#include "vmlinux.h"
+#include <errno.h>
#include <bpf/bpf_helpers.h>
#include "sysctl-write-event.h"
return 1;
r = bpf_get_current_comm(we.comm, sizeof(we.comm));
- if (r < 0) {
+ if (r < 0 && r != -EINVAL) { /* -EINVAL: the process is already vanished */
we.errorcode = r;
goto send_event;
}
log_struct(LOG_WARNING,
LOG_MESSAGE_ID(SD_MESSAGE_SYSCTL_CHANGED_STR),
LOG_ITEM("OBJECT_PID=" PID_FMT, we->pid),
- LOG_ITEM("OBJECT_COMM=%s", we->comm),
+ LOG_ITEM("OBJECT_COMM=%s", empty_to_na(we->comm)),
LOG_ITEM("SYSCTL=%s", path),
LOG_ITEM("OLDVALUE=%s", we->current),
LOG_ITEM("NEWVALUE=%s", we->newvalue),
LOG_ITEM("OURVALUE=%s", value),
LOG_MESSAGE("Foreign process '%s[" PID_FMT "]' changed sysctl '%s' from '%s' to '%s', conflicting with our setting to '%s'.",
- we->comm, we->pid, path, we->current, we->newvalue, value));
+ empty_to_na(we->comm), we->pid, path, we->current, we->newvalue, value));
return 0;
}