%XpsM2LE-C_>_#d6!@|?1c^=I%lg*;vXvlN zQXYakLGnGq(#4bcOa1>?6t9$14xQID{HDI+OL=@sIPI~#W7c_Y9R5b(yk&9OqhRxW zF7uqGH@07B$GEd!n>Ib99_TlDbe@Sj`_%_K`!xVN`!%xVbM|X&ublltea7}HwDHIG zD~tGZuwPPN%|GGnR|)LwSIrAA<0R3r{;vFqCi%Aze;4+v?XirTM2Es}TK}>AlKPMP zL;BU+Tao?hos`^DHk{h8-qe0g?H9)F?9_fu?bo-N{p#sFr)$O=<&;C`zsrByEM3O- z>hix0f*rY!({C-R{}nQ44`e=d_G-*U_#X*^FYES{3V20ssdc|s&110vdS7nRQ-8IG zn9r|J*79J!Hmv@ecD^3l!yee(_xC;4`~Dr9{@5Pw!5{X}-M33fbHq~chdp%n?Qz&c zci$d|Jxs`TujL=x!wT5hL)3R{4_h|8bw!@poYlcRf~nxJT)YtiQ8|dfz|ppE#Z+kUbool#Hd_G@RPQ(bOJJ?V(&3 zI*zCIaJruRc3aPlWS+ZH<~_5|U4+hSSH3Zb%@qVf%i^*}){gVBJt}~mJ(79Ytgqa2 zD7h|7dLId5*Qx!i!QZXVnwF9J_&L>heYT14Zhf`|cI&fUo4(kaSXS1--t)%T5j<}+ z_65%q<1*iCdBk4Ca{4?`=JAOALH)$8*yo9PFTC29f(`G=tIr?D>8U^JFVCaw^F*n? zNncs*kJLXBzG3~H{c-Cx)Bf5oeU`C$+2>{B1??9(3R`($A3kuDL<{11CIwm8U+a`-6GFl{Zl#f3ZJfdnESKJzq5TO6^mN!nbYsv3=UI{-*u4-v*Ks*{9A) z(V^e8e>+qAG__9{ms9&RwNKw}_NgQDoY?~s%Dg6r&fizx8pQtQQ31?zh6}=3>n|>Q z^AZGSoG!Wj|qn2f)E}IMB@9a?*?Cenw?CjAl(*OM+ z_O!QNy80_YtgpOh{pI;yY)98mBO8DG{7y19_5WW%?2Ed7O2gm1&q962>!*SjUhNa= z@5-<1rEz+m{Tk<2vHs~(L2RJ!%^H*+>OW3z1L1!>h<*8536J&|ugA6!e;4bqZOh~M zeamBew}im4oyMp+UGn0AF@b?L)?Yw7L*Jl}zHGbZ*xa?7|^Xu3i;yN+*Pwdb5`Jl6h z4IBSzXAd_J-`T^>==}Yy?(eu7_E6Vj#vZ{Qs(n*-_E7gDn)Q=guZ0Nj>|qZ6&K}Nz z-FmI!g;#r5io$G+okwJ%g!Dq z(>6WR-*N19C3|@P$sl46@1NSksXfGXK3)G!*MHwm>p!)J_scwI_VB-2<~2EVe!liC zLHs=z1X3QWeZ>4|{M9~+y%>jA`xwe!JPnHJRts z?wP-Rk~uOdbGWYi4*i-)Ig;D*qbzf&9y2ocDW_g*FqkQV9|CWPl<&-?w!s7No@KK~ z{YA*f{2k$okdN8p@gn47-qpPb`Iu*6rZ= zqHy}k#PiV4P4xQriS9`1|0C3s>FeK9O%AE=p$R$H?3cvl^j>`rePp87{mSl0J~q(@1E-bN{Naf{;k8fV z*FC+LzG;8?8#_K`pB9bNd*Ns5p59A8`E^g%8%1GjLQ5Zzvk(^_CJ)G=#!xdYJL*KiQcc*p;HsR zJ|}a>p`Y;d+fJ)e#)-T$<74(WMC0_eiSLa5y`0ng{qpZUeRmQ*sef;W@UGhGoA?hC zy-y6Ck@o7(=cUqOw{<3D|V|G(CPVcw>J3YPM{{P0)`|W@IL?3DYe>c%b z+W)SJKGOcW-a~mJ?f>D4KGOag)`j=l$JF;F;z!5q&x^w8D-+K{=O=po`)hY3wU1o* zzSBzTw@>tmil_gCr`NdSL)u^4h>qEx5rxzH?XTCD)BElJho0VVe;u<3A8G$Tp6Da( zpPlFf4nQ@}mFdei1O%zV=_sa)7z1J`16Z|f`mwxiClkk4O zB-K_Ue57Am6Mdv#&P?=?e)+wLKGH95p6D;?msf}%9kX8*h12`>-I(b0{f0Y|S{@gE z;Iz`3PfYaszQ!Gi-}3YorjvwtWi zdMT2BX!zidMDOe-JQLgE_^9ZeU4!1F{|BOXb^-dN$hd}g^QspDEz9UkvM{r_8+ePLzX!u%CWc*e}nfu%BN+*bo0gmq+vS(vPKt z{ql^2U(E7kqvZ)&RG!9*T%KneKinS$DWBJ#rtSRpd%ojG#}}vX_gDW#ZXd31SMvAE zGklTDGbj1^?bC~vN9U;*b3CWC?{&T~8OyU^U7PBB;doQr8piSG#jWkzZWwX!9RF|@FCCtl(==ycm8@0q;t39C2_yX+y%hecWTU$$Cw=_@5W| zNsoU=+(nO{7WYFQe_7n`_V^p(Uhw#D#I4Vfkbdk6aj$uNgSanvtk;81!Y+J)SjU6! zUm~0H;K21w~2R%cZv6+92fM<8&4C5#5v*u@f>l5xIx?^-XPv2-Xh*6-XY#4 z9tnHnRrjq$I76&s(+{s>(PtfdK9`7V#7*Khafi4|+#~K24~U1vqbMg+#2Ml&ah|wH zTq3R!H;LQC9pWx=kGM}fARZErqCAr#&Jbsb^Tb8s5^;^VN!%vx5O;}t#C_rc@sM~F z<=GT*hB!-{CoU3~h-<`6;x=)IxJ%q4?h_A)hs2{OA4(Bth_l3b;v#X0xJKM0ZWDKi zyTm=>KJl)wXMYdvML8wt`=`>xA#sklKs-lWA#M=2h&PBgiMNQiiFb&1iT9#xmb+g2 z98QyeNSq@s5YG`;h#SN$;tk?WV(oA5{^_vxx6cFOA@L~6m+1iT;$M~_&JyQ|i^L`3 z8gY}jP23^w68DJv!~^0X@hHldr-(DeS>il#k+?)$BW@D6i95ty;vR9IctAWP9!2?z z6mf<)OPnVz5|@Z;#7*Khafi4|+#~K24~U1vqbOgQBF+$JiSxuo;u3L0r8M{6y>W@#2Ml&ah|wHTq3R!H;LQCo5J3D@Tx81ZQ>o`UE;kco5zw~`d6pP zKP1i(7l`MGE5r@r7V!r0Ch->WHt`PeF7aNJ(}I5crd8p!M>-_V5f_N(h%3Ym;ui4+ z@h0&WabGwqC)V5P0r8M{6y+2xJ}$4 z?h^Ni`@{p{A@L~6*QJOv#987zagn%0TqAB0w~0H%UE&^bpLjq#BpyZi`V?`7I7^%- zE)tiBYs5|BHgSho=R5Ct=k?pfJH)%hdr^L=pr77L)5IZhj<`TPM_eIp5Vwdoh&PG1 zh_{J%hv6Nkh(V(o7o1F$zQ)Bg5Z``hOxvG%v`-y!Z2_lWz%1L7g^ zD9V`>afUccoF^_4mxyb`P2x6jhqz1JBkmIqh=;_ZD1S$aI76Hz&J!1jOT;zeCUKj% zL)<0q5%-A)#6#jylwY1A&Jbsb^Tb8s5^;^VN!%vx5O;}t#C_rc@sM~F!m43UPzDMZ7`0NxVh8 zO}s0lX#1Gn|Oy<`@1M7?9nT=zdim= z?Qfs8zkSXU=ZQ6}AHGCfBW@D6i95ty;vR9IctAWP9!2@PQp6eJEODN=NL(VW5jTn3 z#2w-;agVr9JRlwtkD?r=h%>}l;yiJYxI|ndZW6bNJH%b$9&w*|Ks+QKMfp`J;tX+? zI8R(8E)my=o5XG64sn;bN8BeK5D$q*QNA%noFUE<=ZTBNCE^-!lekUXA?_0Qh;_d6 z_G{d@OS~6lv+d3c|LQdPhr~JJ0`VMig}6c7BHke0B;F$4Cf*_5CEknjYXtrFdQF-* zB+d~Ri06na#0}yW@doiG@fPtm@j%$ypYxg_@hHl#O%Z2^v&4DgB5{ehM%*NB6L*Na z#699Z@ql}l;yiJYxI|ndZW6bNJH%b$9&w*|Ks+QKMftWAafUccoF^_4mxyb` zP2x6jhqz1JBkmIqh=;_ZC?8D`XNa@JdEz2*iMU4GByJOTh`Yo+;y&?!ct|{o^6e?& z3~`n?Ph2D}5!Z;D#BJgZahJG9+$SCo4~a)n&ZUSm#987zagn%0TqAB0w~0H%UE&_G z&UfB^`rIz@UX+gs`r(hIi9_NXae;V_xI)|@ZV_(~ZxU}2Zxinj?-K7tSziVE^*^2_ z4vBNb1>!m43UPzDMZ7`0NxVh8O}sKJkEfNIZ)29Vy}rah5nwTqG_L*NB_MZQ>4bm$*mVCms+FiAPbsGew*s&JyQ| zi^L`38gY}jP23^w68DJv!~^0X@hHl7rHC`cS>il#k+?)$BW@D6i95ty;vR9IctAWP z9!2@?6mf<)OPnVz5|@Z;#7*Khafi4|+#~K24~YL#*!z2-yuR1*`8r~K;OG0_L3}^) zdxX9H-T5Wr_Y;4Z_*2B6C;ozPR!%Lq9QiNGkI!Et*7|z>_h>wywZ1+d5zfnr^zV5C z@hM`huOEJiSnKQie_XgIr%V5{#J@%S1>!Ffe~tKWguUmP_g+DK1F_cE5B~;Yt*`HY zTG(4J-n&NpL1L}1AO5q%T3_G)X<^U)-uq?ZZxCyJz3{KUf>`To{68A|N3oxaeInM0 z{e0|`v40%yC_A{}M#WrHW(Y0!GEjYSTT{?R5 z;kO)BIK6VVQC>KEZh0-J%`cx`s+L#RSIgCAeXV@9QC*(5!PgqMi+W*xX=zm*5r040 z@>+G}lJWcienidh-11U=`SDBTI1b@QHA#+rv~m}fHX6i_tog1;HP2KpmG3x&AJrr} z_BlA;aggfy>hjuZaP-W4V>MV^Seaj2sFiEg`NqC2Z@THCnz(+6L>V{g{&6PWe(@(Q zzJDyw-;d@s<^J*f0H|bebZP1QnezPU(<`g>#bBwvP+eZFMyfFBhy7Fa{4XkvZQ%Xm znbIJDbn~N2)ziVz)wPwi`A0>rpD_~GLvZSCZ+_sxcRmoDI(hP*@;xf@R@`mHT~^#_ z#W5%EuzUh)$m2jKfyb=O0U`6{yk>Wo702$d@;DGO2ZX$*e7DBA+lo7_kU|;l9afxx z)=A(oEAJ^EyUQkF<(*(j#41iW#n|B#$Kc49@3aLsLJDr=aVw5N=75lrtqFBEq~vB} zJBQ?E6=R1}NVdl3p7I^G;6~hONs4Xo4l7PT>m=})l~M>KVWs44SnF;alDAci9Zn&I zFh2K`PuM~jai=ATZ}0@rN#HTaJIcpQFlizMdBVjL3HNEsm3W9)DW87ammUp|)8r0#;0 zn1&@!BPGk681xtBNa%fSV&Al4ul!4^KcwF*^bh^Ef;-ghc-AQ)3&akS&LL6%T-?tR zU%%%RIZ_jfeO27<`$>g~UR{6I1#5HNBB!gTi=URP|C#6y$lv^3zIf~Rh9ZZHFUpvH zAM>F6b={#yMNZA%eMid0*K}9pJRtw8GvX(Q`A(E|+Fuu6X<5z#^8bq7bL-*iuYIkD zi?8|LE9U|EU%RJ)FJ1pYzteV5{xuVQQhyiD%YSAhVGhXuI}u&Kdlflcd{NHm7^uezF?t5A;zSMu__aw{#`QM0qFV+7uzb)|(%3tfIM@3HUfA@VVFaP+%qCX)2 z+X~_*hknN^a=7@SjL*r>0r~Hi5X;ryeILxlm-@$bZE!&TxuK1Jsrtt=m&m`3{3{~0 z{`xoHdU*KX2T{Fch}8Oj2iVI$rhW(H|L%bepA4-W|GN01h`mRC z4ygZET{zeOuRsb;FZGYTMiYUa?ALooR)4Ab$3h8nQ2u!vf877>yLVpxvzM6v>j;;0 z=^(jr{|V1tV*dYX2N7KT-S_qU{O^!32h{&e!N$K-{mr-U4yu12`By}0|Gx_CdEZ}2yL)Bh4`E|a_{xg`Bb)1M-4ENc`H1`lB3#VI*hC}{N#2!Liudl7 zclTbjTvC)NNi-=5OA0|DlxzqkN=w?Emc&XYjdvzA)igA-)6!NcG}#c6(UeTO&18tu zp}7C&od1!|``q1Yj2%yD_0E-^^Lw82ea?HH_q^}Bx*xdj^qb=GSTH_f!QUY4DaICP zU%g`}&+pd;v5iU)3T=EONE`WBkP`X0`3`0le)-9f@Dn%5cMu#2gW$<0pB$yF-RR`& zCu}J85X+tof=5O57~@@+3hKfaKKtap$j4jq9Rv&Ar{ISg_9(Y0yOdj$9m-A0Hf4*lN!g&R zQI;u-l=GAY$~a4dM@cB|)nU*&lcyUxt}m^*KR%1;KSK5zeV8-Jl@ndz>& zu=VZD`zLO*=^xKW%8fs6G58qe#$&cU8$WK(U$2~fiSjI*&vD7eozD-Yf;nNeF6cVFZ2q&s zlS2tzsK*Rf;7u|1nUHlW<4>{ISg_9(Y0yOdj$9m-A0Hf4*lN!g&RQI;u-l=GAY$~qoasoC{uVJUd2*vIE9*Cls8KVfQ%^X^3w zD+rcM?m_ros}G;}DXVwu4%1zY_1=_^{AVP_LOFPW$oI-u5QGb5>;KidSF`73kYYYg zzS7l$^~}0;@#^Cyzu<`%TPf?OTrV)6B=dP}E8CQ=A>#$Lc>pOyM=*m)ITe6nOae=9+bY+}HkC!2D>1;a12{tkY^EO^K-6g})2 zk(HE{==ZWP?4}&pn`BcCxJAy31h>hi9PlQ2p7sv8NZuls$z5`dyiIP9d*mj0huk9f z$!+p3d6PUKcgTC>E%K1uCGV5B$s=;lvUOPKpB-|N_C7g9-X*8W19C{-BWK7%a+bVL z&XGstyk%RD3zb-boTPo8oFW&=X>yqyl56A)xnY_9vts@6Mv8v45@-B4^NW`mpXJ3_ z9{p>@`fH?@XqYeYf{jmqTZ!k%`yye_k%#0gd5>)BxsjqjuGo5kcWF2E0{6+LUf>;a zQY5%X79qTC+13l(CGXR|MIMqnEV(K2+gzU#&OgzgI6wNqi>`;c&ft1Dl>BjhoHp_!k#+u= z>~EJPKX*Nh{q2tmU+D6>a=OoLnf|E7%=lt|-5}d}R*RL%MM^uLYIc1={5*PlAqpL)!$KXqO&P4~IdP1Akube}8p;Gli?bf1fkneKD# zdO6+aPWQR8P~bkpo=EIVH${R6hMP4W)8LGF=j*B`7Puu;(#wVE1dG4bhdDiyPhdn3Wm3m+J)h7ocA8*Jv?py!r(|i8oJwGxF z%xn<6NAkI_#QRN4yw9}6^KOaHYnFIFX^HodmU#bYiO*}6_`GI`&uf-=e`tyKg_d|f zXo>fMmU#bXiT8b$c)w>Uwq@%R>rie|n)!5LDb^x4DNRp6Un7?(ipTQqEHrDD#v#$}FXs->7#;PE)2R zlawN+&xuVhO!v>&ADQ_zeNJp9#ADv`-Rb^W)`{tJVly$O`{(KYSti1C|7=bNUN4T{ zx4QT_arAxX*=O*+vw5=So*UtL@RHQP?aQBq_nhs%b^4yOy?(64Lg`;T_qErL)91hT z`kC+f$#s(dUNiQwroa9lfA0HC&fn>CUpb%Z@jQe`?%Sr%eQkg6y_4y_HMIR65hXhs^`A5c>mKJ?tYhhuXy@?v+0({aG!A`q3Qe0ra#>Ke*XT~`2TP7 zxytnY=1S0$p2R+}DH8kU9g*OcNN`^yxJ}+AZ;}V(4tbBfMIMs7HE#o_nSE%<~ct)-fs>~IS0Sj{7kNc&3nw=KDH+1{2lz=?sPvZ{W^W0Ib-G* z_ovvWrpYPFq)0q}-8anln%#BgbU!P-GQPhxeUEwi_qy{kAMkv&K$)ks{;3|beyKj) z&)R;m_r3hu554_KN@pIUU^}p`-Yxthe+%tF{yC&s%`&jdarF;MR>Hdz4yD$Av zBQPiUEPi@J^1rab_lP(69`Od}{RZD7-r#%08+?y=gYOY<@IB%UzDK;l_xU#XKHmo4 zBi`Wqd>ee9Z-ejiZSZ}*4ZhE}!T0$#_&(nT=i3I~=i9LNB`$2(`w@^0TYtVsyb&vt ziI|(#Ge_;qMWDobM5TL~_M@@*9?~EA##2NdB?$ z`^oP2rFdShJ`@BA`6;W)i){Kgn^pwzg~z_b_mXe7^?8eohU9Mww zu4B{vuwBRM_WZ^^IFvK?S=tZJO`q>dZ{l||v5p@2J6O}_yV5<=->*v9_uKLOwIdyZ z{bf-kcuOR>EE3!m3AWcQ6}t}wH)!wC-X!mkTjV~uP2MGMk_Y4td5^qB9+JD{eeyPW zMDAI(*L|qp4mnACpPVA^lGEe?IVA6qGvpyTOWr5v$Rl#zGOs_Uzh4!yKiJ=Pzkb8x+Qs`sI%`{n5GkzD+{(bN61%%|yodAeWTm5G4&OU=5A{q=wx ziUjY8gxy?kfrsR*NU*uifjvha(Vn+F-7nkzh==SC_V;wZ%>F3Y{;|&)aX%nWZqsh& z73NoqY~~%fDg1Y^U$*nw{qFNC?7sQJr|tDTo-3zKJ)*z={7m-GW@qBO}ijdv?nP=AU>ZrpXc-D^L*ZX zp3j@l^Lg|6*e>JuDR(G)l-rbD$}P$c*IN@o9BaF#_v<^Q1&RdDZ7+glpV@V$~I+-vPs#X ztWlOJicEF%hQEo#`K^&z2qhZa6ZNR#?${d>EQbU)8CVx{=Z4v zasuJG_(&x7wLQyr{|eqACq;t$WP81o;&tD2A3bmThwrIQ|KB7tPq43Ta=z@?{^5JG z75g48>^0iWJOr1?UB)kxx5%cSu@CN$3$$;N^W-);M{bd`WK*wadmnx8xyo|*wzoWZ z%bVv!H0{L8P`q0i?d4DyC*|R^GfeayjAf$^?I_%y@v`;iYYji~bYNE=;x zY2#(0!y#>a9zJ<|s`y-qPYWM;%JF=BcJMjNw&TANjI`a1*#Ye`d9&@t%U>MF)|7GN z|HphEDu;CDw~5+d^M5Wv{tUx;$e&}l1^ID?cOXA$!=}ZbMi|wN(9&PlQo>ZFm`UsIHBH0RBndX72E*gWZ5?%?3aBr_!}rp+Lnh&=KC>xaKvO@$XGxZ zlYAtMITw2)q|`A)_$`pP;FCxAG~{u7S_uDuDa6K;^ks4qQsPz}BR)9N{wz@1Z~7Z2 zghWMoF?pZnDCB!_LW}MMK4OsLRwOB~9a6_<(2ki3@{=~T@R1YJFaH$Esj~drupGS& zWy&}d5PlaVt8+wti$TI6^ba$fM|c_GJMd{C++=tM;h#YGPFvKG4XZ zPvGlrd_sgj1(~;>q7FkRGfPlXJ-=UqCUr% zU;g{-^Lr)!#bffk8trd7z>f6K`$gI@P6wsG;_I}3{{eQSzcQr#^Z|Cvi7Q?G?mxhe z^jF=>^z#SUk^ZXxLi+;;*pdF~t7w1l06WsB{($y(9$-iM=f9cu;sJJ~fBv^<|Dgly zNPo?(w7>fRJJMhCx3vF=*c0+)4>z|kWY?bH8dQb}^W@q)ueSbOVsiM+HNXo+fg{A{ zdI{hN@wq_)I6{10D*+rK^2sBgm?8W(xRfaG$cN=(!5sCK^`KO`>wyREdROTkZ~3A7 zN)Ntk{=QNvSl?(=gEN(8sk*YhTCc7J)$<6g1?NtlKz#W=x3X4WTB$CElEt~(PKg@d zWA*acm8DR=f=8kGA#HB?rYvH`x1%hw6{IvG5& zTv=KR)>qH1EL7I3i$SBZ7(7y6uC7$hRL23-BPS*2CIv6lDyuGgCrhlwDyAT(C1)iaHCw!tauivj+j(&!)8 zD{Hm0tLuSj|5#^eVZ9mDDl3c2)k(RfvyJLXu->=@HCd=EFRw|!R>_(cZjqKBd${q) zv4!BW)$01W)s>LBNZQJ}jh(sqcs3i}a#MKMgQYj!d(RKv8{Txw(J-@cc4cinl#U5+ zx)Bw)`HfQ9AI`q#XgHzc5jydn8($YJ++v$}iyi%AwcxU|E8!bL)T4B!(kLyTJ^Sdn zMya}7J(IbCy?ZpgLAnpAT|JTHh8x10&aOaJePWXP*jdiY#@dA+_;I#WHfR$b3P zeKgD-4cF@LtDb!%bCX1qG>|vH(F`^UGtw#1SI40{b9S-nsj^UIFyn7rtgk+@=n7q1 zT|l8Gukp+c-~WbiwOUy$om;D}me$r+r4A^Ib9r2qi1x;#VWYBMlgTc%bG_bJJ^OIA z6wPgMZQbU9Zxqj}AjKO@Bc(%cI~C$AWG^mNF@evmu42lU8ui7}`ci!{Bgr_g+~}Tb zEaJrD=(4BL$;jwvh`JsP@1B2C>8|_Vg`@|bQO){#fGi`k9lAp%``F^Dv3Bm^Gl>1j z>e(|TmaZoYr!NY@B*(0=bGyFi`XD;f%(T2QybxSgWlyZuSC$?=_XzqEBXhorIc!$B z@rc}1#V};Yxm8VKnVq&XWpbL;jM-guN=()}+i&BXOe!-w*EUubN{>`!Da4{ssw^(z zY{de3G(0Y`FPgs9$mFe>saw7IjqCL@)wT7?nMP@4jkS4HbR`+=l{GWGh=!iR$RPp( z$Q>H4IHmd`v=gvK=`pB9Kq0fpM3V_}=p-_gk<841)aA?&73LUp_eN+qwFp z)$1H#D7jgQ)R?76%xr9ih~dhxxmdN$j`_NxbnddKVXSX{qXfo-O*TEcURirovd77K zZecwXloMCNH{GbS6RUKv7b`%G18H+mm3h5@r30rzWx3R-$Y~cWt)9iYxr{{tPRAG) zR^gad)^L6|Hv)|0>U!znvuD?342@R`j9bgzdAl98NCebWPQ`oP{=j{u2kyJ;-i*`) z?TSP~1+#aa3@)=ZI3$TzM>kh({2P(@cyO5vWy6j}v_u>0XeezqCEbcs15LVAIbwIE zm@rOF(+wED!1SF2suFq>q0+isMFckVD6~-6@9do??!b+ajmwn<1C^vhaoXc!?FlcgoFg{wNl$wcTI1bd zGENHRNHpiTOrFkrK|gUqti@P?j3SH6LSw_66BD;&^U_{Q3Zu@PDwoXUgz*%U6kz&Y zFPjr4A33XJ0bRt^#KB%i=8D8}tG0Cz8CelwI`EpRvVMuHDj1!wIp|U_-ff~9=tK5QMJNqztho{?c4Z7xoE#8%gj^FhX=5UdfR=niyFHZ zoVsSCvQmAo+p9R+coTDWc`;%eyNT~~^MVXz|AN6V{wlg-iFlTYPl&3qVxYz*6Io=8 zF;cAuA9(2gdrEJ5%W2bO_)CBMWMB^)KF{Vx?~0+ZTf1_CD_V$-P2FtGmn1|_d+Wk;b?Vkw}y(CmU@_!Bzzb*0m3Ngxj?KY?d6a?3lBvgs3V4H5<9mq^o&`_%KV0cU9M28nsG z7sx38LFAPvdhziLFHyF3)XW@-nzEza(m#nm4-#LI@|zw@{%sYX{V{W8koX#&<0R1j z@pz!UX6~AM`c^;l(I9BwjiOOEiDwvdT*lFrJCbohJI5^jn6vQ_vPa(9$KzTgyKzOk z#^WsG%685C*I*_o`L(PaA$x3Fp7}-)-xT|v<=IRS|ETbgd@_ii5*|g<%k-7y(1o6}8ml)b(>{~(nGvEZvpZzyMy!!&%kH#*14S0v~|00-q zy^Kqr{H=6MN*NL3{_##}oVH2ZH!6#%YH2ovQ}%FQR{DlFH8d z&%G~*e?jb_va>yNzY@g1B>81&|IHvi5N7-4{(TVt3hFN2#1(knF~j~l;<)G8(VsJWD*cf5zrrbo{+Ss?c{Z?| ze0h*~0mg4OB;SHl5a;b|PI2C2&9Hs zV@c2UUA7t|-Y@nV?ZRSjklR6`CHAJrVrPF`_NgH8L9w@K7Z&>_8ROX&?szQq+aiA< zNPGzXW3KD5w11oY--5&@=Eq#mW6bBd9rFJU5+B8UOOh|YJ4kfEm-nsx@}CZ7=7opk z?O^6XFot-teu@20p?DcSIAW-a*tg_aVAA8$;FQOB7A@=CIR5qEoMnXUk+7D;-dyILL=&1Nx);{)MX#aRTWSl>M zl9d1I-3?vR#uNY5oBFS*|KhxzoBFS*|N1WTUp-mpK94m`{0|PZ{{08Dbs76BxyIVX zb)5Vrqu8%F9s~odr_NuExj_59LGYCX>}B##Uy3z^4Le>mOG zeYfrBMzYT3u%^lT?>J=ryYitRHlGKCmJzZ?#?JGxKgyGxKbrSg{1MIzliz29nA}$o ze`xk!ZhzLaY%|Aqi*~m^+akOD8U2IvNAW$IKm1Kh?gPY!!Sk3c4hNu2#>VG)Trv7K@f4-aik6FL4&Y5R$@^?=-WIes= z$AVZ(?jI&Smi$UMOPxJZLmCir4nBMuPP0KEO*`JyGoqy_)oqy_+ z-TlLTTR-fVj6aesqVX5>S7ZOTGXZu3v_ ze9XK95@M~xA?x?m_XM$TJ`6~DoCjwtBV>=PT|dYBr2^UQmv~;pg=N1~W`4gJ#6BTFU1;Vtrw(=f*$5U+v2NX=L*o z-@iktVozNg#J(i^rxfk(c^2C{-aqBN_~M_~ep`9)yt1=D#^sf1UkqXc>`%x3%9Y3V zkMrAP{9g-V@*Ez1GwScQJr;krV|kpuZ+YzR_HBMP8sYvKL?cVJ%vJ@o!`QD)yEtuT8u2haFWO+iyDq z>9-l*`NKZryXRxO9*aNRvph~ewCw!hOv>hG#uxL%yz8p`;k|bwb&~PmAMc&|!>K>y zc|P@rQ-Ao~<`3_cb#5MO+AHmahq_$EKGcT{<3zww{W zKeGMf`=>iL{y4ur<2(Pj$NZds9C|GNaTHBIgN$Un#{My5^E2a*d1L<8L;1&bez*C@b*yvZ_sriuVU3)@8ZP_3BUpRonAyRX@LvkyZ#RESq=KpM!GDyMNC`IbTJ)o`Z7Cv%2S?9CMHKIVi{MJ)eVe zj1PYf%CWQipl>`imIue`nEP8OoW49U9{Kr+Uj9DO9W&=9`k?Q$$f7;b%l!yAn2TpyO}s^fC8EXq?`QKU??oUj8#*_w?OKZZpRw z`bhu(kBL6g|35s@NBaN4i9XW*|9GO0^#4s0{YCxnR|L`InETiGa{7i*nXj3zd3vw^ zk0dAhnb1TvUy0#F@3-s7>4{$6Gk3?4pY-%QPAd}g1bZZX%>6THoW3@(&dT4*IlVtF z|H;#LC-GiMF4W84p}1q_{S&?1pK(Xx!xOzcCwE8UcRhXHY2k{l_w-)BnRz1TusY`cClpTa zkIM%0ra%Q5BjLYv#^pSD7XQIDoTwVg3 zI_Bg$+v)xGZcg;_e8U|xQXdz8;I!z?$0mAtUgM60{7o6-C(2HXagjc7`u;?3#)W@F z?Q7@$BgpCfdP-SN?~TjMUwL|eTx9)We1BXL-UA9G)T#_7Fw&HmIxKa-iHn)#85J{V5)iFZu&iMFSg>ka0g@bWkRqrB7a zP2!tzd4k}E5 zPfqlaagn$#{x-rqVqd(*G}*C8xo(X=38(WaYTY~!aewneo_?No=;M!h`s_p>`vv4L zYk_w>FNJ(Q;Kg?~=z|w{dSN+2eBOzCjtESS!~o&%h2CBF(j@uMei?edgJGM=LjP&# z#g}-8#E<8och@bnnfHfc(4$KJA@PHM2fg!~G$wWs_%QU&uTgLE|2^oPU!Z;lGA{Am zy6VM`-3`54e_Z?!{dNR;w+?vm=iULmJC9ua9IlgJ2tCK0>Oks~2+^olIt``k7o-d1 zIyXjr2U5;Qa$*xqddQVdeQpGI`v%6=cJ6itQV$W+zXbysjL@{w-A;% zjz5R6^q*s?zqH5kF2bLfu>8L;W-X#Ucs=-tXFrXwtohC^*Fds%J6=Zk6&}AI;f%*0 zLimKo;*;f^aOppX@ZBE&Ho^suzliVy9)AVlcX|952rqd2O@!q>67!E;f$+M=FGcu* z$8tW%BJASl70Z0^?PbLc#Vy5~inkPRE8bDOt9VcGew5=tzrOL5;!tr`abEGf;81r zTu@w8TvOas+*aIC+*RCD+*dqMJXAc2@?27JT5(2kPH{nTQE^RiQ*m2yM{!qiPjO%I zK=DxVD9T5YiqncSigSt!ii?VCikphtiaUzCihGLtiub^t|2?uFN+Dc)ARqj*>Gp5px|o9(XGKbNJHJye`koL4-rxU9ILxTSbg@s?s4 zZ}0l)G8u252a1P^M^V09CV-dz^0eZN;+*1w;-cc3;-=!Z;*R33;-2EZ;(_9!;!%{J zmsFfqoKc)pTu@w8TvOas+*aIC+*RCD+*dqMJXAc2@)b$NX~h}EImHFVMa4D6O~q}+ z9mQS6J;i;+1I0tdqbOgQRGe0vQJhm;P+U}8Q`}VCR@_nCRoqkDS3FQWR6L6ERY}EZ z#Tmsp#RbJh#WlrE#cjn~U~fNo)wbdt#k-346z@mb+?Mq6zdEJtq2jFKyyAJqWyKA} zEybIPw-j$H-ch`(cu(yE}+)&(7ys3Cg@wVbVID-%O z+o^%#q2f`LpPy8mRxEjY`9D9WxS+VGxTd(NxUIOOxU0CQxUYDic&K<3vk0HD&AAPALSPU{rp~-QXDGID$XmOS6o)yP~1|ysd!8A zw&ESdyNdS|??+j-Hh%kGlu{fj&MKDimN`Iw^CB5RC zL&c*gr<01)iZhCHiVKR1iff9Sirb1iio1$?iu;NOiie6vQU0E!;zUgz-I^Rkq(hl;a`^NQycmlZb@w-j$G-cr1+ct`QB zVj1rOKJ-T~lkxWWwMsZGYL2*%WO>t9kTX9Em zS8-2qU-3ZkQ1K|ruShCRE6ym+DK023Dy}JRDsC(8DDEomDefyCC>|;vMfv)q;dq3w@ zL&c*gzdETntvI7Nr?{ZFsJN!Mskp7UqqwWMr?{_ppm?Zw6y+O|iqncSigSt!ii?VC zikphtiaUzCihGLtiU*2^ibqj?O;T}MaYk`YaY1oWaZPbkaa(amaaVCqabNL3@lf$7 z%9*6%wBn57oZ^DwqT-t3rsB5Zj^eK3p5ngZf#RX!QIu~?Do!iTD9$M^C@w0lDQ+rm zEAA-nD&7Hm?;GB@t9VcGew5`;JN@)Gr4)yXvx@VI=M|R~Hx#!NZz|qWysdag@vh=M z#rsiyEzocOYg39t#aYF9#q)~GiW`bsiZ>N+Dc)ARqj*>G5bV8w`r1*Hk0uqT6=xLZ z6c-d171tCu6}J_46n7Q(6!#Sm6b}`TqI`2waawUkaZYhTaZzziaZ_t9kTX9Em zS8-2qU-3ZkQ1K|rr;>`(iZhCHiVKR1iff9Sirb1iio1$?iu;NOiie6vQNA^)IITFN zIH$OvxTv_MxT(0UxTCnMxTmJGZR({fa-N_>+o1r}zut3_enC9Jw#y%jd5tmiBt~J0zXY(q5mB zf^+yV|2tl<__ShauOEL|v9#B>e-vE6$L0SS#h+LF1;t-d{58ej1bg>0@4Q0sOBG9d z{rIm}EbaB}i(qfRc;~v}4=R@S`td)bSla8`zX+7Ynjp|CpMqh8-0`)>= zd3j9&5xbvkWxcw3$#i}MKcSR&Ze_W?^5~^X9LMmJnk>f_Y1~D%jYjbkOS!9P=9%iH z${ok>lbTG&mcz>(N2#8#uB@*G$Iet5Yr)#WYGr+)R;pDijRSk$4AVs|apMw6GVaua z(@e~M^(Q@ka4OI4C-b`U;BjEbmg@`Em9=W536pU+I9Jbp zQEhAoADqtAh7mB#4=-02gJWy!tLv4AAvew#$@3vN{g!*~yZ;^c1*h-6`;O8bB63#T zZpCd@+-k*fCr?>ENj2pOqLakqR%VHmxl&GwyUmK@r>s0dq|6d2?PaTRx3~` zqdjHCNot)W9=Gz2((&7D7FOO$MkZEq(kaFPr#Q|)u5_!dxDlwhkteJ;PMIZAqF58_ zc1o0HQ@a34vx;%RDNwAj+)+AZD{jQCmQZbjr>r5Bp#p^F&EO2D7nGUe?OeB$7_?MLtvj?eeX z`XMPJG5n;H)9lc+(I|dm?_4`HwTffTv=h>cxsnmLTXCBew_1TdHO5m!%9BLO6GSJ8 z$F0l~DbfEXOUzgXFc4OQfiMBgkmGiIt;EDIEHlIekkm*_5Nj9*oB}h&SaPM~S;^`) zN~AQ5GL1x$Svd4(=SawPZQ{VZVlS8L1{_D^Hw*nkep|sE5_UZ2l$3eJ4rg2dN&g(- zr${fq=M*`T6N-HmVfXt<`H5aaeL(0E84I2*gJ5e@hzg>Ev6?_gWzbp}Oxc19f z%i+>X`FG-TNcq?7OXN$pKak&PJFNUolROB@kkWn^&ntg+1pOi9zZ@nx|f){<(rSh3jUb&AGhEAo|a3WLi*o9nnTLJp5!|4-09bGY`q-#c^Z#r`>b z4k`cpdN%o`+8=Zg=dkkgHvPE$?swI^^5e389a8@H_icJ_xwHzG9u)s0d>vN)mW@81 z|K<-fpmXWb{`fxuA5#APEdNsNkAD{F4=aC{<(DC4{(TSGD?cW-L&|^Gz{Z~mtsH;5 z^iag!jjuz>|Ei3;93rLsmk8i+>Cyh!tH6hp{~pf2OSL~1BK=|Imtm8mjE|J>e)rBR zf9?|Nf1UAWa!BhRE5Q{|d5Ke*CAPbLA&!r)bVI;MPrNcJaY6`JF7sI(?Z5HYuHO<%1J4CtP}Gr);wR zFFmRZ-U*qIbLx=x|Ea5g8F8fjuf|6XSAGg%@kxi2|1n;Fz3vj_oBNW7mA@^8!NuqC zCFQ>cA3418;~Qt6JZ<`|WlY{z>}71f`MojE;MX@HJ|*rOC*j?K4PVuUls5hZZLa+E F{{i1B3C{ok diff --git a/internal/ebpf/file_bpfel.go b/internal/ebpf/file_bpfel.go index 39ff6f15d..1b89ee110 100644 --- a/internal/ebpf/file_bpfel.go +++ b/internal/ebpf/file_bpfel.go @@ -23,7 +23,7 @@ type fileScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadFile returns the embedded CollectionSpec for file. diff --git a/internal/ebpf/file_bpfel.o b/internal/ebpf/file_bpfel.o index f1c850d6b47d51b3c4a3ac4ef5e8475c0a355b62..80c6638f1799b800713d134ec0f691b255e1639a 100644 GIT binary patch literal 77144 zcmeI53vgrCdEYO{ePCBBiM!Hrxt1K=m2DZ4S1as85@bsX^jH~=*Ak+K4cT%4ii8%F zxFk$+*MQ*0n8cw`$F-Tn;li%$P_ok?8O7x^ZiS{v#F@AWCefsv#+{&JHDNQJ3|hNW zw&O|A))V*p&iNnU@=tKrlALuW!5v=w@9(@{_k8!A@6UzE;(1v zt6txAjT`5<_YMhJ9QF+r4~|$pFl6*43BFB^#@^KazB;`8f^qhC4tQSs```cmNH;m- z@pJO2PLCn??cOuS{UZpsKQv*u^z^z(@1?LoZ|qaAE&Z2w*m#faunBMXe#)jhACZ!I zUTNNkjzEW?VWVp>(CZ-4cdgRLL1N(XdSu?twEQdRpxs(&X(sPTMTb(-m=EKLiW<`A8g#eJf^8h zx_UCort!5XFDc0O%T~PN0b8Hqh^=ooADnMet~Yi*o72W~=ksGBdm;wsh4n4wg+VFf zcJJM$WnS843v5Rx3NNDVTaf)F4J@0M|7T_Ip6|9_#=h`_wVTG*4EKBAw)2gE@;7bs zNO@Yuy|kD&6)P>~pc!ZinuI2xacB%0g<}3$^ud^a7BT-UV*Xh)-RG4S+onBAi|f!9 zbPd{su0k8o6=)s046Q+zpjGGsv;r+d3(!0?2hBiJ&?GbgjYDJ5C^Q1~p(D^CXc+22 z+tM3y9xSdyThKLV6S@j*Kv$r3=rXhhU4mAj3(yL*3@t$O&>S=aO+k~;1T+qfL8H(J z)Q65hhoE7o5i`EG%VB8;@|pLI$Jn`RjdtuW<|TJNzr53UoA_7CVdg=be^N(|7t7Id=JIIkbju-n;TD0p;hd>inqJ1DcMO zMAP|*?8WEpd0HAynt+;)rvIAL`La!C|Ddg>YnKa^LtDU=V-)2W8`j*VzETcf^vVND zTi3&t)1_1VHI!rLJ`+#V(Gt0Euf06Be>9yvlFo(7qxEt5xbk%Cg?@d(6w6$nZ8Z-| zRx%%c#sn-X$W|KG-j)6e+4e0B$H2C|O2cum&8IY+usj+u`dG+JcM{(>TpG6Sqamwf z!x`gV4B322!v(O-r!-s!$BmYTE8qlp0h|O^!71<(I0LSMbKqrg9$W_(z$@S~xB;$! zSHTP5Cb$Y-122JF;2L-xybNxG>tH({7DFpwJ5Lrvwj8BlJAW2Kwj8BlJFgZ)wj8Bl z-}GcLw1)V09xjG#Ii!E#Z_6S53%2Eu{sr4|NdJN{Uk@k2n8$}xV9f8s8L%x!X*dVA zYJCm-GkNmP`5zY|B*))xox0#n3X?ma7=5fo-{pp(U^_S20ut+j12{ z3t(HWVyFVP1&OVvzZ5h!z-+e;%P1n1aXNn`f_{#isV8rUdA*0Sty#Dp;q)EqJ@9qyh zZMgI)TsQXDv9^EbZU2_$^I(j#d5o|56x=bM<}r@uF@EMTZssvw<|7F2Lr0)P&@j}4 zVji2v{5FqyZ+^}8*F5IQdCZ^lm{;dl;9rL>Lu=3_Xcf8utw77r0yGcJK{L=4Gzm>W zPkXz_WBzhUdo>)Fzx3D#f7+Ga5GhYpnPeJL~D_t&wD)=ridt$i#l zTDw?UwDz#nU&q?{WfAkwBIch(%s-2me-_(jr1jUaZl3c^d-T__v>xuSW6k}?{yG-d z0mD^uo)kkkZ-$q^8Kb4)8W`6T!^_}2{OjNXcm-SrH^3F}DtH0h1Xsap;3aSiTm!Fz zm%(jt9c<^r{yNsK7fbzhtg)Z{b*wo(wp_=)jQhLpd1&cVcs}LUnV(uS&nb#yzDdYE zKiNNs=P%FO^z}aM8t%i6h?B0H^RgFfcD+#ib)<7zeZ~E$A){}6oxIg^-c|d2<=Liv z{(}3~W6#?AsKNUI7kZxDeg0#HlRUTiuqk)x9IjK(+50u6b2#tL+50ncU))^im(JPy zF{N{DlR)X*Io0i1s9A4*L7RHhoZ0ex$EtVKIaX*kGx&tz5eI9_Wk4T^W4)q{d#WQ{l?!z z#=5ls9;sjKCf9PXD>BnNLcK?tYlP59Zzv(fd<+K3?ekV{^Xt-#<3@ulw&G zo8e@hE9m>({r8V?Kd1lP*37&8_mA7w{`B8J#(2o1J?h{bcp01l*T5<85;zI2f)n5c za2#9#$G~N96kIU+LtmG=_b+?Acl^e#bM1S^-F0ftOuRq*@6GnttJ<)o{`86z?Tq+`H?@{(99kSN}cZ#gu*DVlfF#K>P0*>j;tetgSujuUGB-vS{Cv zkoU~Nn0NZ?Rns1Ne^6&&_rC0fzF(>m$!o@%t{X^>4=hvYv=o+*MU4=HFE6_T0 z8CrubL95UOsJ;JCI&begl+G96o`>e38E6WcgeIVIXbc*KMxZ`)1Udu_Lp^BQw4c-; z+Jde@n^4S;=NsS^XdSu?twEQdRpB?F*8AEFvhK$`_II$}HRo&p`E39Btc){vpTOM*=s%yubw>aBteKDd z&u81#F7=#mRI?D_bt{T-^(({`Qwl4c^?*we4^ccFILc-`m4 zIpa_|jpxOu@x1sno)@3S^WxLEt~`zB#iwy!==8cBAE#T;HE0vM3bo^>bb19`hb}{F z&?RUUx&W;}F&(FIr4Y~xaLKmPFXc=07=Ak)g2AYBMU>+G=g{}sCb?C7NbzV|$O z%e#}OY{^I3S+ZDP*cm8rXVBf@5uZ`*26@YOc z(Eo*pZA0F{boBk$qc%`j{|Dl&IMy<~%O1PBTavu>zxLUcqZiiZLg$9nT0U$;ng4(n zx5s)9d7CfCT1ULnZt8fMa9sAR?3c@4mR)~YY_IGqvQNt{+ZFreBUonFXX3n}UM_8M zA9#~|VA~MJ{G&nZF`)k)@>$s>-nOVTTt$wxZo2(5+4VRs`!C|SEUHUdbzhPFIUH-@ zUXWvL%eWlBh~tbLFUzqnds&YEtvi+se^-uW3u|Am=#d;>Cm;Xb9D3%zP|J{Xo2kQ_ zg><}ml9q14cEzjOrd_q2s znBQCArsdzNA6zLEKLj$6|?Dxs>EuwMRACO}` zhsv_QSB_;f|H)C~e-NyF85j5TMiy7InfgcNQ0l2=GMfawT=P342Zu%V{-6BqIcB}} zb3o76dnJhU2-N9$CUUAJKVCxp}Dule65$M2R2N%~=1LXIDiV=bp{AHcCM z$4}rmF2_&F@g1UN*=KOPBF7(><9CW`!v9o`@07#19RGqG>v>j|<0U!1TaH)c7~4S1 z9ZA-hr_^Qlj|bex<@i@6u59jnaw(YhzDqo$N~WKGUOGsQ&0M@7$8mAj?Q?Q`uc$A3 z74C64{vzBna{PiEOTybUtzVbpdqj2nO*xh=tn|eGe9&L}Bq=AK`ajUaU&qYP!avc&U*rGj9vlBBdiZPnuuROF{;3}R8vnQ8|6mV) zjel4wukn*T{5Af|@PD|6zsCP-_&?giU*ms8PBKmZ{XP6O{+ne2RR2^De~teQ_)AL9+`#CW+=cUv4JpAxIkEb7b&j(MY zAALM|GM)D3iutT}X0(vbPR-3sWM{qXIXRm3&K^G|;q~+E)a=CRsqDC~Nu0gyggVP- z$9Zyk>a?#P-ZR;vcW!j@Y}Ol}na-!jrq4=@*|C|?xv^Z@dW_DTj(YNOR6maC$8qne z$QnXA9ohnC2PlW;vD{opA{}P3N+sc~2re zIVow(&5Vv^)21%znbD7?XN$91!|aSVHht#I^iOr}Nn}+j*ezP; zBTwd^Ix^<%n#s8aT{ zUmM21=|(BQ&39{IKNS7&VZTd9H_)*U-}o+X>=s+aTWr4{$$7h`r~JEoDM$LuXg)nT zJ^jqtd^$UsJrlVBt$WzNL7PuvyK+jD8*cD#nw}D;iKqO?A@!H?n$C!veE*|%xIL6S z`QSZ|-gu+8O9qzzY<6Z^a*9eE85~>X>Bf(CuVk!|G-H#CM3c1A=_k)lOwLVArO#x~ z%x32z;(XYT9`3z+nHhDC(pE>s?acIeHsBN$r-+R88^`R0ep65MuvPkKQW%3J3TQT z(P$V~u6NJo$K{km@1mupktLzSzLfQ_e{b@E^gRzgE>U})QH6;)Pmf(YKCp|GPu3fO6+G66YA`Uu=OfVfFTMi-(b#`K0#uUmC3@ILI zH`+|8HIV7K2|b0>$wrjeci-(FKV}_elu9`GS|>@#MYXwEXB!*&yA-&*I;lxt-+Z?o zbUGVsT6Au7_8CoHPS&$ybH1XUxO#lkjhvkNY6AyCc~W9etKwyKT#w1rA*aIVWI8{p zr=53tW?JUWNtqPH=opW&88J*#vvPhHik|f3%v}1(>FGJ`Lt~XZW7eYYyxsQNh5%Ah zJr(bJ=;4#;hfm&fe?&_n_1X|f3K)Ioac`F`!4^>hWprcJhQCoFAN6)=59MudY|PPy zI_ztmO-{GUsUcOmP(JGKaxuqpYMN${?(FJX@dT#rjwW8EYfW27V>P0|@Ilcuv?;@&kvC`HFX6524ijOB~woamY* zn-*Is%?xhlROy+BT$mXfA$8Rw*jkAyXks}VGcMN-y={z+3=QSxXlo84I{%4R&nu|W zxeHuFiKnwHy)K+0vtr7-7ejh!wAE!3Unm7HqK@ljQ?PK(to15ez%Lj@uSAWJ9GyFM z!3rJo2imCD@ZRX{vPS|N+UX6Pd_DTwCf%z<-PRD_O*IkAtc%Lt%P@FSEv)P7?QLDG zbxxE`t23QuE;b$>mL=2sPU@PeV@%}KHOrEz>_^?o#QAlWEYp+Y8~i#(;q@+6Btc!R zNM{)9v~hi6vk%w-=OD9$l+r}hiN!c?D9WP`Klb2#>3beaZJtxN>MZSI>Z=P5c-w-n zWx(6idkrr$;5*(I8Y-`Gz*F#J7cfr8F=~RNyW1wcO1;517;Qs!dQ6?<|D&sK*Fv4> zWqw_c^r%9x?#H}S@44^fgO8l_j>tl8)|;Fd%TCSeGXs4F=Nrz&nJs zA2q();&Kq|*A&?GYc9aruTm5f{u`3tj-hQ{87yM9W%<aV;{cm@7{CA{bUZC(T179NUk^P1rO@?dWFo!d-1YWy37FKY~V>+nA% zeB~=re(+i0T}=rn_15qe_5a3z7Y2V({a+pMq{)o`vhteL5B!J1`@S{c`2pS~909xf z#lU|d;Roa-NPzdsQ-kYGWe_FKYX>Ecf{2IUoHMC6u$xfj>NxgWYB98uYpIx z(m&TqV@Nw{{cjY$+?Vr=*bne!;vWaUU&8Nt>!6n*&Vheg(~n5`!G9pUM^5e<@p6E7 zi~nkXHGC8N*BU=M=&cj$IMDK||8DUQOFJw3^3XJVYMU1UpAz1Y+~!5W?-$-%9`s@X z-YpylPpbbXWL^pIZs8>OXVhONg;aod3unMp_5bvsmkaQ2;XL@O;=g-A`ai%sgv;RH z6aT9|C-Y8#_Xsb5|4jUctAk!Oz*h<{f&WJQ2c8p_cG32@Q*7tJlC;05@{Dpy&L?nH z`3X6HMBRKfP_Z`Gy&ItJE%E>0QgT z|D>qerx^U5eM*5>Mb$p#L^XX4ul6Yqe^Yq*D3HGlO_Sf6sM;qPY8_VlRHg9J)yCi1 zrw07BzXq1S))#ed^n%zJ2-;+b5Zybj^1?CQY4B ze_L1=A3AR-|E=)8Raq~95AKoc0Ga$_#0l_W@gIEE^D^KW;Sa6JdLh6`;e3Ga7A^$% zdf{q-)qhD?=TWyFtApKjyA;{@E9-T;6xo#D*}HZ4JA0=KQBBWn`VGmTy>r*y&fe)e zb?Wczo!TR9A7}3}U}x`~eRB4$jCs%5JGDQ~eyP1v`=jYQd$$aB_HHE*UhSRQqhR?p zoJ&vroA6%~RePtZ;Z@b%t&0Z3x8d*XoiEq9>aYDbux9TCoI+!%yIGI5$=(SMNf?*U zp1!^7ug9=n>aWM-Je0|xzaF#mgRajm`Fc#|C%uPxFffnZB^;Np+56(A^P1b#-swE% z>`ff(?2SyZ#^2eSl(3l>CA}S2hm5_`_|D!G5MIP=W%*Qpx4v2eJA1PXcJ@YYotX5E zJrU!y;eO!ZkhveI={fu2)?-PT*WWHb6A;Gy?(9nh?CeWSSj(^B_e%IU{G}LXOOU^Y z)BK!$Nd;K#OOC?l;qUBA75>`(1JeF_FF9ym{z~}XoRnK~*K#Qz7w+2^+wT4QeKKz3 z{%5&wU(9*v?hp3ui#AP^?_`8E{+A@Z9bXG|o|C)vP8s1v%vO<4jqmJD z4eacVvp>$>xb@EOOZt0W>8^MFLb+krJDR_-N2?)E*E^cNvp*i@_x~s1-~J7mw=w@a z`x6DPimLsI2g2`_@Co?a(%W^B=BMeYzq3y+zYOA^5(9CtDeZyyEV_7hVW~mdcSTtz-rG{z%G6R?CjaPu$E8zcR>1A->nJSvp*BQ_iA}QF9~Qk<>SI4 zrrk`w{rh$O`*r>GlsO;z_UuP%&vbqokoig93A`SYp3YnE7d~^iJC7;y~H z41bqj1@WD|)BAZ^KbK#P(pyG&XYU&DH+Dzto0d!CE33UzRd!no?ChPsSLXVAK>AnT z72Ra-?(dEhWAB7@oVa}Y&!_tD3-;G<_I&8uyT1qaPUa_l$Neps^mKlEK)CcocOFwd zBkb&*@=ppod#8N2a75B@@vj$7fRS|PeRj9r%ZZ21i*CJF2(Z3SQ5M$poc&vZzq5bK zU=g#`|qr4z}cf1{GI(vz~9-U9N5{v zLLj`_KWE=;>E(T9@^|*l<+lWXXaCf`X?>zdKa=b07yHl8`tQrz^WjJRzPwrQ zVSdu@t;uWnp1fXf)@{Eb-^I{v3ETp=z;6p%|A>5-Atr|pgY&}rJ8LW8I(Qwd-+#Ll z`RMoPE=4~24#lO&N1v5lihT4Q=B3C-*N&GWAGOh!A|HD;^!^<56K?0G`hLa)-D%$S4Fva|GWqWG^qM-jJ#EUr(|q?O=>D5<=YG*J zgPmWx?Z$Y;lxNqb@=Ta|?b_7--!|phwW(!1h;v(uaLWj88p9;7!2)sUp3{td{e)C(A4+xP5ttpO!+V0)Gu#_JNL_fHs!c{ zQ~B?QJNL`GO!;AS0!95C(&v6Th;sJs7kO|++pn4WUTM~nGd>uz~p5sLH?{vMQ?LD-+W!wtdG>E=|I6Xd z?f=K79Q!x5e+2H_{_imDAmudW>X!8rNT1t(7s}bY{oOBPchj+^;((V5IO*Z%O*#k6 zcQ}GxA2azLFux@bbpNa={{i!kRnYzS;T|{I^|{{E>wtMC-F3A`gPpghyFUNR)c@e7 ze)+g5=fO?=5`sJ1>vx;-A2i>g?WQi46z)8)mQA@2dfYE(O!?(4Z|axdLpt0q_n|z! z`^CM@*DcXsnsl$(RNn=Y&Nb#c@7>UHzs}@)%_e*O5mWwa%)0`?@Lz*FpDzbZy{_4G zJ)m(1J@+l+Zc2Y@%K7F^<~oNwNAzT5_PK41RYl=ID-&X*_Q&i$gl zv#t4Zzx*cB=YBbca`x_*>olY>m*L38!(7TP(z~T4hzUW@>t)1&D zA6a}_!mE1{?A$+s@KJLAyh-0=ZhY2p-TiT-gW%>KrygG|yQVM8NVEA+{SEGYf$Q)l z%Bdr2U*LM!rT;#<=xwPYGHrdTLbC67~LcrZ(jDQf^5p4lzqXqiyT*EkISx` z3$JdvDeJMju2cS$?8XD~^P)o-zn$y!!uLkLT7U zZl9#7ZMVMl0Bif`Gc4UMRr^%JHb2c)=L`KG8M-O!e4)SXqMNez$BO~h^40^a^Tld_ zzaV^AcHK0-*6B_K*_3z6?w-df>#YBT?7AuI>^-Rf^5nU%l@i@Y|4+z{v8F`l*eTMo`P)3Ps_eXDoA-8>tUQ&zSg(FKSP`+E)y>hFA*;juMn>iuMw{kdtyIzbM+Y__KBm! zapEL#hB!}LCSD+3B3>q5Azme3Bi47$Tzz%ChB04g{gp?EBg8S{1aXQuM_eGT5Lbz7 z#C75Zag(@3+$Iid#bxW%pID!{2mRf3kqe(7e|>%x44)$|5Lbw+#5LkNaf7%?+#+rh zhjD4G&Zhr~-MYc~$H+fHoFdK<+xz+5_O6hBmAFP+CvFfoiCe^N;xMisUHwLgBg8S{ z1aXQuM_eGT5Lbz7#C75Zag(@3+$Og7wY&W>qJuy-*B%k#7;%C)MVuop5Lbw+#5LlT z0IPjnC0-+5CpKS(K>alSP{6(``@~V=IB}9VL!2ir6E6@i5ib+35U&!i5w8=wrLOj` zslPm8(ao{`24Ik*#Bt&zafUcgTqf4v{B!x~^-+zuPTU}F61Rxk#9^!twZ59)2yuis zMw}o{5$A{t#1-NyagDf6+#qfew}{)sVLS@!)Soy)93xH;r-*aJ1>y>EmAFP+CvFfo ziCe^N;_x0FZFany{wIzQ$A}ZeDdHS)fw)3kC9Vz;* zW#Sd$RpK?`bz*l*QtPMX8^R-3$3AhCI8K}-&JgE`%ft)BOT^2>E5xhBYsBls?nbby z@6eDmf^3d`;wW*PI7yr#&J$Mx9Fcsh#5LkNaf7%?+#+rhht zuXNQ4@hb5e@j9{l$3I$MO>gMhZvQL$#8KinagsPgoF^_5FAy&gFB7j2uM)2juM@jh zz&iEEs~wJg;wW*PI7yrfa6;O%KwKfN64!|9#0}ymaf`T39R9Ixe{1#AV_I;w9o`;uYdm;x*!RV)x3O z_P5q&=q=s)EBnMz;y7`VI76H#E)y>hFA*;juMn>iuMw{k%d4Gc>(rmvCyoX9afz8A zP7&vb3&a)TDshdtPTU}F61Rxk#NoGf>#y}0A&wBoh!eyq;v8{-xI$bdt`XOX8^lfG z7IB+6d;`^=I6@pFP7tSvbHoMW3UQUVMqDRu5I2ci#BJj6+o}G<5#ktef;dH-BQ6kE zh^xdk;yQ7IxJle1ZWD*~Cbn$bWH;lVI6@pFP7tSvbHoMW3UQUVMqDRu5I2ci#NLgj zx~9HkayUfn6Gw^T#7W`|ah|wLygq&1o&wQ8Y4~+r-*aJ1>y>EmAFP+CvFfoiCe^N;_%^a z{k480#1Y~cae_ESoFgs}SBR^`HR3vPgSbiDB5o6hZ>IVaM~Gv@3E~uSj<`TvA+8eF zi0i}+;wEv6xJ?{BLiHz(5XXoU#3|w&ae=r(TqUj%*NGd%P2v`Dn>c(6)t@**93xH; zr-*aJ1>y>EmAFP+CvFfoiPr->r&W!1>#ICO>=Q?cgOuRt6M7&JALcB`6 zM!Zh!9i{pc`@~V=IB}9VL!2ir6E6@i5ib+35U&!i5w8=Qhj!8gdVOd5UmxPh<~S1I zlDNl+6T~Uv9C3lTLR=-T5!ZSP$9uKgthvtYsLHs%5uMmHY_>};w{dtx6JH+23-t$hat*x)dzn1v3ppvs053Q_ox|$4-b~RFh=KM=Q6fv>Ss2BWu1hQq42j3+3Ah5sYdQ z?f7h+Zzo9hTy|=1);n@$G(YRjj?IkDjpfq0>}bAc%bRZ6R1?=P8=`a?wRfDZcd+=~ z7VjM^;2(?@Xv*I4f&oxT@5tojxijg}@$s42iPPTX#8`G}HoKt;-G1nuYQTR}X>0@c zj%P}P0MgA*PG-lwBeQcebE8j+7S9;P`QV*;&wVE!eB`8e>fU?rNZ+9nvvRwY+pOGb z<*3sWmXE_3dJO0kc+_eX2#uvFk>pixE0fG@b=lkf~7BM%3 z2uAImW?RPH7$g`uaIS3`o5Gkg?U=S=EN$d=E4Nv>)rz#K@jL;99tT2?0i6PmT8#ps z(*7n%8L>E!j<7D$5#~Tf$WhzBR%Kuq))8V3B&tyvAl9RE;2dP67@t`BXjGHB4Jt7W zOP)q0OWd|Fw*HNL>>SkJvD&!7Urj;@nAiW583>#*SVR}%R` z@!j{!U7WBxfc~XK-X+Iza<9E=9b7xp*of}?^p?8u9Z$(YulmRSiwzO1zjh_(ua}3t@?YI&<6o@) zx}55je-8O)Y%-qKU&C?!`hDVH{}{C{tY{MQfJ z94=P>-`*nsc8~gB-Xs4<2YT0k4bLIm?=QIey7qINl=!{spZaqfBG~^|_Q?O*E%L7* z;>GGevPJ$C|JhNBs}>$Uh^U->d&e9=G}X7peaf61i9Zhu3WUVEwP@k^ft_$UpXB z8~VHU%x&EKT_@mR@OMcWw)HyS_Xr}yYjK=#p*{} literal 77184 zcmeI53vgrCdEYO{ePCBBi7RQjlqE-ZWm|^i)e8HN1j+UWTJ73UvX)>y63CVfP$aaV z#3f;py8;BK#!MXsqdGC;%3RoS9m;YNq;*nGt3*gAjW`oE#nf(wle#HVD=FhT8BCo? z*-XYkIMBfA_oJ9qA@# zJbqd})#(xBzTJDuxPJuU_Jt-4m!4cV>Ae&-=#4%5`qF=ShmH5h4x8|H@546T`G}Ov z^GfqRbObsC4MRO>+ayq$Ux&7!YtSZi721HVK}M!T&;ThKLV6S@j*Kv$r3=rXhhU4mAj3(yL*3@t$O z&>S=aO+k~;1T+qfL8H(J)Q65hhpaAI_u}(*{FR2o#$Ctx=VUyWh7EfAcJ4L@FOOQ@ zDgK(nOFC-g_~lvauH$`1-NjA*ynXs9f6BUz=4^Q$u*LAk<}GWyD`YS2{@%v@%VV0F zq^l>RY#LvS@{)pVpSI!^_uKjuM{Iq&`QUt$a=o$h*_<|>JD(p3*%L81FRX7dFAPc< zw|nn3E%VYYTVOjnQFsw;--7HfX<*s3{Qp$;?)h%}W$d%xTf1p|&2XRhO*`KRD1Xg1 zkCdln+)ImjQ?b%w4w`|cph;)~8i&T9Q7Go0MIVg$XA$$yBIch((|ulPv2EI;w73p! zLD!&7=qj`UU4ho2%g`Eh30j3NKr7HPv;fURbI=Sl1x-Q|&^R;(jY1<(A36dZf`*|U zv@N|M=fUDSv;|#*HleG~26P2lhb}{F&?RUUx&W;}%g_Qe56wX{&=fQYO+e$&7&Hov zKz-;4bO;)T8ZqO0yBwBwAfI{Pc#NID-e|}EVqS9R^UFJpw~2qH9G1@8be|S?UwG`i zohZh3Tw?-0EuY4Hhb>QVUdxG}o_AV8P2cHT4`@1C z5>4kLvKODX=V@s;X##3Gn*Qrf=LMV2zCl}0*De<;hqiz#$0*7%HmtczeWe_}=#~4G zwyuXOr%R{!D=5d#t4usiM@!_wz5epp{?T;yNIDlQkJiWK?Oo}wkZs@6a13nQt27)3+k8sH3Cp7qqmP8lbSLqB!=+*CJ{qz* zHk>i;#gNUXG+Y4Nd`iP*aNKBVxB^aq7r;qy6`TSufivJ5I0s$^=fQPw0lWe(gB#!q zcon<=Zi1`eHSiL+1+IbD!OP$_xDK}SVKKA0hudhx9KP^Yw5NjCp)G1;+e7oB`W%l!kL) zTaMCj-mw`d!bWAhfUVsvhF~v;Gw_Gq9JY2?#wWrj;SW1HoB+2?K2jg>I@sE2X%BD| z{%ha}xCyr9lJ*AMa!G%HZMmesz_wh)P#tW`RSYeIZMlk}8rYVr7+M0`auq{Wuq{_H zv;el{DuyaxTdrcL47TMeh6-R?u3{(;t{W|ea^Pif23!NDz)RpHxC%~y7r=3F1snsH z!BKF*==XY^=)K(HjnW&pMpEa(>%t}JjTyF#?3s&%X|dkedq{u2pWcZ zP|RcVnBV3x@6E5-{+h=;Igj~s9`ow_3jFKPWoQk$1g%0BpcQBtT7c%EIcNr&f+nE} zXdD`YMxha?4;_IH87)4K@i%P!c|BWNG{O4oSlbL{{?LKay)R{^`~Et1(b~zMQO~3>kgn>*TGT^RC+GE6+6T z^B3H=9(%^#M-AQ&xY+aL?(-iroaDL9hfKLk=W(5S-rlb%oyU21-rk>)`{L$8zjWT- zk13sRn*>Vd*P$)w8ng*rg*Koo&^mM(T7xb@tI!2#1zLs{pm}Hxnt`UENoWEZhsK~$ zXawp*N1#K{Fw}$E`C96a_OtVQ>HHeF30;LYpexWibQub}aDE9~g)TrV&@!|D%|mn0 z3^WBzLKDz9GzN`ABTyeY0v)ot2>1E0;o|cck2v3oFW7OpZ_qxFboZV3d9R*F7k$oq z#+Ks&JWm)qZ&~B@pYwX29hIgF%t!w@Z_A#Ki)+v(bQRiwu0ZS1WoQk$1g%0BpcQBt zT7c%EIcNr&f+nE}XdD`YMxha?4;_IHLBmiF+BW^(Ums(BoA*t7^w-Dz^|20w;PdnT zb6$N84g23;ADj8J|C|@s@BQbz7!R=L!z*Ce_2D`g_I-F6oG~i*lfWtP5;zI2f)n5c za2#9#$G~N96kISGT-R;&9*Vx==dQP3^Eq$eedO&D@B4qAYu`WaKF>X))34{&-EaIo zWUNd3?;+dqFz-W0phM6w)Pv&s@E^(Z+Y;8Jdfz4Z-m$#5ZpPz3N z)PHVk=Z!_!p+(rA#R%Ln@ARMBn)#%(=d&h6=I@i8u++C;U%*6YH|K4nWy{Zjc>c4Mn#~0S0 zrTGyst{XegPw`#?#=X0a?5|f%bM@adUQF5dEf$l|1hoI2v5pXV&)V9f{(9BUFN^j) z33<;PjCrTOUN!BZ_Xl+bcJIqx?E9s&j+#xfTA&rw&U6=dG+e_z(v zVfntdwa5MEsKyTewXg2?Vbs3p8^quL^VC^$es$NWYJKE+Dt_PP_5Mza`@M-r z^o1DNwtM#ZZ0Q2t^S$8P@p}R9`Ch<#z8CPG?*)wS3vH7?>B2g+1zm$Sp{vjabOl<6 zE<JGy_dRlh6b-4vj&h&1d--|)ULe$UAcPxHQ&rfl9jkQRGce`H8Dy?(mrd%i_mjt8za!M(8y zmiO(z`@_NXCEZT?V>Y}?{}E5#eh~lBkJ$L{m17;)WBV;@xYzaGusscbAiodw#^wWa zdiK9p+kZYQBf7udmG!7q9iz412{9yKX23eh2W4UGJVV>2}w@_Cmb$S^PfF zGxm8|e?45V=iLR2w+sFCunwHkg^U?Lr3>Ub3A(`@b{w zn(r(3*TZt1(|`WkfBq|$zW@Ap)m-oNpa0tTvHH({%UJ(6u>Qrm*Mq0{Ohid=j{3TjQt&|(vx zZ+ma@v<>;g_4$k640(1%<9S~R+dXl0r;G#o+ghfhMbtj{9n=?3?YpMxex2;w)u9{C zk_5q$TzNwr4XciF#lB5fQ~D|_^74K}jy1iw?6=4++ZDP*cm8rXVBf@5uZ`*26@YOc z(Eo*pZA0F{boBk$!!}S@{|DmjIMy<~(;mCJTavu>zxLUcqZiiZLg$9nT0Uq)ng4(n zx5s)9d7CfCT1ULnZt8fMa9sAR?3c@4mR)~YY_IGqvQNt{+ZFrdBUonFXX3n}UM_8M zA9#~|VA~MJ{G&nZF`)k)@)_AB-nOVTTt$wxZo2)f?0OuR{ZlwDi|UeA-B)D)9FDbc zUyx&M%eWkW3C9^ZUY28D_OcxRmOGXVe^-uW3u|Bho;mcwH;8`O9-IF{Ekn|6rVeiw z((&d=TDk?>6|ZWWcGY%{%dYLJZCRFG+f~QuitK+RyKGk+kPjrKJn&ZiwA+R@+X2U5 zes6)BmVc{$bou?M4SU7gM1%Q7kcP;H{QR!_fYw>JVBW5uHSf2}9+#cR(9PnuBKu#; zF54A)9tHEhRrp)7OWn4`MfHx(AyM6~mt*Yav5vXpay%gF%YL66-zFND{j?nG zIaHSY{cF)Hb3oyxN77R>*ca8~>^|2yRPeKH|QKWt0L@uPCA<<#v%IQHfE zaU93xcv6n<5-rPK!10P4|Fj(6EvgBBQjXsxhjBT+Ajf*1mF4)C<@mT9ugEdBftWjz ztT9ii%kCcyxR1;6zmmAJx%0`TVA}iL;vrQs{rvONL2_*7;zc=*i@R>0mE#klzU-fe zdt8oRfO|%cYjP|JZ_~8?wH)6gs@uPnW7)zwFZ>pTxz~6}odRLhNz&QS=U^JFwY`*O8&;!|g+2fK<2qH8(Sno%OQkMWlf z=gH}*GroR!Pi2eV`O(R9S#Nx1I-ee!J|{6|$7V+7#&T)vF*dD7p{Wzi@N4+N| zN6*Z9b2I0r#zyC|<6eGr+O*}SU2Ob+~|x;-f23Q9nE_Z_3=qb zX>Mk8ESokpO3#cwot`buYCW?v-q`fnv(r;)Q+piSVgT|p+3eZ;9O~d4C&oSblR``T zxK^3XP0!4Erv4o_Lt}FVFE=_hKAG+2o1V^Rr@XoRZBml4(aFhKJ+MWxUSqdu%?~}E zf8x-Xw`(RlcW!3NM=Bb3bk2s3+4eyzvtofdrsc_lPCRKZae5l#-^uc=X`A# z|CXDj0Jk33!hSINp@V*x4sW0%AG-OS-q>xninrO`Ka}%!O;7pn_N5%@v!nU+Zx$Do;0xw0k9EjiecyTqK&Ll}?3_(QJ|%k;MPj_$R8kxCj$^)@g=obySsB3RW@co_r}Goz>A5o#;}MO9 zapijVTz*_mJoGMFS{hjrI_OJT5BevP?@8Zt|DzJM=NVO)nDZpb4WnJ$wixUkA6Jao zbB~{u&`-=vpG_lo9xNEXl8Fp*88vonPmH@Z*f`S6u)NtXdAqV`iJ6J1GmoEpLfTV$ z=6qJhu$kpLJ#tG{x*^(0Eo&m{=(LTggVW4rNN&?9(Vg#XyLD1BvCQb4El!Q4pUCP| zD3d~ZbbMUSR+%6V`iC|2rs132FnF_O=w@#{J~weTJ3BXeHlLoFMQNT=x3qTl)U4@V z2_`KiJtqO=KvEYM%sA2ol8b6{v(7d)@^>k4d392gzP|Oi9&|bz zY+7_~boMDtUQX6?V{^Wup168^%gvme`f39QLU~eRPpjf(bzG0h)FG$B=wv!Ss;8ZI zW@cLE%}JRQ#ON50u^BN;Q?qh@7mA+r*0>; zkw91seF=Ls;CfWT8tW#>7$YV5Xp+uwnKYgC68EkVLMb{9lF)|9Wh`Gb=S0^m*|gY7 zX=ZRUr^-bWIbtkDH-<3mZXlT>CLL#W#^q|Fx7E?HqM_WZZ4E?3XGHPpc}+Dscaf_q z@pQJP*QHcsR*ZZ1@<=b1wz`nwOQ+yv)lt2W3Kq^8x?W`q_ywcrwW%?iqjN_tTA?GJ zT#dU6!;ROF616j(ZFT+Y-y-#u5rwHvuPoEK>8E|&-|d%v3WKlPC~}o3<4-$0xq2^Na2iOym+aYrb9Mpmz((AS@yP!vNcKhJShJG`haBgaH zV(O_a`T(9(73=!_UY~cbK6+m@KXU)+`|kg7xoQrM7p=lpB@Otwf?o7W%VuzqE3IJ0 zfi~(jyf=Eg?2*8Rc6tLRUyr`FN%tyIw>89fQ%%HH>teI_!VI2N3+wv*_O>qHIw#7e z^_osIuQeVXlttA0PU$MDV_xLcH4Bxg?9*nh`Bn7an!rLdX>7{Vq2dkTiYgA-6L#o zFJXPVHtSd~gWN6RrjtEb_aolv`|dq;|3jy|L$cVL^(H6AvQx8JPoEX~=C+#L=#`sp zy1ybf-y3o>{G{CR)7!W|D{k^E zV2!7n-rv7L9x5D`eP@2aOM*Wnyk~B}%LMpJ;heChCqca(l2{r3pH}|Tptk@PFiH31Y(kp=kKwK`$k$>1p`A5Y`@!Wvd0v}aAHsH0vB6gFqY5aS{e|LPq{Et=T84Z7Oz>C2DW5NTc2Rwa4T>Y1n zW$-Mc9sh&yHMIfLj_R*`mGBDu|3Y}ryS8}^@OOlVV%xkX_&RxjxBJ*OZw-7<__CD& zZyo%g@RhGf`N1XOU8|Cj)LZlWIraa_fG164_yzU<>VP){{!Qhk)DQfhg|B*b!1DvV zOE>~{^^+o+^!`l353CKCXN{WQetEiZLs-Tcg)f6&6#wBpa^4YF1ALA6uTcC3_^%}X zWkZ8rlXwmMBVp;EYosxx9ko2S312=U}m3bw=yM>eBiu#vjo(b@7;SBim>i_XUFBjn5!g=tE;=j8h z{U6{R!e#I);(zrgWZntz9^nP>AB+F6OhVNFUn#r<{(s^>@SL!;o3_UZv7G}|X@61W zXO)w3K7p5&AC~h+)Xi4|6>D?dI|ODP5*z!0rS3eYFE5-H)_KhN9~ahn%<+xFKZtou z({uJ|LDJWHIQt}77#1;GO+MA%*{25B*{3Gh*{8OI)%2Zx3d^aX?Cg^aeZ$T^$??z0T zI$!^Rur5BFJsRF4*J-P=UJz&XKP{%Cw>@6`Tid1|6+@0P*N-mL_}tG!cu6fFNL z`8VP3?A=;`)!waB_%{5Vz4PTdSIejUH?U^!1)N4>sk_>@6K%40!b1{9%hk7ceS6op zcm4I)57l~1<|n;}d2L`Gdqg;%wD(qZUUQq;JDtazy@`XJy^$%{_&a-(64v;?Ea~mI zCS>fL#&`Cnfbb$_E6b<)JA1PPcJ^i&?Cg!)`Y`DmdlCt4ydQWlWbOxQdd|MM^_a0Q z(U7@6sQ%8rL@?hw`w|P<0|_68zZAo43Gx>c)t%?Xo}>b-_9aK*^YC}}r3!y-{{d-# zy_X!cFW(V9k&|*u?%J-(M}_GUoc$@o-`Sr9u!z~J z@)@*0b+EHPZawAf&pPanS?`Fw@i2codlbg}?(EMH{GI*r;a?Ng^^LPH&i<%9(e}{r zd&T}ZdtyuLndeVIf3+`Kez(4H_C;CkPnpuIAiT3b%kbC!7?AeYXO)}mPqo``#{LLv zzjg9$_n$Y_(XRdHP5tLh{pU@8f6tqY{gL@e-?8v9Y3h7=ukhpF?#^S%abaEGsK49P z{siq!0_^NfD!^)QGQt}FHzmCtFNQkL$(_9^BfN;&D)Je$H#M-cH_rYzd*jwSUz7Cr ze5JeI`5WbiUGHfA#vZMPJYDZ-`p*7%nBT9K3H$9|m3bTUl(Roku(LmEk2F0EzgNO1 z;BQMW@1BsqvrjI+4E)C>{pbTCj|-0k_(tIv7)g0?ISAUjpncQ#`*QGi z_xJL`n!dAl3-EXLZV4=6HfP`5{k?{`YJSe%HNno_x%+j_-i0xrJ9{?-cJ^)r^S`q{ zKKz}%i^AX8pCs7XJ7=$)z01MhmfpTkq4jnCW%#@ND#GgT>|GW9Ew3@GH(Pr7EiUqR_RZzD1b=7$)V>AtTLHWD8VK*~ zpR;ey{q z`u(>{k&k|l?o#BV?@(NdeDqn_rN~F`VP1-SbnSR4@=+UoDe}>CVXJM>lM4&l{#FYm z?iq4lH0PQ9ZeGyqoSb(Wz7cekW4&fl_Z(&M+i*{jyA3TTC2jx9lxMrS2NU!vn4sIu zyTU>D|7*&#-Kzy1<@iV8uHVTCZr?HG*lxZ{7j!SeUFVVDmNo4lj;35)pWj6KOO*aQ zQBM7?5pRR|S-hb8*G#ybo9g>>Cf}XrUEg5%CrrLOJ-wz5Zcm!>?=;_i3A+Cp+__&g z%wXpial0|TV#>2?Q+Xy#y>@MC|8JV|?Ap}+hv3fb|G!Onc5Q0^55k?>|6$V(@`60I z=Px0BZvR_Q&fe{>FSu{q{=G@}GV=^8=<^Me{$-oSdDxWaGV|TVV0gWT*I%QJ$@O+{ zJB{#qk1M#%!+nL^HO!#-CB`@_f@a=;^O+Z`?j*%Cm1%`=2)T+PA6w|D!3- zzD@0~YiLi>=l1`yDaXD|?H_?VxBoj#J4iXH{XdTMx&3#coW0xM{epI&&L;i+UMk?E zho3R&>^I-x2zq_g-7oHKzHSa*H|butslE#)o$JhZ-n*gYex1qpx=r@_Bc}YGRoB%X4SEOI$@>jc&I6nJWz>}Oz^3xQYRY+FQ@^|o z?%XeHrhErB^^4xS^rSr8FZY`AOF5}uK8N(VUk;$0+%NK)j{IhNw{aRc{I1-$-0Quy zbA9EbMLr?n)jbJz?jJ$;D7k;eq;E1eKI^#d{ut6haC47SkFSwk)0btW*?g$}R`*qb z>+mMZsUzyD!1b_8|7()vRp!48*aV`cUF3f*7DaxP6kQw%z*H1FY?%&#-j6RP9p<+x#?JoiCmXu+A6y+b+7PzxKzM0<7h&2Uy47 zYJfj0d{B1XG``m9T?(=(@08s=k5krJ|1sHhQ`XsgQb9K51G0ZqK{n-x?4MAOP5FrI zpHq-cS@Y|O!jXp$fo?H?0d9Q zvMJBWetm#T!tyl@v#Gxx#);)?eH;8U#ChT}@dEJ@@iOrW@hb5e@j9_5_ER@kpCMwO zI7%ERP7-H`^TcK11>z;*W#Sd$RpK>bedo;8SI27@^M%%5d4xDZ93xH;r-*aJ1>y>E zmAFP+CvFfoiCe^N;;>d+wod(t^_hFn-(45E@CowQ=U2h-IpP9wg}6#wBd!xSh?~SM z;x=&@m)7cR`k&aX8=QZP{1e0};vBKPpWkio3i(%wYs7Wp262y>EmAFP+CvFfoiCe^NVtZe^+aDu32xN2Z5h0EdCx}zTIb!`kT*34! z#8u)N@k)TzzOE9l5w8=Qmt!QJ)=%RP1?;=BPaGwV6DNr?#ChT}@dEJ@@iOrW@hb5e z@j9_v>UQcck63hb>=Q?cgOk54HULVzn>%CUJ|nO&rGhQ0uGtjSxqO zW5fyK6mgEYKwKfN64!|9#0}ymaf`T39LA%tPW_1^#4+Loaf(>~H=J%R{Q_}?xJq0j zt`j$io5U^RHgR~*#`292M~Gv@3E~uSj<`TvA+8eFi0i}+;wEv6xJ?|!jT+ZKBg7G6 z{p}RpT=)cWia1AHAg&NsiEG4l;s$Y(xJBG1HvbqgP@fTbuSGXkzX)-RI6<5V@Bv9D zPh2KmAYLL~CSD<4C0-+5Cw8|awSHQ@Av|(*>=Q?cgOuRt6M7&JALcB`6 zM!Zh!ZUnpf4h=~o$mZB5juOX-lf)U~JaHw!5y`hoTqCX%H;9|WE#fwDSTAa1)B0-u zBg7Hn7;%C)MVuop5Lbw+#5LkNaf7%?+#+rhhvhvl-8%Irju6L)6T~Uv9C3lTLR=-T z5!Zn zgg8c=AWjkIhzrCO;wo{CxK7+4ZW6bM+r(i!3hvaOI6@pFP7tSvbHoMW3UQUVMqDRu z5I2ci#BJj6o2dVZBg8S{1aXQuM_eGT5Lbz7#C75Zag(@3+$Ij=k$C~=%PNt_|h6PJk>h?j_$ ziC2hMiPwnNiQOw;o%-X|4#z%mlsHbDB+dmmA?;Zpt`Jv=Ys7Wp262>t<(R+ z5#ktef;dH-BQ6kEh^xdk;yQ7IxJle1ZWD)Zr1}#_1N@)_jT0w{GsJn~GVucO67e$e z3h^rO8u2=@d*x31TkA9QmTvu(ec~u_oH$9GAQC$w#{&GQ#7q#Uh;zgR;tFwaqblek6PCJrB>`V&WpW5fyK6mgEYKwKfN64!|9#0}ymaf`T3 z9KMa}PaGkR5hsXK#5v*uafP@_TqCX%H;9|W>j9qAsz$r@RURVtiKE1E;v{i~I8R(A zULal~UM5~4UL{^5UMKbrQ~im3;wW*PI7yr#&J&l37l@aLmx))1SBck%*NM$TJ81&F zzBB!=5AkGk90_nq++)NE;uLX?xIkPXt`gUX>%CUJ|nO&mUIs%z@2^&26M5XXoU z#3|w&ae=r(TqUj%*NGd%P2v`Dn>c)o>Q5XYju9t_Q^Yyq0&#`7N?aqZ6E}#P#4X}B zarkzsKXHUOMw}o{5$A{t#1-NyagDf6+#qfew}{)s;XA1Q#1Y~cae_ESoFgs}SBR^` zHR3vPgSbij*8$!sRo!-Hx4z2P5Wki981YHs#{#@x(wijyDDfwVKS%r};#UH!OVzIu ze}nk1iMPeN_0{;-5FZS%9=?nCH1T7^lf)k-elEZXN&kz)FA~2({8i#_5Pv(sdVgZi zUGgEDyI*lV@j>Eu5uYX=53sI>=7>K|{2cKYiC-lCN`Te=yh{8R#NQ^~bGO#k)>q?S zPyETyKMyU2E`+L~&xAf3`i0QvLjNN4`Oq(hmO{^mz7TpL^u^F~p-+cC75e#*d=v1{ zT(&Uh9h%8b9y;;xdk!g#&rIjjW7FrR=DghK)c9mJJzJbjXA2W^>FIoSYSadw%iku> zW22LkvwE<>KNxLlE<1D4c)jX{EuHQyPj z=GpAU^6i8OMm33ce74TF6C`^+J2f}!9XdOjpY>+PW=7}6a_L-lG~cu3O*d_-iR+gQ zQ96yw0H~yQXmaxW+4Si6_{{9Y8ELfwt;)cGo?WQ>E_2Lv*X^O*}0jy(Z@xLXN}@~@J`=%@2UGAI^~@{apJD@ zT`DmvcUrl_%I#JTJ3VIkD4d~3fKGvjtww>+SURTJ-C^bMF{?*_&?pdkSNcwkbElQt ztw^Da>oF@w;p!B4*y>&B!*|#utlkcmM6AP6=g>KD4u^3NOW$q_ZbS-h^oW(i&?pcp z*_u#yLM1mF+Z{-5)}eFY93)%gb65J9Ex3`}ElIHr93u1Q}B`AV>=ii z7_oD{kIroob3=$=)b44vW!#NHf{_E~+Lo~?j5*VeXe-9jM((t7hn3r{NShkZV?gLp zAoK{(De$n>C=e>`Z<3S|iv#Hh>mnUt4rGKJw*6~W28LlBA?84$8kGTJJvs-@K}L%4 ziKP!mHK{wG64S8cX;iYrZ3|=T-^j<#LH!-8&D-_Yg^c6p^`bbiS=X+EvhF*&PUa|1 z>`<@6g4>@<%Lwd$|Ssb2Xn^r*jvc#mU7VLIPhB?UjG*M{R)Ds((#_^~yhv{4+Kg)BpSAnDhVo7VRJTF+`*Z)5V9c z_a|Gl|5A_o@9&ZSzuYSS`)v-dRsUb!BLCGM^}n`9{uycfUhO~fsLkJhjru<(k$bg& zbj`*O_WyM~@_*|V`NuwFK*{lAMoQ)WJjrvbX z{9g56S+ntj^}nG<{>Qe+KQn3LzgGRDTjalv{4+KgQ~v{U%=P~nj6XWfz2wt2qRyGY zP1`EC&5MJ&ar_M8F9ZY2vCH2%UndbcP4!zx{DXMk+l8m@@b*jmUhSX!QyU|Lh&unj zO?H>R>wmRLz4E{QIUDgH?%!Cl_jTN{s@n8k`7a~?IPMQ={%@C^^Dj#K51#(+w0MbP@Ruax>r5}UTf?^~w|u46RbPs{G|A3==&4}*V!`Tzg` diff --git a/internal/ebpf/loader.go b/internal/ebpf/loader.go index 09582a9f4..1228f5cef 100644 --- a/internal/ebpf/loader.go +++ b/internal/ebpf/loader.go @@ -258,18 +258,6 @@ func (l *loader) attachPrograms(cfg *config.EventSourceConfig) error { {"sys_exit_fork", l.clone.HandleSysExitFork, true}, {"sys_enter_vfork", l.clone.HandleSysEnterVfork, true}, {"sys_exit_vfork", l.clone.HandleSysExitVfork, true}, - {"sys_enter_kill", l.ctl.HandleSysEnterKill, false}, - {"sys_exit_kill", l.ctl.HandleSysExitKill, false}, - // tkill is an obsolescent predecessor of tgkill; treat it like the - // other legacy syscall tracepoints. - {"sys_enter_tkill", l.ctl.HandleSysEnterTkill, true}, - {"sys_exit_tkill", l.ctl.HandleSysExitTkill, true}, - {"sys_enter_tgkill", l.ctl.HandleSysEnterTgkill, false}, - {"sys_exit_tgkill", l.ctl.HandleSysExitTgkill, false}, - {"sys_enter_ptrace", l.ctl.HandleSysEnterPtrace, false}, - {"sys_exit_ptrace", l.ctl.HandleSysExitPtrace, false}, - {"sys_enter_prctl", l.ctl.HandleSysEnterPrctl, false}, - {"sys_exit_prctl", l.ctl.HandleSysExitPrctl, false}, } if cfg == nil || cfg.EnableFileIOEvents { // Legacy variants (open, unlink, rename) follow the fork/vfork @@ -331,12 +319,14 @@ func (l *loader) attachPrograms(cfg *config.EventSourceConfig) error { // Successful clones and process exits are captured from scheduler // tracepoints. Clone syscall exit tracepoints fire in the parent, and // exit/exit_group never return, so their exit tracepoints never fire. + // kill/ptrace/prctl read arguments from pt_regs at tp_btf/sys_exit. tracing := []struct { name string prog *ebpf.Program }{ {"sched_process_fork", l.clone.HandleSchedProcessFork}, {"sched_process_exit", l.exit.HandleSchedProcessExit}, + {"sys_exit", l.ctl.HandleSysExit}, } for _, t := range tracing { if t.prog == nil { diff --git a/internal/ebpf/matrix_test.go b/internal/ebpf/matrix_test.go index c53a492b7..7e3dd91ee 100644 --- a/internal/ebpf/matrix_test.go +++ b/internal/ebpf/matrix_test.go @@ -55,9 +55,9 @@ func syscallMatrix() []matrixRow { {"mmap", event.Mmap, []string{"mmap"}, hookSyscallIO, []string{params.MemBaseAddress, params.MemRegionSize, params.MemProtect, params.MmapFlags, params.Retval}}, {"process_vm_readv", event.ProcessVMRead, []string{"process_vm_readv"}, "tp/syscalls enter/exit; first remote iovec only", []string{params.TargetProcessID, params.MemBaseAddress, params.Retval}}, {"process_vm_writev", event.ProcessVMWrite, []string{"process_vm_writev"}, "tp/syscalls enter/exit; first remote iovec only", []string{params.TargetProcessID, params.MemBaseAddress, params.Retval}}, - {"kill", event.Kill, []string{"kill", "tkill", "tgkill"}, hookSyscallIO, []string{params.TargetProcessID, params.Signal, params.Retval}}, - {"ptrace", event.Ptrace, []string{"ptrace"}, hookSyscallIO, []string{params.PtraceRequest, params.TargetProcessID, params.Retval}}, - {"prctl", event.Prctl, []string{"prctl"}, hookSyscallIO, []string{params.PrctlOption, params.Retval}}, + {"kill", event.Kill, []string{"kill", "tkill", "tgkill"}, "tp_btf/sys_exit", []string{params.TargetProcessID, params.Signal, params.Retval}}, + {"ptrace", event.Ptrace, []string{"ptrace"}, "tp_btf/sys_exit", []string{params.PtraceRequest, params.TargetProcessID, params.Retval}}, + {"prctl", event.Prctl, []string{"prctl"}, "tp_btf/sys_exit", []string{params.PrctlOption, params.Retval}}, } } @@ -69,16 +69,16 @@ func TestSyscallEventMatrix(t *testing.T) { assert.NotEmpty(t, row.syscalls) assert.NotEmpty(t, row.hook) seen[row.typ] = true - raw := rawEvent{Type: uint32(row.typ), Retval: 0, Filename: [256]byte{'/'}, Filename2: [256]byte{'/'}} + raw := rawEvent{Type: uint32(row.typ), Retval: 0, Filename: [256]byte{'/'}, Aux: [256]byte{'/'}} if row.typ == event.Connect || row.typ == event.Accept { - raw.Filename2[0] = byte(unix.AF_INET) - raw.Filename2[1] = 0 - raw.Filename2[2] = 0 - raw.Filename2[3] = 80 - raw.Filename2[4] = 127 - raw.Filename2[5] = 0 - raw.Filename2[6] = 0 - raw.Filename2[7] = 1 + raw.Aux[0] = byte(unix.AF_INET) + raw.Aux[1] = 0 + raw.Aux[2] = 0 + raw.Aux[3] = 80 + raw.Aux[4] = 127 + raw.Aux[5] = 0 + raw.Aux[6] = 0 + raw.Aux[7] = 1 } evt := raw.toEvent() require.Equal(t, row.typ, evt.Type, row.name) @@ -122,7 +122,7 @@ func TestMmapUpdatesProcessState(t *testing.T) { ps := &pstypes.PS{PID: 9, Name: "target", StartBootTime: 1, Threads: map[uint64]pstypes.Thread{}} snap.Put(ps) - raw := rawEvent{Type: uint32(event.Mmap), PID: 9, TGID: 9, Retval: 0x1000, Arg0: 4096, Arg1: 8192, Arg2: 3, Flags: 0x20} + raw := rawEvent{Type: uint32(event.Mmap), PID: 9, TGID: 9, Retval: 0x1000, Arg0: 4096, Arg1: 8192, Arg2: 3, Arg3: 3, Flags: 0} evt := raw.toEvent() applyProcessState(snap, evt) ok, got := snap.Find(9) @@ -130,7 +130,20 @@ func TestMmapUpdatesProcessState(t *testing.T) { require.Len(t, got.Mmaps, 1) assert.Equal(t, uint64(0x1000), uint64(got.Mmaps[0].BaseAddress)) assert.Equal(t, uint64(8192), got.Mmaps[0].Size) - assert.Equal(t, "anonymous", got.Mmaps[0].Type) + assert.Equal(t, "file", got.Mmaps[0].Type) +} + +func TestAnonymousMmapSkipped(t *testing.T) { + snap := ps.NewSnapshotter() + ps := &pstypes.PS{PID: 9, Name: "target", StartBootTime: 1, Threads: map[uint64]pstypes.Thread{}} + snap.Put(ps) + + raw := rawEvent{Type: uint32(event.Mmap), PID: 9, TGID: 9, Retval: 0x1000, Arg1: 8192, Arg2: 3, Arg3: ^uint64(0), Flags: 0x20} + evt := raw.toEvent() + applyProcessState(snap, evt) + ok, got := snap.Find(9) + require.True(t, ok) + assert.Empty(t, got.Mmaps) } func TestFailedSyscallKeepsProcessState(t *testing.T) { diff --git a/internal/ebpf/mem_bpfeb.go b/internal/ebpf/mem_bpfeb.go index e2ee49396..119afa03b 100644 --- a/internal/ebpf/mem_bpfeb.go +++ b/internal/ebpf/mem_bpfeb.go @@ -23,7 +23,7 @@ type memScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadMem returns the embedded CollectionSpec for mem. diff --git a/internal/ebpf/mem_bpfeb.o b/internal/ebpf/mem_bpfeb.o index c42f95631c87094af4da1872cb54734f10ec1c36..11508e9f158433e53380583dbc8c08bd4fc2e73c 100644 GIT binary patch delta 6367 zcmcIoYiv|S6h8OP-QBx=&_#)shq@6GYSKzeixfe+Dnd;wZlZ~e5^Tf6nt&h*sXV+J z!Pp;28ZR-8Ap`+ULx@(Zrav^S5w(d#H=&75@JD|TQ;Ctr#H4{gerM+FdRYSO+GWyv z@A>A;2fdLX_4=P{Jo!Ew81*> zFR0&UUGNXr@3AKQSi@Xz(jf{%pCGcz@O=;uigg!W+%E=szR1;(n<3kH;*cN5cM+Zh zDy6@QYbY72rri7kl7fP6Od=& zy9`eXa$MvzQDm(@x_G(uj2~-U=qZB8_c?qY#e?F$AUk0OHO`Dm zM9RASOyk`e!9C@d{7FHGRz=E>HRW`bEq;B|{F!5zfJ-|b*ikv|Z){pK`}Zni6>Fa2 z7fK~uu+%@>^sVaJ*)w!#$*Sl)2(|HDU0do_YU#C?cW>IZxn`4wpSN69-aF{WtK-s$ zMJ~WMi{aX`{Q>+0EaZ4+^=p7n1n`qEp(}vdi@aBPjyZTxtmAk-A>u7hao#7W$dwu> zFC+XG**y`|CIr`!y%*bvk^zkMQwK2m+X-wbK5*Tl-$3dM#yti@G9@MY9i;R*?kCSo zc#_mv?l2$?J|%U|#=v91JORGz5C(fZfMJk5VX#8iPS#HbFzcrTV__Si=XN}vVhp`< zJ*ij=_5Z`DMlL*t|WUD9&+3~y(}Pn zKiTJ4AJ5avg2HWN|Hk9hL+@cl;q}x;APKW5<#X*2a zoNmEqu#drWPJdqeV+Kdok(vcAbl^dcU7D*H4m5yEo$^`7%hpbpT_4aE;)f$!T|iTLoVsCkcbXNrR(UKx!s% zM*wqwSzvSysROL{x}^bEaD(lF>q+%;gPs6py?7+Ln$$to_llk|>-z*F#(j+Y1DFjw zCU^^}!*?S7;ekK}dtgxT+obxjNy5VcTm_sK{1K@m*mQ0dUm|r3xNOAe%i`p8FrE;+ znw)jOi1L4l%|`q+!_7slD9TPDS8M`sO+$^D_hSLP95`-p`8`A@VHp3YxhCT!ff3qV z#_JYbCuF8Qi}>pd$OEKgK>R#A4Ofx4&d##gfEfT9Q^Zqtmd!FUL6*$M1!r@=EU5fx zqO;5$)zEv#;gXF+X}Dg+QNef@(FhFCa_Rbx3>0JYc8bUx-Fo z&nxEkj9I@O_%gm(vVsTn`PUUZVXtXGQdFOG$gFW;3wNOO!AZ=VHez#Q>!zE3YWFDm_`@o=^l^A!C)8th}Pw3Lz*l zS$PyLf~|NDl$NY;{v(C6mEMFUB`fCt9D7Lu(HOb=dbTpBpp;~#&ws&e#R&xlYxZJt zk%SWc|72x;|3?dCtJ0H|@c*sYN@p_8cqfpe0%TS36InHzQJ2kljFGIeWTo|-0psu- zr{a9F!u+NrCBtQ}UgGLp#_JJ1vsV?mq-4Npl9gu{!&bb4(vp>D*r`Ca%CT1wWTiuZ z(CM3TfUGKe$x5`d|0Q<1;t}AOaWz;mpRGzyRvxn-#}daXR|XAsrgya}h^)NZceN^r zti0QIwSq@)O;+Il+jX@nh^)NqU2ej}JW{%=RY7Fs<*r)2#sIfuS1TFs<~J+PT)mh~ zYNSJ{u2$VEX0kJk6_>PGrbyRwiu@02<3k5J%H!5Wzpv+vHQ*=T@T@UEgLku^-0fN2eg^Lm uKe^{kd;OH3+4H0Ip5MQBsny|U_O@7G`>}m3*07(%d(7{{JLzZk#s38;Y=#E_ delta 6392 zcmcIoU2IfE6h8OP-QBzW!9`Gu5Zwf##ZV}1fmQxiMJb_>k`SqhVo?eusn7_~LW_4F zd}tz?CYOgseW*zv8sq^}HJf1Ks#R;?p%0BI22F`3_DT0evPq5cJ2PiDmnGEQuuOXI zJ>Q)9Idjg;`F1)pZ)NALp>_y@6WW!N=*|#p~@(AAFi~K0$D}H9(Yt}V? zRpSZkhJU`X-}=*!tzYilbcn*xCyA^WzH9NISS#@2eyFoni(ChJ8)O?#9P%!F*WpP* zZo_vyo)qML76cS-$Nf76yZ9!7yYiUGzp#F_cM|Q^p#H5IydXE>(Vg+xK%{bFBhP;q zHad$j9^0G3L$ziu*yveoKns!cfEch5KAFd)QPj5*MI!j}Vo)O0c(ELZ%*L>sg#0kR zPvS{IeoW*H z{6c~IBU}B6man5nj`egMKlFN6)A-bnA!<8#~Q zmG>S7sBn3BsOwm^x4DI=4>*FpN^I z2HUbAB_33lN&Su^syqy=C%g%7A?`ZKUF(&!7J?J(H0^Rexg28=njy#_mj19FTePmDbc#Y6|SW);eHab_x3d8+mU&jiZqzu5A^{ocy zJ>YbR-p9d!N1SfK-(h2e0G;8Y_9F&IUL{rYAoTE{$1W{Yqyr7$QfIbkfH~2R;Gn=m zPVQD5BEeTlErr_3aNUgw%L#ZM>D7XnHkte_k zcmeJiQmYW-&}0#w3Sfjdlnr2RpX2k-10Vs_qaqwD!gT?R0T5f$ei|p!1#UH1M+XLl z+XZ6*ec01iZqO@uBdHWO=nG)hi$|huq~2lupy(O1en>E4 zJji%BfZ4zi!EcZ{w*>JIj|D2&1D6E9OKJ$4B%BUl?CNkv@Fz%m*mQ0lXGskMS4|py zRf3#$#&d!XlCvKeQPzn`CpH`L*9^BDwW6r{2DzdOz%>muJ^&mG;LX5sgR3_XjdH?j zH5ig9?Z60aA>(xmZWc1ro<;n12IK)!GT`PwBLT9i*@Yju zyV2P-?KH-Z#s$dAQ#njrDqB^ath}<=s`6xo3q%=gg^X2UvhvDeD{P($la)u|GT4fD zZ)M2}=RZ<9Tj}FdQL9LJw?&h>hCcjx8{I$z2Q3Qn22IdwDFcGJ>@%LWFHTDIW}3Yyc>ZYrHi z7Ws$C=tztZS!Llu%UZ$y2^U!ov>GTR7_mPjrbJ2*O#kZhJNI|Cs?mN5&k5+>tIxgwrf>KEfz;oI0G&r1A-*c8ty{BmrD zXAM5Vl6+GBdF2>>iujj?*;`#c*WCe^lC}%WUt$ry273w4-%hrV(*FPHV}2yt-;7pH zTLtvdHPV5_L>7`kI@88*X{RKEv*KK^4^ zskjoq8aIVsi$4KBWASxsy8>B1pzcuVwK$r)5vN zYr&Ey^Jd_bCik{%pI_s9uWZ}5dFPgr%|3Q@)C@ZAJJcf8N~qwOot-eBD|sJ`52rr` z=O>1FHT-dipN3nq9m8WBd1TC`jcF1=_z3@VX|T$eq^uN)2toVSBR#r>wHPm%|9UzqLE>xR z)M0uW;&NE#b*N!>S8<4=aFyoA_#wqx@&{Afm}PfpZuwY0Lom0k%5TzvXi>yulrerd z!&@pmF6r&I=~wO(K4zN%<*UNgwi#5$WCLYyTFn1-GQ{g_Q|w2uQpZrB-Zmx5b71>9 z+drqJ!8+knwmG9ixdWbb#x~s{o&dAH{0<%^J@I73^eTS}7o{TRim*$C-xCq9j+lPU za2d|;wf!lP2JgUy7x@BBpC#w0tVlX8=}Y0l%eILruaWfMY{Q`W=^KPuxy8zR;0f1k zlZ0KVKqB&pDA5eT7gj01OS;WcuTwq?&n#kljmV!-ZsH)GJjpR_Be*@plSuE0u>ZnC z+N&8ppo08jw%-WuSN@Uo=nRH~k&*Jh!Ub%N;t`w-aX#rOWsbQuf(PADM4SvUhE~4lX9~pXBc??8 zj&!IYV#<^w2QIHf#I(%)kLhd2&5D3?k4A@+Y`C?ZZov+^p*aM&?hLmY=& zm77S9x3LC79ECH=+ex2z)G>!boPgVu-zI%>yW^VnP()$7V>*;SA%lGk=F4S7ZU}cU z1qhOG5^FcIt&~>@H?fPb!NFy7P>Fy|*DWvcpTV0s45*fT%)dmeCqhoNAj5Jvsr*Pj z+v^1TUK!(u2Hw(<;6&T19Eepq#3EK1Sn6LwebG|}@u9rz|3IxyY5|NNf)g%Kt3G0- z!9c9~m4mZA#)gmvo~40;bHm!P2~PA3YsX&cKyOw%Tq$sn20ls6=@5$;vAq0r`t1jnOLqSUYSgV2%9Pklf&AF0*UZwAch8i~aBSy@>{LpCB3WB){&!x;=tENA2F{1r!;OpcIaxF&gU1~%Jax6x! zFFt`9$q3|Dj2M4WD^(+Z3Ig@Zi5SWL55%WgwIJYJh>@@VfjSN5UW~H)KTxCGixKlL zi%!+(p^1?kR5k~d+?K*(bipNJ3%@jDoC0#fU4R>5Ine^HhLg$x8YD zdtZ%mB1Z1LuSSf>!xtmQ|6W(4oQRQ&_{ddhl&eur#K@Ja)96>D?4o?gV&s}YeExGa z%83{;|8i9t?P`=0F%tcktI{Y}qlYF&a!}cNP`UE|9&TKQo0R`Qn?}}ygbwBRl?RkB zDVH!kRgzJZi_i+!VqaG7Rz9vQKjlYh$9>=p$uT`jL-%Nhe|g^b7j=EO{`^eqoVV?@ zv-UufH!uB$RqS=9T`TR)eciQAdY!yu-rRkzRpoW=J8!+`?b=^ywR@fWYpo{l`uelbR5N22G77@}zyyl$aQQ=kB@P+r>Wk!JYKp zbAEH?&di;;Gyk1VTy&-`I>R|PbMUQO->!EP)hEBN-|1fcvGG&#dd#QlFUNl2ZC(A8 z^Nsi6>SvrEyfqC2&M)5ahHLHb#1h8D^Vp1I%qpy;>+t2d4A%+sj(yVxw(Cj8ad zJXZ()8f<~93!mgjIeETEIf04K`ejiMtn`~TAbNfv5(UJf9Ydw zyx8A@R!&=0^wApWKr@+FQb0Oz8~z`RN(BScj=yM8@ulUtO7*k&8TIq{*WllQEpXke z{v>`A{+(EW=fg*@}NRR?>ESQnH%cuCg-s`XOVUE|&2gX{xOVX5^5!uj#5( zFg$MBd!=dFT=0l@yy+^RWbC$hUpC!XJ5%M?R^5T2BWBifnm1nkC%I6K#2%CzNeZs> zwl|-u*tutK@6+4&^){Z&t=&+uY7XnO&u`zma(#&R?>XH2%+6eIDD&jd`q^05%hWE- zNowM{wK$PJ-_HH@R4INRd}F%A8{zjtya_(!eRaNxEq%G?uQfY#_ZPk9^qp#(_dtZDW(EOD(t5~aw2Aq zC?Ayv-jA7a<#%ECRLq>iN(0|xs~c%Cf^vdSue!&WnGmPpS)XZtl@!=P?O3T$ zI1MM2H%pxEXF{BY>y-PkHG3Jc5Ldwsu)NT#*!20BX$f%xZWp!`2;Qhu3%rM|_=zFH zN{4>OI*gZ0cnAHIB>5ZQ{7ZB+#A{$#RC5i_#!Ov^6L5=`$FMJu@?7#jFt^>x!QAq) zemt1lKII`gkVwW&K^fzx6Wpb~F^LbmW?K1c;a6RALHUO`?I)UDGpiYxV&Y+`;8z|< zCkjCL7`kIHw%EA${~K^eFF6yQW?F6L>jaZhu+%g7TB>$jj0(GpuZb zj3c1}ODQl}R>5iIQ7Wj+u>8t+TKNp|#8QTXk&+Sk4z8->BP?T?O5)ZpP)UKj7D(|q zS6mk}J!QOGxsiB+wKlAL7*5~B{!qpzLYyK#6=ErW&S&QTs8o=PnHen*@N9@v#FGrI zywO?8Cs}(rWl_)sC_MMkFyh4*tlFaDiq6_Yjw#>;3Eq3vKdgXUr=}p zEIV2dzYESPudQTxjq$TV8RMr;?$VK9L))z!Y-s&+%>0X5708eV9;Cv=F*7GVfm)60 z0~kLAJ6s@EQ{+m6fmlr|2U~lR1tInCqW-E=CG8lrWTYoc;_-@f;B-+ufBNih&PmQ7%Bi6sDld4hlVq{q_B{hm(jO;u$VjV{; zM%EXfK#gRhh*pf4f7!WQb}Bg^g~jMccxSG(qX~DzvZKikC)^5WmH(9(S$43J8bvQg zcAgp`9ubR?^^Zn@8vRo-k|}VRfzG z_+=9#+V>myo1;-AVq`_vP=;AAJprs60F{ME^B*KD5M@e9mpo_JzXoanWGKhrzqssna(eJtU-0?b? z1hjM6_ul>7bAOzB?tSE9S?c$Je816*W%ui{1)WT zWX19O)hpSd@dN6Q*_-2ESDmbO!@JV;fGC2!M5G4r+<^;8ZNiP)<&obi`2zA&$a}bo z$nV8-C$19mx8XUCtB(Ag3K=A>$L;SEPVg*&KW&*P8@TcM^z*2<9p#S>;fDMTxO8JY zCW(S+@sY>>KYR>6hW^;!IxZSEW5LH%u>%tr=;PwRE~5BW44Omv4DuhvlP7}|-;EpR zi^$(6`4aLEAU}<(j(kn>E#$v}{BAQ={1oyxBVR)KcaXmV`8xR&zmQE#ykC7kt4(Z6 z4`X2bapaP3dMm5_+cx}zY;p3sD~A7o5jf4_ zf+NF!&Q4F>cFl0-GUFGUKFl{HEI|BJHnQs%{{An`pE$qkq{o@;<>@W{Eq7P4SEhGr z!{F}2(PkL77r(s!bMO0r&VBK-UwiPtXGR~?c;c6(Lw+{1Z(I5;^vbj6bR&ZB2%eU2 zA{zLW!?$8SuRHu9IK+G2*1sKm%Hcba=e^8hT!RZq9mRE02cD?N`v?WyGz#Mew#oo` z^D#gjR{FBV{hLJO=F7|`u>-W4#sTpvI{L|cE zNh5Oe*Z&9k zf6c+3Hc!{cNBc`@4f12nR@AgFMF=Jorbu|MA#7k3x2 z*%CfS!9HG^w(#F6DCNPc%vk^EN(yd<1OA$+5RH)6=CxlJzJt6~tW{tkt zk{)|O_zUEnWqYy5E)$BLBkwitZw&SnGm3tMjm`yA(%=j>JZ2D-9A^8BVH<&ke~$UVq)en|Sq65aoNg;4nIfMh)k#rC>Gz&j{Z^K^YE3WnoO9 zemS_}Ft?Wp<{l>h5ZlwLRNw-xP!q0`zrYpd9cH^kBzJ`TXV|_Vc4oFO3S&tZnHvtX zgH7R|lKM0j8~`AzUZ+t>$c6jYcy z!bd3hBp9n~4!oyvka<{tt#GVjVirt#f28Ccem8i`FmfhMfj6K5R=mo> z_JEsnm=Cxrx5xSq&Jwi|8mm^GRj&op!1Rv$qI6)@>!`35FNu_A#cPEJK>v>tu{L*!!VE+p;PTNuBJFxpTLqM-U7aNbnFKq?Q%w79@g%^aywV;>sFsm(lP7&((lhVhoD zVuGTI)Za^L1e=oPx}2(!t5Hzx7N`-R79R{a#0}U!FZL>_QFf^AFn_4<(s2E+lG+}C zmxa%e8oM6ca(E|Lmd3vq>#x;m)l~2?5Pt_~wL*u!d@S(`0A(Y@?88>TwV@-V zY0V~HrOY9=YL0eelI9SmP{TDqB z)=UK}$AQei%5eba*uhBTI24Di9EbTHdr?^AI2`S<>j`20R*$VZSvd}6hLOl|I3pb} z=Mbr~VJpYsoY+NRl{!uXNzm?xmLfGY&bincqISxBL9juF8j!K}7ikFq+s3iK|Esz;nIgYB*fyl8Ho5b>>*hP*bnShn!XhrNI&(W&GEKdCW#~#}T z{3>e}IgSfGTyz*6#AAl79LHs0k>j``EOH#rIn3>=SbrYS>Tz6im@CW+*Nq&C7&((l;0=hC zmFJ4)lrH)MgdLj|d0vnXtUNai+y1F3b}P@z!d9N!!d9Nwz*_&U+;+GC16sZ2P%$4i zdhKH*%`Y0cw({GR=K|~-S_AxZSX+P8a95tk#BSxe0_OGCA?48XZ}%R3ZlIA3Jugw? zZI;tIz$G=kyZ#Y#s6vhr3at<+(w!}iUVdNwOOev?YF^5c8d=4=sn*m199`6u?MdRBg- F_%BrMsVWZVwn+T=8q{6D~m8#7^s0w$sZzqpL?EjbM|7} zKWq-U_nyyr&d=vL_k8c0#(8h;yf?jD&Hc3ZOpn*GZGNWbQSSr4im6B+!u?grZ%6*O zd9vqW^{0Gt&tvMZ`MZ0*s{Wpj@4YqqmroSJo)W1lo;|pb)NQzNJCv!NlJ7+RZsa{& z3G(;hxf@rC{1H6&;Hn{iR3U@J^|<}0aExaPK4F7`_hWwP|8_0hb`H!2iqKnAyM?OXQbI5N&zDAm&m-4>8yVT41c;Alf zhZq=t?78^Ic%m|=_$Ro10#}0ki+HByis$j<@==s8pdot@kN6cl@4+g;It{BN4- z9F#gsX1C-w_uo{Jh_w7U@9n>(Ah@UX-F#RG(Q4n3k8jx8f1gkH-@c{8#|WH`;KD>Y z+Vac&_ipRh@;);!Hr>xRBm^M3n0F0asyuS?)QL04PM_F2zdG`ubg=7k?s>t;e0)v)Qa+34|QkL zm;rl=(;aZwc|0xON!0R=!-t95S{?o*CZ9Tt_n`ePhd+fp?|U9&8!jY;h^e0!K_W_c z&v6KC>W1+@*j82Y#v>G_!u!elGPWcQI}A_K2pH|XPZN#v%R46aCrH1*JYg6)lWJn0 zB)z~xvnu=$_CLncNhSr8M2GMe=w9LHv31~ToeIB<#p5W_!w#c&%^rZq^xsHd;Q>b- z<^jeHlO!!3@wbwG6K}Q7W=w}ZTv$iki}*iaYV*wfXNg`o2!^{##ye2NRR&(?&~$DL zyw08+H1&})DK+*ov@-F`v$3_YW9Hb(%>B2?kGaE|=>R#C<_rfRdDCoP5gsJ(0yBpS z6ATWL*T=m6-uAr5Vb3TyN?zImkQD^y$UB4vs@pUOzD?c{>;=Uu;tuD?`w>{%3H*V) z*{$FOu`_ch8^Zr4e?Nz2(Qw#7{$Lfn%#8SlA0@vJ6VNMC0Ul^@?AL^kledIe;kYU$ z5I#ZP@8BUnZnDb)!f%mxne9oFT^1D1llMCJ*9&`w6@{;ox6B2y!tgKTUBL?cR61a0 z`;cMl0e?j7|HO*|kN9JTqaCEQx5^;eoYST!7b zc$45EfBn6Tx3KU~+(UXRLKq~%2S|6~m<} zmj}QKcmeSh(p`vgu-L>)4kN_Dn!{Xwo!@_SP-!FGje@Y+#GMYKgRon8fc!%-cu4p- zqJs&A!@^j=#7*E4hq=8huyT&{(`?ViqyiUkg>m6J=^9suIp>P<86Q6LcRZ_#B1H=yV2Tj%C4}yCQBWKbe7@;gr zxM5*?z>PZ02izF9NBmo#BwB=PtXg?iy{1e9(>w0d(t%a4Sz#+);wjIH*Afqa{=ZN3 zCOqpc3(w=QWL^PhT;Vk$77wd#t#1&m;&mz13@a+d1#{pP7K{lOYQ`&;0d=Rbm*SGj zfb3DYzW8=HhE9-pVr@Gx{utb7UCjk!9|l)V1q`IBm{=h$XizYFs#`jE5T`aXyB_v3 zrG_g5q>>n=BU1k~sV;0v8Z9|fUALfMtSnGnz(Ra@hTMSd6Jq}kDSl0<<}iP#aA>&x zv!r(MIlUnK4^q85!3~FZgC#WjA;h0Q1Zde*(39pnpinDb@$=?8Kw%X;fR^t7{`@al zBj1TjLc?;b5{J>hN)3}FHDuV!>|hhqOi!Zzf^EW zR*(G^Q^CryFDnQ|j{SA9iyQ|sVJpW$waK0ciyQ~tP4;3zSijX{t4^WFaUd(SavTgv z2O`J8uwg65!Km0pj)QT-R*r+2ruwsB)_*I%fw-{bhIGL43^@)~n>tuCY~`5uF^90^ zSXkuPidUhwIA6k4^uH{S6U7p zJ|!%298EjS_PVghaWvyF;uU4HQXqO9%{h#NBw7#_IgT0*<6MXq4O=;`SQa^MT@t&< zaqF6}$Z^&dqkxZ2KKpShw5LSGM=lbVw|{|D?O}k_E12cE>eyMHI~`_u9yE-cNhuhi zE#-Nn;Eb;M0|XN&<#|dvu<~3tZ2PAfv0Hgw5VrCxp0R3K$Zw(lZ;0Hkq5%(R^_pG9 zEPAamQo*koxwi6K%5$d~u$1R+!*)R3Yq*qW_5kaD;Zk<}TNt59pX+F3UC$w^-(Y#p zuA|SJEzj9?^m()8IU~(KmsM(F17{bh)aT8X=j=NAY$vo?@|*?N*5}QZXXyVm^?9@9 z8R!2s^?9@9nf2fPT>fABTZy9y-!fGv1TcpBe-bO06pCm?vj{t$vxWp1o5I=E=DOYA7GYy`InDK9#TFK9?uoNd5~9Kmi5- diff --git a/internal/ebpf/net_bpfel.go b/internal/ebpf/net_bpfel.go index 0b2ac2fe4..da8e0c87a 100644 --- a/internal/ebpf/net_bpfel.go +++ b/internal/ebpf/net_bpfel.go @@ -23,7 +23,7 @@ type netScratchValue struct { Truncated uint32 Pad uint32 Filename [256]uint8 - Filename2 [256]uint8 + Aux [256]uint8 } // loadNet returns the embedded CollectionSpec for net. diff --git a/internal/ebpf/net_bpfel.o b/internal/ebpf/net_bpfel.o index 17569c1521e7cf0c49a57940f785d6de29fff23a..ca639ddafb05f690ca4ee25c37bf6f989533114d 100644 GIT binary patch delta 6771 zcmc(je`sB28ONV<&fV?J%}sNcmNc8)dTR^4(f+vYk~W!TyEEO))(TNtiBst9=0-Nu z-ci)6b~{%IF4ZxkXLJ`fB%-pE6-h~jfU8DmCCY^OV-U1Llrru_O9Ykt;n45*z0Y%V zxaeOK^OAes=kq-8uk*g|dB5jmaonF8_b2mS=~C~ez5Yta>^*xQ_iwu*E~V~7Hm~+J z;c$5 z@*I9cu=gP^;`adT{m85M9fghLu^j6^tek>fg#Y9kN3R^{4L=3mjo4Gj@s~LOTa(`p zV=&PeBl~|RWBf4M;dra~F`=&xj4>1rpbw6Zpa2JO5cd5WMA|Sh!>~UDn>WLBLhT&v zht)2^{sinnC2YR|)d8us1D+3>Tl55p|N{yOX~*i|nO`BwDHyWZ!0C+g_i6`sR1 zVH^q0-1D%D$eF$g`~Aps_?=gO5%x>!FTtLIjkXi0FR#G94>{ATu#r+5ak?djjq_1g~D+QwtZFcA4; zNAyVl1Gm-T26i&|L0*tp^4aJo{a1ripQ+3~fAF$TBRV>`Ex7N*Xmn<9p9{P?crLjW zf!(>!p8DjTdz^LVi7z~M`tkf@4rd=Jjt5bFXlM9Ubiq!U?!xcWjpcNF2-lyb*W&ks z|Ioh19{_hZM(N5wi0hRY9|dzo*vIXzgvd1P%j~culH)$2!%`l`Dmaaev!UX03HSNj^03?xe-Vy#z}Bl8AEZ2{jmH$k+=OhkZ=kHM|gBBm?Gec&v(*)g6yo-@Wt@PL*_=28(?#%*aw8yq&**4EC}wyYI? zg#je938^Y0b7=-wHh7cqnlH=Bxm&<5`%+haFZr-9tIEh433XRJtp6Yiq=$X!aSo9u zS>c#3dF9W6{o}qn#o1wve9@N~oysfV&DcP5G42A-E8jpob0i@P%KrdoiwRjGhiGsU zv?P5vA{Qv)8G;1D&rG){zqeuG#n-6^DOXO zAY(C3gUiYn5l>HI55zbLt}4HV_@);EnTT-)JgNK!;@!0%lv>QuS;LvE{C5=aUj}39 zI3ssMi2Nxm0djJgJc`Fk`8@gKc#4qQ!R6ziqJVYlBTxUE;1eUB9%xv9ItJn3iDm`v z02h?Ct~=4#v7KNe2#`&jN-?H5je*(TF(_toL7HM@;xxhXeEuy>(g8MgnpQS(no~A$ zT2!%l3LRu_i10{Yhv&%4(iE@nlCQ6c*AKuQb@YYu?)f+I5ItbX6pyU3b%-a@4ba4+ z2(}sXF=Ko;IEg_r(f>BMFlJNT;O$_WY4j6HChIxzUC^i?M*qO~(4OKt&y6sF2BfQjPHjFqeiMejf3}Zcn%rHrL>=DYpeJ zU~*ejHZhvhv)|+v;^8_VQ*KQ=Ol}u7ZgOkdVQO1R?qG@IP!S~wqL%I&anQ(apaTGG&elUvgQliL}sU_2LN%I#8&DYwhY zCbz3CEO@Wr3^7i%&2GT@(_wO3&;lm61Ii}1#TZj=hm}okM`BF59aT2DEyb8>I~JQoSn_fIz<>ku2(vB~eKHpnUUF=PDnK8Zmxu_GtH zwY8}yZwKqtyMDvx!Ki5@$4~Ezzd|9kuy}0@Q&+;pweeJG~{9^srRet&X zZ*saG^6T{9xy>n6XZ|LY~c)29Fb6ZzG%o&Unci;v*rxS^tuc%~`k zHZ!Ex9jn5LDjqZMWAr+`Y@51v1y z3LNo{=9R4@D%(5k=)d%XJ7LE+Q_;8gyn8nDvFqEtBhg!Df9zGF3r~mMbkzGy=%u0y yxDG_UAw3tu&|f+gy{Gz9?}g~E)kEHJ)cd7-z1N~Aa77r`f#@w<=cC>)@A@}t8RTIA delta 6800 zcmc(j4``fs8ONXZz3cUIxumzWwAt+Jl~!}bHoay^m$=g0Y&%ovG!+Ly(WV_KS4p?S z&6;ZUy^SCd2S(otLBVBAwoFEeL`G)Sr7V<+IwMSpnBfV7g+VpoA5s~^@Ar4lb9p@& z2ukxK@B4c`&+qyDf8XEty-be!3#0yc&Kv*Hp3Uw4UClFx+t2!UzA7#y-;eCN+B=Z{ zGW=QoVeb#&&I6Bne-6KO;LF}$!lsV*1^+}@LL^>5p7BK5kuz`)eHgZn zJd5i%?ET0KxK6-6fV_y&cgn@ z+6CB`VD}&|;~GA@x{Sfv?kY{mSQGWsUjQR&*&%#FAanzSrVBe3N=~dWB$!6SsQ5SQ>6^SfV zW5SuvI~r_9{uutcbDJYB&)>tFo!e4Y*47j@cWtc|{wCblwW}r09z>c?;D&)nx;Z@4 z^}wAia0557>_Og;ns7ZGUhA4~ID2k*=#kUshdO4)4*u9*!?3q!N5cchPaON${SO}N z2v7IyUn`pld%m7%uhra}y>NPX-{A;9cJ50mA>V``=P)<;TE{={5c+xPakX{o~-b!UIP)2W<5&5YrXdKVitANLCq{OF7)% zMOg+<)y9(V_LzJKoPOMwek~_&0uO-M-p9d-l1Nd@zd(L5CL>i2kX2I|854&`6}}5n0|kRW8eWWCv+2edMPG@5l(q`C(yk*Ll*$B6Q=ak>sfcd8n z#pQ-NnjtKi?zk)}e+ZoFj7vrN5V mlfqR;7#+GfbuuM4GVbEuri#$_gVfcU$97y zXITEaFB#?Q0Ue8&p*r3Gw=DURjc@}vr))FC7+r(^K)he^rBAsHXY`IFUaz|NvhqC2 zx29t$lTQ{X}6D=Z(4Nio7Ha7lTd?Tz6Xh;Ra2R(>7jo1cow7&zdJ=t#pct^qf}TgPKE z5#deXN#!Oejei-8rDgq3kSDMO$jRR&_v5Wno+Ez}ZxM1kxO^N`P^>_<>MPHJOryv{ z{a)=vBlm!LqFMRf;JmU{btf7-wgapm1!OzG1|v*yDuUVGg+}au;)a+SiK)|=RzT*` zIPPrF#A!;|#A#O9#EC}$JNOlmEV z_)nvO1kUBCn6UAJmb(#yk&Lcjx+mk^pCvV#g{Vhfuf`C$l5#Y9l1Nb&7q;c?< zwVb>W%&lShv*7q%Pq-E2zk>JVJ(-K}e(-{FRpzn(i|W7|paM#@L|gJQktG z)Oiypw_>X?!KB?*xD^8zl+mn9eah}(4NAWIu@QY*OB!HuJEClIJ66}=tg^}Nva-qT ziZbNZsjc8)WPePUKTb1snA~QSO>XnbCbtD;9io7`6Fcv;!xHmOIm$!)fda}lQ6 z_9+J@w?%aro0yo~niiPcPHVjJY=kMdixH;WR+MY%TIHZ7zk-$E9x{M(n^88o%`2PS zb}O6Q79vc!?Nc_n?T;|kcEB89hccS4y8&Ed+Z zt2@&nw|HY*2kuM<{$xmSA(SOac6AoK?*D;i) zRm)w+;GFXRNq!|LYJ=3{+b_S^|3w|Zy2x)SSYP>d`n!(uD*=D)uAls3{_85g8}a_F zr~D4{`Vc{lPoe*ZB|s^eW{ zegQM!K0F^x{6Hlal}q4W@b8spl@s_zVB+sRb~LE<=Cs`@W$PzcQHOPuN3Cc_Bj9L9 zbIR5cmF>Uj=so(`Rh!X!cN9Le?}IZ-pIX}KJs!S%=@oA(y!e&CTMTdE-W^{2YTy;a vTevTV7lXi0o(caIT=#w+UMt`0jfA(#z20)z^F%L;aW951XTgx-B4fcV9l+rg;g%H6GE}-Io<`aXdFhN z|HItvT*}zyaNG}rc4AR|om;sF;xtyUy%+igNJ*xyh~5hOb}^dnfvJ8=pWP6seCOusY^9WnzeVt75roOLnwS)`@mwY2gO9LQ(h+fw9M+w5wW zox>0F2csU|xscQGRau*?eWTA0j})rw+KnQ+Bii9NvPWX}LgHwOZCjm9wSjS@LEaTr z1l&h7R4uXWpCP)<{+RebqSdH}+Y!WnC%Vt^e0RUm(-3)C<}{HX7<$Ni!iH-SaFo0x z^N3?;Ze+wiKwfVICR|#u{vLV#9G??@MBXWW6jQ=4$(sP{tfIq@diGHAB6BS0mzxdrS^Ls%t!9XX}7SZ9Oec)HZF=6rRH13}R z^l=xUhg^Uj70#~UobZ(RS@H(U3DFH^G$R;%dg=zB6UJc!&N#-`j+&;zrM25as@;xl Lys0`KHq)V~%b{om z58^A5QxPeegNI-hi-<;BL@IS=hEi{?yVH8Wt@J5(Fw!siW zKJX?JQbD&h5O)@VVu&<1n2{YYM=>G*e?RmYSeZ;^L`UGiBsu{-2pvbyLf;TwgdTz3 z0t=%?@#%t1pg(|K44cK&>Zw}_#MN_mE)aD(P#8bLQf(yDHgq(b?GE$^^iEjj1oR$Q z_NSoxFpw+p6bE3pqodh}<=}8ac5+@$ujCvvIqv;nTho*rCD*}xcF8RV`__EGIq~e= zb{RvBh<@=4AUx{!*1ry%I-5yfIDS6e`M6=N?XC+&oi?OY$8Lt^i(ubsGgNH=qgsXw zV<8?NBpO&Cxg4J)y2kMqiGRXr^VLO!e-aIGK40HI9BU(4x0zE!j_24-)(AUrpC0cc zYb)~=!%(JWC7vWJ5riuze3PuboSzrIOV)mV7ZbwI$QlFd>H@x!m0tqxA;%PC2QFPF zFaSH!n&=S<=zd`&=ke$?cJ9U7iN=_d!gxscI6ozPgs9L8<_+(xn1hYg_OJR#OTn~O{*hcXZj$D_8vA{BqpB6qx^f3&s)G#mD znGwe=qG?X}UBjI4SNI{(53JY@31h*t{BD@}yy9P|+SdcoED&^qag11c%Ok-*0Djo45O3C0>c= zgU!b0LTB>@)xAWuaBqZ^#BYMW)DK)|jrY3hx?+6N7v0x~*6pgd4{F$+N7awvCmSM% zANm)$3(4Wo-JY1`LHkZn8x()71MnwcJZMP6kHceiEzXONfG&wo!B4@*pjqUM_!9g* z_(3RdoI?)5rl7OP4*0Brt)J>Qo|v(qtDbFEp9B9@ergOR!HW@t@Oz;VWL)M`@JX4^ zz>mOVUk8NJ81_IpMtOqB?Zq(mUr(}DB06RF=tpL_{e|tl`%uGv^h&=q4@Ot)l|Eju zp9e%6a?S2`G3RumWx46h)O5kw+Uqb#@9;;BkUr)QSRw4Rg?kWD_&Cyg8NW*S5ZF0M z#COE?C9dBf>Jokj_GRq@;QAM&^EMIR)-QM$uE?2Flo3uaKU6efvqcAZBB^Lv8X&dE zV&o0RP&dBQ`e^k+&@O`j4u4qyC8S}iNfhK$X2XHX2Xt;qpz$tLlu!#Pk!JNm{ z)F$wBP!D!LDja5hLUdBNA8O7LWrUAFH{^*X8aN2PD|{2G7KrAAi_rEWQJ&et6Mlqo zmWURm;TyDb86Q>yw}4*@^NZwLAzBpB&tflctb@Exv~@%e!*zB8UM zG4Wd(9)s0a+&Pr%MX2$^eh2t{X(2oK8{Q1&@FRC4p9^;h*Xw**Tt5uun6!DEuE|7B z8tTl)#S8dUI9QqM8}ex|^JmFX1`k6|3-i-5XZ1*6YatVexQt#s({t6>uB$!Y{{j4O Bj|Bh# delta 1258 zcmZ9LUr1AN6vxl~?f;!_Qzz-rlB|rfwzQ$ERwDu>A}k1e2wK!i$;zH84DJHy5A+aR z3!kh9sXg>CvPdFq=!hZ%i2{qD1wjT9Jw>CJzGwG{!-MDd{eI3lzu)eDcNRJd9oe8m zTbQVIoL2QSR0{WM$Sd({pl{7Pt`piPv*-Lh;IU25TAe_f)7K}$m`;B@FVc; zP(FAJ8HG(iA0VsY(;AL`YQFJ=wdZEh(_%#I_*8k+C`^nuBVzD7p-srR)D!S~rJjWE zg2%ab2pz<-1Ilrj3q)=omfjUJyGkvhW7dp$Pj9TsTizE(59iUW`A+Xz|K8f^=MB4g zK~y3?ThlJ)F*D}PdrtKaq|O~bn`(PpvB7R`46HL6aSWftu?@*Df@^EJfY=NlNBRcv zn8H0^=b$yq{Tc3GA*z%9N3cI_-3a%8BAvrT{QCaESK^&HZ!1a?8KuG=E{rJZlY#xr z+ZA0BhLj?Wl@I7eUr#6+6~4*y`xIq_?}F6nRy%!BHRwu?-M13k3bu;_<@#j5PU;;7^&ojIaO;YDa|o+wwwUhr#S-Ht1tC7Kg%20Q17=7rCISA8HVl(7yr7Nl^C2j+=> zm$451EBp|B^&RgV$~QC()fSh3FJ7{O|EXKh=LjI%kS~SngqQlbEu%DW2p_^R2;~iF z;n5YG5uTDh-ww|&9mu!A?8L)y@VD=TriA&+GG7xWGB4Xh6DMmLTw1GnHFObcG4$g< DhPjb6 diff --git a/internal/ebpf/spike/c/vmlinux.h b/internal/ebpf/spike/c/vmlinux.h index da94af6b5..c5a3f8ae2 100644 --- a/internal/ebpf/spike/c/vmlinux.h +++ b/internal/ebpf/spike/c/vmlinux.h @@ -73,6 +73,16 @@ enum bpf_map_type { #define TASK_COMM_LEN 16 #endif +/* x86-64 field names from kernel BTF. CO-RE relocates by name. */ +struct pt_regs { + unsigned long r10; + unsigned long r8; + unsigned long dx; + unsigned long si; + unsigned long di; + unsigned long orig_ax; +} __attribute__((preserve_access_index)); + struct seq_file; struct bpf_iter_meta {