| // SPDX-License-Identifier: GPL-2.0 |
| /* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */ |
| |
| #include "vmlinux.h" |
| #include <bpf/bpf_helpers.h> |
| |
| char _license[] SEC("license") = "GPL"; |
| |
| struct { |
| __uint(type, BPF_MAP_TYPE_HASH); |
| __uint(max_entries, 1); |
| __type(key, int); |
| __type(value, int); |
| } hash_map SEC(".maps"); |
| |
| struct { |
| __uint(type, BPF_MAP_TYPE_STACK); |
| __uint(max_entries, 1); |
| __type(value, int); |
| } stack_map SEC(".maps"); |
| |
| struct { |
| __uint(type, BPF_MAP_TYPE_ARRAY); |
| __uint(max_entries, 1); |
| __type(key, int); |
| __type(value, int); |
| } array_map SEC(".maps"); |
| |
| const volatile pid_t pid; |
| long err = 0; |
| |
| static u64 callback(u64 map, u64 key, u64 val, u64 ctx, u64 flags) |
| { |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_getpid") |
| int map_update(void *ctx) |
| { |
| const int key = 0; |
| const int val = 1; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| err = bpf_map_update_elem(&hash_map, &key, &val, BPF_NOEXIST); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_getppid") |
| int map_delete(void *ctx) |
| { |
| const int key = 0; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| err = bpf_map_delete_elem(&hash_map, &key); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_getuid") |
| int map_push(void *ctx) |
| { |
| const int val = 1; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| err = bpf_map_push_elem(&stack_map, &val, 0); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_geteuid") |
| int map_pop(void *ctx) |
| { |
| int val; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| err = bpf_map_pop_elem(&stack_map, &val); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_getgid") |
| int map_peek(void *ctx) |
| { |
| int val; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| err = bpf_map_peek_elem(&stack_map, &val); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_gettid") |
| int map_for_each_pass(void *ctx) |
| { |
| const int key = 0; |
| const int val = 1; |
| const u64 flags = 0; |
| int callback_ctx; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| bpf_map_update_elem(&array_map, &key, &val, flags); |
| |
| err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags); |
| |
| return 0; |
| } |
| |
| SEC("tp/syscalls/sys_enter_getpgid") |
| int map_for_each_fail(void *ctx) |
| { |
| const int key = 0; |
| const int val = 1; |
| const u64 flags = BPF_NOEXIST; |
| int callback_ctx; |
| |
| if (pid != (bpf_get_current_pid_tgid() >> 32)) |
| return 0; |
| |
| bpf_map_update_elem(&array_map, &key, &val, flags); |
| |
| /* calling for_each with non-zero flags will return error */ |
| err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags); |
| |
| return 0; |
| } |