[Modify Feature] [2024-12-6] 补充signal中非自定义handler的信息获取

Linux_Lifecycle/bpf_src/syscall_trace.bpf.c

@@ -396,3 +396,30 @@ int BPF_KRETPROBE(trace_handle_signal_exit)
     bpf_printk("entry signal pid: %d  delta: %lld\n", sig, delta);
     return 0;
 }
+
+
+
+SEC("tp_btf/signal_deliver")
+int BPF_PROG(signal_deliver_btf, int signr, kernel_siginfo_t* info, struct k_sigaction *ka)
+{
+    struct sc_ctrl *syscall_ctrl;
+	syscall_ctrl = bpf_map_lookup_elem(&sc_ctrl_map, &key);
+	if(!syscall_ctrl || !syscall_ctrl->sc_func)
+		return 0;
+    pid_t pid = bpf_get_current_pid_tgid();
+    int target_pid = syscall_ctrl->target_pid;
+    bpf_printk("deliver sig: %d\n", signr);
+    if(pid != target_pid)
+        return 0;
+    u64 current_timestamp = bpf_ktime_get_ns();
+    struct signal_val_t *val;
+    val = bpf_ringbuf_reserve(&syscall_rb, sizeof(*val), 0);
+    if(!val) {
+        return 0;
+    }
+    val->timestamp = current_timestamp;
+    val->sig = signr;
+
+    bpf_ringbuf_submit(val, 0);
+    return 0;
+}
\ No newline at end of file