gistfile1.txt

from bcc import BPF

# eBPF program
prog = """
#include <uapi/linux/ptrace.h>

// Instrument the fchdir syscall entry
TRACEPOINT_PROBE(syscalls, sys_enter_fchdir) {
    // args is a built-in structure provided by the tracepoint
    // It contains all the arguments of the syscall being traced
    int fd = args->fd;

    // Log the file descriptor
    bpf_trace_printk("fchdir called with fd %d\\n", fd);
    return 0;
}
"""

# Load eBPF program
b = BPF(text=prog)

# Print the output of bpf_trace_printk
print("Tracing fchdir syscalls... Hit Ctrl-C to end.")
while True:
    try:
        (task, pid, cpu, flags, ts, msg) = b.trace_fields()
        print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg))
    except KeyboardInterrupt:
        exit()