From 992cd2180f34f8f37e5583cdfe9fabb7e259a77a Mon Sep 17 00:00:00 2001
From: shangfan <45649554+sf1999817@users.noreply.github.com>
Date: Thu, 16 May 2024 03:50:59 +0000
Subject: [PATCH] youhua

---
 .../Filesystem_Subsystem/fs_watcher/write.bpf.c            | 6 +-----
 eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.c   | 7 +++----
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.bpf.c b/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.bpf.c
index afd1ad244..74be2bedf 100644
--- a/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.bpf.c
+++ b/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.bpf.c
@@ -24,13 +24,8 @@ int BPF_KRETPROBE(do_sys_openat2_exit,long fd)
   pid_t pid;
  
   pid = bpf_get_current_pid_tgid() >> 32;
-  
-  e = bpf_ringbuf_reserve(&rb,sizeof(*e),0);
-  if(!e)
-    return 0;
 
   bpf_map_update_elem(&data,&pid,&fd,BPF_ANY);
-  bpf_ringbuf_submit(e,0);
 }
 
 SEC("kprobe/vfs_write")
@@ -54,5 +49,6 @@ int BPF_KPROBE(vfs_write)
     e->pid = pid;
   } 
   bpf_ringbuf_submit(e,0);
+ 
   return 0;
 }
diff --git a/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.c b/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.c
index cfda09d1a..92c971ecf 100644
--- a/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.c
+++ b/eBPF_Supermarket/Filesystem_Subsystem/fs_watcher/write.c
@@ -28,7 +28,7 @@ static int write_event(void *ctx, void *data, size_t data_sz)
     time(&t);
     tm = localtime(&t);
     strftime(ts, sizeof(ts), "%H:%M:%S", tm);
-	  printf("%-8s  %-7ld %-7ld\n", ts, e->pid,e->fd);
+	printf("%-8s  %-7ld %-7ld\n", ts, e->pid,e->fd);
     return 0;
 }
 
@@ -36,8 +36,8 @@ int main(int argc, char **argv)
 {
     struct ring_buffer *rb = NULL;
     struct write_bpf *skel;
-	  int err;
-   
+	int err;
+
     /* Set up libbpf errors and debug info callback */
 	libbpf_set_print(libbpf_print_fn);
 
@@ -95,6 +95,5 @@ int main(int argc, char **argv)
 	/* Clean up */
 	ring_buffer__free(rb);
 	write_bpf__destroy(skel);
-
 	return err < 0 ? -err : 0;
 }
\ No newline at end of file