tracex5_kern.c 2.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293
  1. /* Copyright (c) 2015 PLUMgrid, http://plumgrid.com
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. */
  7. #include <linux/ptrace.h>
  8. #include <linux/version.h>
  9. #include <uapi/linux/bpf.h>
  10. #include <uapi/linux/seccomp.h>
  11. #include <uapi/linux/unistd.h>
  12. #include "syscall_nrs.h"
  13. #include <bpf/bpf_helpers.h>
  14. #include <bpf/bpf_tracing.h>
  15. #define PROG(F) SEC("kprobe/"__stringify(F)) int bpf_func_##F
  16. struct {
  17. __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
  18. __uint(key_size, sizeof(u32));
  19. __uint(value_size, sizeof(u32));
  20. #ifdef __mips__
  21. __uint(max_entries, 6000); /* MIPS n64 syscalls start at 5000 */
  22. #else
  23. __uint(max_entries, 1024);
  24. #endif
  25. } progs SEC(".maps");
  26. SEC("kprobe/__seccomp_filter")
  27. int bpf_prog1(struct pt_regs *ctx)
  28. {
  29. int sc_nr = (int)PT_REGS_PARM1(ctx);
  30. /* dispatch into next BPF program depending on syscall number */
  31. bpf_tail_call(ctx, &progs, sc_nr);
  32. /* fall through -> unknown syscall */
  33. if (sc_nr >= __NR_getuid && sc_nr <= __NR_getsid) {
  34. char fmt[] = "syscall=%d (one of get/set uid/pid/gid)\n";
  35. bpf_trace_printk(fmt, sizeof(fmt), sc_nr);
  36. }
  37. return 0;
  38. }
  39. /* we jump here when syscall number == __NR_write */
  40. PROG(SYS__NR_write)(struct pt_regs *ctx)
  41. {
  42. struct seccomp_data sd;
  43. bpf_probe_read_kernel(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx));
  44. if (sd.args[2] == 512) {
  45. char fmt[] = "write(fd=%d, buf=%p, size=%d)\n";
  46. bpf_trace_printk(fmt, sizeof(fmt),
  47. sd.args[0], sd.args[1], sd.args[2]);
  48. }
  49. return 0;
  50. }
  51. PROG(SYS__NR_read)(struct pt_regs *ctx)
  52. {
  53. struct seccomp_data sd;
  54. bpf_probe_read_kernel(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx));
  55. if (sd.args[2] > 128 && sd.args[2] <= 1024) {
  56. char fmt[] = "read(fd=%d, buf=%p, size=%d)\n";
  57. bpf_trace_printk(fmt, sizeof(fmt),
  58. sd.args[0], sd.args[1], sd.args[2]);
  59. }
  60. return 0;
  61. }
  62. #ifdef __NR_mmap2
  63. PROG(SYS__NR_mmap2)(struct pt_regs *ctx)
  64. {
  65. char fmt[] = "mmap2\n";
  66. bpf_trace_printk(fmt, sizeof(fmt));
  67. return 0;
  68. }
  69. #endif
  70. #ifdef __NR_mmap
  71. PROG(SYS__NR_mmap)(struct pt_regs *ctx)
  72. {
  73. char fmt[] = "mmap\n";
  74. bpf_trace_printk(fmt, sizeof(fmt));
  75. return 0;
  76. }
  77. #endif
  78. char _license[] SEC("license") = "GPL";
  79. u32 _version SEC("version") = LINUX_VERSION_CODE;