diff --git a/GPL/Events/Helpers.h b/GPL/Events/Helpers.h index 3844f06e..f9277f14 100644 --- a/GPL/Events/Helpers.h +++ b/GPL/Events/Helpers.h @@ -230,11 +230,21 @@ static void ebpf_ctty__fill(struct ebpf_tty_dev *ctty, const struct task_struct static void ebpf_pid_info__fill(struct ebpf_pid_info *pi, const struct task_struct *task) { - pi->tid = BPF_CORE_READ(task, pid); - pi->tgid = BPF_CORE_READ(task, tgid); - pi->ppid = BPF_CORE_READ(task, group_leader, real_parent, tgid); - pi->pgid = BPF_CORE_READ(task, group_leader, signal, pids[PIDTYPE_PGID], numbers[0].nr); - pi->sid = BPF_CORE_READ(task, group_leader, signal, pids[PIDTYPE_SID], numbers[0].nr); + int e_pgid, e_sid; + + if (bpf_core_enum_value_exists(enum pid_type, PIDTYPE_PGID)) + e_pgid = bpf_core_enum_value(enum pid_type, PIDTYPE_PGID); + else + e_pgid = PIDTYPE_PGID; + if (bpf_core_enum_value_exists(enum pid_type, PIDTYPE_SID)) + e_sid = bpf_core_enum_value(enum pid_type, PIDTYPE_SID); + else + e_sid = PIDTYPE_SID; + pi->tid = BPF_CORE_READ(task, pid); + pi->tgid = BPF_CORE_READ(task, tgid); + pi->ppid = BPF_CORE_READ(task, group_leader, real_parent, tgid); + pi->pgid = BPF_CORE_READ(task, group_leader, signal, pids[e_pgid], numbers[0].nr); + pi->sid = BPF_CORE_READ(task, group_leader, signal, pids[e_sid], numbers[0].nr); pi->start_time_ns = BPF_CORE_READ(task, group_leader, start_time); }