1/* Copyright (c) 2015 PLUMgrid, http://plumgrid.com 2 * 3 * This program is free software; you can redistribute it and/or 4 * modify it under the terms of version 2 of the GNU General Public 5 * License as published by the Free Software Foundation. 6 */ 7#include <linux/ptrace.h> 8#include <linux/version.h> 9#include <uapi/linux/bpf.h> 10#include <uapi/linux/seccomp.h> 11#include "bpf_helpers.h" 12 13#define PROG(F) SEC("kprobe/"__stringify(F)) int bpf_func_##F 14 15struct bpf_map_def SEC("maps") progs = { 16 .type = BPF_MAP_TYPE_PROG_ARRAY, 17 .key_size = sizeof(u32), 18 .value_size = sizeof(u32), 19 .max_entries = 1024, 20}; 21 22SEC("kprobe/seccomp_phase1") 23int bpf_prog1(struct pt_regs *ctx) 24{ 25 struct seccomp_data sd = {}; 26 27 bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx)); 28 29 /* dispatch into next BPF program depending on syscall number */ 30 bpf_tail_call(ctx, &progs, sd.nr); 31 32 /* fall through -> unknown syscall */ 33 if (sd.nr >= __NR_getuid && sd.nr <= __NR_getsid) { 34 char fmt[] = "syscall=%d (one of get/set uid/pid/gid)\n"; 35 bpf_trace_printk(fmt, sizeof(fmt), sd.nr); 36 } 37 return 0; 38} 39 40/* we jump here when syscall number == __NR_write */ 41PROG(__NR_write)(struct pt_regs *ctx) 42{ 43 struct seccomp_data sd = {}; 44 45 bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx)); 46 if (sd.args[2] == 512) { 47 char fmt[] = "write(fd=%d, buf=%p, size=%d)\n"; 48 bpf_trace_printk(fmt, sizeof(fmt), 49 sd.args[0], sd.args[1], sd.args[2]); 50 } 51 return 0; 52} 53 54PROG(__NR_read)(struct pt_regs *ctx) 55{ 56 struct seccomp_data sd = {}; 57 58 bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM1(ctx)); 59 if (sd.args[2] > 128 && sd.args[2] <= 1024) { 60 char fmt[] = "read(fd=%d, buf=%p, size=%d)\n"; 61 bpf_trace_printk(fmt, sizeof(fmt), 62 sd.args[0], sd.args[1], sd.args[2]); 63 } 64 return 0; 65} 66 67PROG(__NR_mmap)(struct pt_regs *ctx) 68{ 69 char fmt[] = "mmap\n"; 70 bpf_trace_printk(fmt, sizeof(fmt)); 71 return 0; 72} 73 74char _license[] SEC("license") = "GPL"; 75u32 _version SEC("version") = LINUX_VERSION_CODE; 76