diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 2cdd277306..4fdfcfae90 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -2839,7 +2839,6 @@ FILLER(execve_extra_tail_1, true) /* Parameter 25: exe_file ctime (last status change time, epoch value in nanoseconds) (type: PT_ABSTIME) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0) time = _READ(inode->__i_ctime); - time.tv_nsec = time.tv_nsec & ~I_CTIME_QUERIED; // See https://elixir.bootlin.com/linux/v6.6-rc1/source/include/linux/fs.h#L1544 #else time = _READ(inode->i_ctime); #endif @@ -6695,7 +6694,6 @@ FILLER(sched_prog_exec_4, false) /* Parameter 25: exe_file ctime (last status change time, epoch value in nanoseconds) (type: PT_ABSTIME) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0) time = _READ(inode->__i_ctime); - time.tv_nsec = time.tv_nsec & ~I_CTIME_QUERIED; // See https://elixir.bootlin.com/linux/v6.6-rc1/source/include/linux/fs.h#L1544 #else time = _READ(inode->i_ctime); #endif diff --git a/driver/modern_bpf/definitions/missing_definitions.h b/driver/modern_bpf/definitions/missing_definitions.h index 9d29bccec0..420d6ace3d 100644 --- a/driver/modern_bpf/definitions/missing_definitions.h +++ b/driver/modern_bpf/definitions/missing_definitions.h @@ -585,13 +585,6 @@ #define FMODE_CREATED (/*(__force fmode_t) */0x100000) -////////////////////////// -// ctime flags -////////////////////////// - -/* `include/linux/fs.h` from kernel source tree. */ -#define I_CTIME_QUERIED (1L<<30) - ////////////////////////// // flock flags ////////////////////////// diff --git a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c index 85df87ab00..0bcbf5dbe3 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c @@ -222,7 +222,6 @@ int BPF_PROG(t1_sched_p_exec, { struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode; BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime); - time.tv_nsec = time.tv_nsec & ~I_CTIME_QUERIED; } auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time)); diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c index b6099600a5..f7070e9c70 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c @@ -286,7 +286,6 @@ int BPF_PROG(t1_execve_x, { struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode; BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime); - time.tv_nsec = time.tv_nsec & ~I_CTIME_QUERIED; } auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time)); diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c index b4a52bd1e9..f65a4cbd75 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c @@ -302,7 +302,6 @@ int BPF_PROG(t1_execveat_x, { struct inode___v6_6 *exe_inode_v6_6 = (void *)exe_inode; BPF_CORE_READ_INTO(&time, exe_inode_v6_6, __i_ctime); - time.tv_nsec = time.tv_nsec & ~I_CTIME_QUERIED; } auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));