02413cabd6
Remove the zero initialization in the sample programs where appropriate. Note that this is an optimization which is now possible, old programs still doing the zero initialization are just fine as well. Also, make sure we don't have padding issues when we don't memset() the entire struct anymore. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
76 lines
1.9 KiB
C
76 lines
1.9 KiB
C
/* Copyright (c) 2015 PLUMgrid, http://plumgrid.com
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of version 2 of the GNU General Public
|
|
* License as published by the Free Software Foundation.
|
|
*/
|
|
#include <linux/ptrace.h>
|
|
#include <linux/version.h>
|
|
#include <uapi/linux/bpf.h>
|
|
#include <uapi/linux/seccomp.h>
|
|
#include "bpf_helpers.h"
|
|
|
|
#define PROG(F) SEC("kprobe/"__stringify(F)) int bpf_func_##F
|
|
|
|
struct bpf_map_def SEC("maps") progs = {
|
|
.type = BPF_MAP_TYPE_PROG_ARRAY,
|
|
.key_size = sizeof(u32),
|
|
.value_size = sizeof(u32),
|
|
.max_entries = 1024,
|
|
};
|
|
|
|
SEC("kprobe/seccomp_phase1")
|
|
int bpf_prog1(struct pt_regs *ctx)
|
|
{
|
|
struct seccomp_data sd;
|
|
|
|
bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
|
|
/* dispatch into next BPF program depending on syscall number */
|
|
bpf_tail_call(ctx, &progs, sd.nr);
|
|
|
|
/* fall through -> unknown syscall */
|
|
if (sd.nr >= __NR_getuid && sd.nr <= __NR_getsid) {
|
|
char fmt[] = "syscall=%d (one of get/set uid/pid/gid)\n";
|
|
bpf_trace_printk(fmt, sizeof(fmt), sd.nr);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/* we jump here when syscall number == __NR_write */
|
|
PROG(__NR_write)(struct pt_regs *ctx)
|
|
{
|
|
struct seccomp_data sd;
|
|
|
|
bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
if (sd.args[2] == 512) {
|
|
char fmt[] = "write(fd=%d, buf=%p, size=%d)\n";
|
|
bpf_trace_printk(fmt, sizeof(fmt),
|
|
sd.args[0], sd.args[1], sd.args[2]);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
PROG(__NR_read)(struct pt_regs *ctx)
|
|
{
|
|
struct seccomp_data sd;
|
|
|
|
bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx));
|
|
if (sd.args[2] > 128 && sd.args[2] <= 1024) {
|
|
char fmt[] = "read(fd=%d, buf=%p, size=%d)\n";
|
|
bpf_trace_printk(fmt, sizeof(fmt),
|
|
sd.args[0], sd.args[1], sd.args[2]);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
PROG(__NR_mmap)(struct pt_regs *ctx)
|
|
{
|
|
char fmt[] = "mmap\n";
|
|
bpf_trace_printk(fmt, sizeof(fmt));
|
|
return 0;
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|
|
u32 _version SEC("version") = LINUX_VERSION_CODE;
|