Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 | // SPDX-License-Identifier: GPL-2.0 /* * Copyright 2020 Google LLC. */ #include <errno.h> #include <linux/bpf.h> #include <stdbool.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> char _license[] SEC("license") = "GPL"; #define DUMMY_STORAGE_VALUE 0xdeadbeef int monitored_pid = 0; int inode_storage_result = -1; int sk_storage_result = -1; struct dummy_storage { __u32 value; }; struct { __uint(type, BPF_MAP_TYPE_INODE_STORAGE); __uint(map_flags, BPF_F_NO_PREALLOC); __type(key, int); __type(value, struct dummy_storage); } inode_storage_map SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_SK_STORAGE); __uint(map_flags, BPF_F_NO_PREALLOC | BPF_F_CLONE); __type(key, int); __type(value, struct dummy_storage); } sk_storage_map SEC(".maps"); /* TODO Use vmlinux.h once BTF pruning for embedded types is fixed. */ struct sock {} __attribute__((preserve_access_index)); struct sockaddr {} __attribute__((preserve_access_index)); struct socket { struct sock *sk; } __attribute__((preserve_access_index)); struct inode {} __attribute__((preserve_access_index)); struct dentry { struct inode *d_inode; } __attribute__((preserve_access_index)); struct file { struct inode *f_inode; } __attribute__((preserve_access_index)); SEC("lsm/inode_unlink") int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim) { __u32 pid = bpf_get_current_pid_tgid() >> 32; struct dummy_storage *storage; int err; if (pid != monitored_pid) return 0; storage = bpf_inode_storage_get(&inode_storage_map, victim->d_inode, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); if (!storage) return 0; if (storage->value != DUMMY_STORAGE_VALUE) inode_storage_result = -1; err = bpf_inode_storage_delete(&inode_storage_map, victim->d_inode); if (!err) inode_storage_result = err; return 0; } SEC("lsm/socket_bind") int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address, int addrlen) { __u32 pid = bpf_get_current_pid_tgid() >> 32; struct dummy_storage *storage; int err; if (pid != monitored_pid) return 0; storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); if (!storage) return 0; if (storage->value != DUMMY_STORAGE_VALUE) sk_storage_result = -1; err = bpf_sk_storage_delete(&sk_storage_map, sock->sk); if (!err) sk_storage_result = err; return 0; } SEC("lsm/socket_post_create") int BPF_PROG(socket_post_create, struct socket *sock, int family, int type, int protocol, int kern) { __u32 pid = bpf_get_current_pid_tgid() >> 32; struct dummy_storage *storage; if (pid != monitored_pid) return 0; storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); if (!storage) return 0; storage->value = DUMMY_STORAGE_VALUE; return 0; } SEC("lsm/file_open") int BPF_PROG(file_open, struct file *file) { __u32 pid = bpf_get_current_pid_tgid() >> 32; struct dummy_storage *storage; if (pid != monitored_pid) return 0; if (!file->f_inode) return 0; storage = bpf_inode_storage_get(&inode_storage_map, file->f_inode, 0, BPF_LOCAL_STORAGE_GET_F_CREATE); if (!storage) return 0; storage->value = DUMMY_STORAGE_VALUE; return 0; } |