microsoft / microsoft/ebpf-for-windows
Add an API interface to access the ImagePath of the process triggering a hook
Open
enhancement
P2
triaged
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the feature you'd like supported
Allow for an ebpf program to access the full path of the process triggering the hook, similar to [bpf_get_current_comm](https://docs.ebpf.io/linux/helper-function/bpf_get_current_comm/) which only gives the process name without the full path.
### Proposed solution
This is useful to make decisions based on the process name directly on the ebpf program, without relying on process ids which can be dynamic, or depend on user-space logic.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.