1 | // SPDX-License-Identifier: GPL-2.0 |
2 | #include <stdio.h> |
3 | #include <stdlib.h> |
4 | #include <unistd.h> |
5 | #include <linux/filter.h> |
6 | #include <linux/seccomp.h> |
7 | #include <sys/prctl.h> |
8 | #include <bpf/bpf.h> |
9 | #include <bpf/libbpf.h> |
10 | #include "trace_helpers.h" |
11 | #include "bpf_util.h" |
12 | |
13 | #ifdef __mips__ |
14 | #define MAX_ENTRIES 6000 /* MIPS n64 syscalls start at 5000 */ |
15 | #else |
16 | #define MAX_ENTRIES 1024 |
17 | #endif |
18 | |
19 | /* install fake seccomp program to enable seccomp code path inside the kernel, |
20 | * so that our kprobe attached to seccomp_phase1() can be triggered |
21 | */ |
22 | static void install_accept_all_seccomp(void) |
23 | { |
24 | struct sock_filter filter[] = { |
25 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), |
26 | }; |
27 | struct sock_fprog prog = { |
28 | .len = (unsigned short)ARRAY_SIZE(filter), |
29 | .filter = filter, |
30 | }; |
31 | if (prctl(PR_SET_SECCOMP, 2, &prog)) |
32 | perror(s: "prctl" ); |
33 | } |
34 | |
35 | int main(int ac, char **argv) |
36 | { |
37 | struct bpf_link *link = NULL; |
38 | struct bpf_program *prog; |
39 | struct bpf_object *obj; |
40 | int key, fd, progs_fd; |
41 | const char *section; |
42 | char filename[256]; |
43 | FILE *f; |
44 | |
45 | snprintf(s: filename, maxlen: sizeof(filename), format: "%s.bpf.o" , argv[0]); |
46 | obj = bpf_object__open_file(filename, NULL); |
47 | if (libbpf_get_error(obj)) { |
48 | fprintf(stderr, format: "ERROR: opening BPF object file failed\n" ); |
49 | return 0; |
50 | } |
51 | |
52 | prog = bpf_object__find_program_by_name(obj, "bpf_prog1" ); |
53 | if (!prog) { |
54 | printf(format: "finding a prog in obj file failed\n" ); |
55 | goto cleanup; |
56 | } |
57 | |
58 | /* load BPF program */ |
59 | if (bpf_object__load(obj)) { |
60 | fprintf(stderr, format: "ERROR: loading BPF object file failed\n" ); |
61 | goto cleanup; |
62 | } |
63 | |
64 | link = bpf_program__attach(prog); |
65 | if (libbpf_get_error(link)) { |
66 | fprintf(stderr, format: "ERROR: bpf_program__attach failed\n" ); |
67 | link = NULL; |
68 | goto cleanup; |
69 | } |
70 | |
71 | progs_fd = bpf_object__find_map_fd_by_name(obj, "progs" ); |
72 | if (progs_fd < 0) { |
73 | fprintf(stderr, format: "ERROR: finding a map in obj file failed\n" ); |
74 | goto cleanup; |
75 | } |
76 | |
77 | bpf_object__for_each_program(prog, obj) { |
78 | section = bpf_program__section_name(prog); |
79 | /* register only syscalls to PROG_ARRAY */ |
80 | if (sscanf(section, "kprobe/%d" , &key) != 1) |
81 | continue; |
82 | |
83 | fd = bpf_program__fd(prog); |
84 | bpf_map_update_elem(progs_fd, &key, &fd, BPF_ANY); |
85 | } |
86 | |
87 | install_accept_all_seccomp(); |
88 | |
89 | f = popen(command: "dd if=/dev/zero of=/dev/null count=5" , modes: "r" ); |
90 | (void) f; |
91 | |
92 | read_trace_pipe(); |
93 | |
94 | cleanup: |
95 | bpf_link__destroy(link); |
96 | bpf_object__close(obj); |
97 | return 0; |
98 | } |
99 | |