1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */
3
4 #include "vmlinux.h"
5 #include <bpf/bpf_helpers.h>
6
7 char _license[] SEC("license") = "GPL";
8
9 struct {
10 __uint(type, BPF_MAP_TYPE_HASH);
11 __uint(max_entries, 1);
12 __type(key, int);
13 __type(value, int);
14 } hash_map SEC(".maps");
15
16 struct {
17 __uint(type, BPF_MAP_TYPE_STACK);
18 __uint(max_entries, 1);
19 __type(value, int);
20 } stack_map SEC(".maps");
21
22 struct {
23 __uint(type, BPF_MAP_TYPE_ARRAY);
24 __uint(max_entries, 1);
25 __type(key, int);
26 __type(value, int);
27 } array_map SEC(".maps");
28
29 const volatile pid_t pid;
30 long err = 0;
31
32 static u64 callback(u64 map, u64 key, u64 val, u64 ctx, u64 flags)
33 {
34 return 0;
35 }
36
37 SEC("tp/syscalls/sys_enter_getpid")
38 int map_update(void *ctx)
39 {
40 const int key = 0;
41 const int val = 1;
42
43 if (pid != (bpf_get_current_pid_tgid() >> 32))
44 return 0;
45
46 err = bpf_map_update_elem(&hash_map, &key, &val, BPF_NOEXIST);
47
48 return 0;
49 }
50
51 SEC("tp/syscalls/sys_enter_getppid")
52 int map_delete(void *ctx)
53 {
54 const int key = 0;
55
56 if (pid != (bpf_get_current_pid_tgid() >> 32))
57 return 0;
58
59 err = bpf_map_delete_elem(&hash_map, &key);
60
61 return 0;
62 }
63
64 SEC("tp/syscalls/sys_enter_getuid")
65 int map_push(void *ctx)
66 {
67 const int val = 1;
68
69 if (pid != (bpf_get_current_pid_tgid() >> 32))
70 return 0;
71
72 err = bpf_map_push_elem(&stack_map, &val, 0);
73
74 return 0;
75 }
76
77 SEC("tp/syscalls/sys_enter_geteuid")
78 int map_pop(void *ctx)
79 {
80 int val;
81
82 if (pid != (bpf_get_current_pid_tgid() >> 32))
83 return 0;
84
85 err = bpf_map_pop_elem(&stack_map, &val);
86
87 return 0;
88 }
89
90 SEC("tp/syscalls/sys_enter_getgid")
91 int map_peek(void *ctx)
92 {
93 int val;
94
95 if (pid != (bpf_get_current_pid_tgid() >> 32))
96 return 0;
97
98 err = bpf_map_peek_elem(&stack_map, &val);
99
100 return 0;
101 }
102
103 SEC("tp/syscalls/sys_enter_gettid")
104 int map_for_each_pass(void *ctx)
105 {
106 const int key = 0;
107 const int val = 1;
108 const u64 flags = 0;
109 int callback_ctx;
110
111 if (pid != (bpf_get_current_pid_tgid() >> 32))
112 return 0;
113
114 bpf_map_update_elem(&array_map, &key, &val, flags);
115
116 err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags);
117
118 return 0;
119 }
120
121 SEC("tp/syscalls/sys_enter_getpgid")
122 int map_for_each_fail(void *ctx)
123 {
124 const int key = 0;
125 const int val = 1;
126 const u64 flags = BPF_NOEXIST;
127 int callback_ctx;
128
129 if (pid != (bpf_get_current_pid_tgid() >> 32))
130 return 0;
131
132 bpf_map_update_elem(&array_map, &key, &val, flags);
133
134 /* calling for_each with non-zero flags will return error */
135 err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags);
136
137 return 0;
138 }
139
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.