tracex5_user.c 2.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101
  1. // SPDX-License-Identifier: GPL-2.0
  2. #include <stdio.h>
  3. #include <stdlib.h>
  4. #include <unistd.h>
  5. #include <linux/filter.h>
  6. #include <linux/seccomp.h>
  7. #include <sys/prctl.h>
  8. #include <bpf/bpf.h>
  9. #include <bpf/libbpf.h>
  10. #include <sys/resource.h>
  11. #include "trace_helpers.h"
  12. #ifdef __mips__
  13. #define MAX_ENTRIES 6000 /* MIPS n64 syscalls start at 5000 */
  14. #else
  15. #define MAX_ENTRIES 1024
  16. #endif
  17. /* install fake seccomp program to enable seccomp code path inside the kernel,
  18. * so that our kprobe attached to seccomp_phase1() can be triggered
  19. */
  20. static void install_accept_all_seccomp(void)
  21. {
  22. struct sock_filter filter[] = {
  23. BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
  24. };
  25. struct sock_fprog prog = {
  26. .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])),
  27. .filter = filter,
  28. };
  29. if (prctl(PR_SET_SECCOMP, 2, &prog))
  30. perror("prctl");
  31. }
  32. int main(int ac, char **argv)
  33. {
  34. struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
  35. struct bpf_link *link = NULL;
  36. struct bpf_program *prog;
  37. struct bpf_object *obj;
  38. int key, fd, progs_fd;
  39. const char *section;
  40. char filename[256];
  41. FILE *f;
  42. setrlimit(RLIMIT_MEMLOCK, &r);
  43. snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
  44. obj = bpf_object__open_file(filename, NULL);
  45. if (libbpf_get_error(obj)) {
  46. fprintf(stderr, "ERROR: opening BPF object file failed\n");
  47. return 0;
  48. }
  49. prog = bpf_object__find_program_by_name(obj, "bpf_prog1");
  50. if (!prog) {
  51. printf("finding a prog in obj file failed\n");
  52. goto cleanup;
  53. }
  54. /* load BPF program */
  55. if (bpf_object__load(obj)) {
  56. fprintf(stderr, "ERROR: loading BPF object file failed\n");
  57. goto cleanup;
  58. }
  59. link = bpf_program__attach(prog);
  60. if (libbpf_get_error(link)) {
  61. fprintf(stderr, "ERROR: bpf_program__attach failed\n");
  62. link = NULL;
  63. goto cleanup;
  64. }
  65. progs_fd = bpf_object__find_map_fd_by_name(obj, "progs");
  66. if (progs_fd < 0) {
  67. fprintf(stderr, "ERROR: finding a map in obj file failed\n");
  68. goto cleanup;
  69. }
  70. bpf_object__for_each_program(prog, obj) {
  71. section = bpf_program__section_name(prog);
  72. /* register only syscalls to PROG_ARRAY */
  73. if (sscanf(section, "kprobe/%d", &key) != 1)
  74. continue;
  75. fd = bpf_program__fd(prog);
  76. bpf_map_update_elem(progs_fd, &key, &fd, BPF_ANY);
  77. }
  78. install_accept_all_seccomp();
  79. f = popen("dd if=/dev/zero of=/dev/null count=5", "r");
  80. (void) f;
  81. read_trace_pipe();
  82. cleanup:
  83. bpf_link__destroy(link);
  84. bpf_object__close(obj);
  85. return 0;
  86. }