1 /* Copyright (c) 2015 PLUMgrid, http://plumgrid.com 2 * 3 * This program is free software; you can redistribute it and/or 4 * modify it under the terms of version 2 of the GNU General Public 5 * License as published by the Free Software Foundation. 6 */ 7 #include "vmlinux.h" 8 #include "syscall_nrs.h" 9 #include <linux/version.h> 10 #include <uapi/linux/unistd.h> 11 #include <bpf/bpf_helpers.h> 12 #include <bpf/bpf_tracing.h> 13 #include <bpf/bpf_core_read.h> 14 15 #define __stringify(x) #x 16 #define PROG(F) SEC("kprobe/"__stringify(F)) int bpf_func_##F 17 18 struct { 19 __uint(type, BPF_MAP_TYPE_PROG_ARRAY); 20 __uint(key_size, sizeof(u32)); 21 __uint(value_size, sizeof(u32)); 22 #ifdef __mips__ 23 __uint(max_entries, 6000); /* MIPS n64 syscalls start at 5000 */ 24 #else 25 __uint(max_entries, 1024); 26 #endif 27 } progs SEC(".maps"); 28 29 SEC("kprobe/__seccomp_filter") 30 int bpf_prog1(struct pt_regs *ctx) 31 { 32 int sc_nr = (int)PT_REGS_PARM1(ctx); 33 34 /* dispatch into next BPF program depending on syscall number */ 35 bpf_tail_call(ctx, &progs, sc_nr); 36 37 /* fall through -> unknown syscall */ 38 if (sc_nr >= __NR_getuid && sc_nr <= __NR_getsid) { 39 char fmt[] = "syscall=%d (one of get/set uid/pid/gid)\n"; 40 bpf_trace_printk(fmt, sizeof(fmt), sc_nr); 41 } 42 return 0; 43 } 44 45 /* we jump here when syscall number == __NR_write */ 46 PROG(SYS__NR_write)(struct pt_regs *ctx) 47 { 48 struct seccomp_data sd; 49 50 bpf_core_read(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); 51 if (sd.args[2] == 512) { 52 char fmt[] = "write(fd=%d, buf=%p, size=%d)\n"; 53 bpf_trace_printk(fmt, sizeof(fmt), 54 sd.args[0], sd.args[1], sd.args[2]); 55 } 56 return 0; 57 } 58 59 PROG(SYS__NR_read)(struct pt_regs *ctx) 60 { 61 struct seccomp_data sd; 62 63 bpf_core_read(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); 64 if (sd.args[2] > 128 && sd.args[2] <= 1024) { 65 char fmt[] = "read(fd=%d, buf=%p, size=%d)\n"; 66 bpf_trace_printk(fmt, sizeof(fmt), 67 sd.args[0], sd.args[1], sd.args[2]); 68 } 69 return 0; 70 } 71 72 #ifdef __NR_mmap2 73 PROG(SYS__NR_mmap2)(struct pt_regs *ctx) 74 { 75 char fmt[] = "mmap2\n"; 76 77 bpf_trace_printk(fmt, sizeof(fmt)); 78 return 0; 79 } 80 #endif 81 82 #ifdef __NR_mmap 83 PROG(SYS__NR_mmap)(struct pt_regs *ctx) 84 { 85 char fmt[] = "mmap\n"; 86 87 bpf_trace_printk(fmt, sizeof(fmt)); 88 return 0; 89 } 90 #endif 91 92 char _license[] SEC("license") = "GPL"; 93 u32 _version SEC("version") = LINUX_VERSION_CODE; 94