1 // SPDX-License-Identifier: GPL-2.0 2 #include <stdio.h> 3 #include <stdlib.h> 4 #include <unistd.h> 5 #include <linux/filter.h> 6 #include <linux/seccomp.h> 7 #include <sys/prctl.h> 8 #include <bpf/bpf.h> 9 #include <bpf/libbpf.h> 10 #include "trace_helpers.h" 11 #include "bpf_util.h" 12 13 #ifdef __mips__ 14 #define MAX_ENTRIES 6000 /* MIPS n64 syscalls start at 5000 */ 15 #else 16 #define MAX_ENTRIES 1024 17 #endif 18 19 /* install fake seccomp program to enable seccomp code path inside the kernel, 20 * so that our kprobe attached to seccomp_phase1() can be triggered 21 */ 22 static void install_accept_all_seccomp(void) 23 { 24 struct sock_filter filter[] = { 25 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), 26 }; 27 struct sock_fprog prog = { 28 .len = (unsigned short)ARRAY_SIZE(filter), 29 .filter = filter, 30 }; 31 if (prctl(PR_SET_SECCOMP, 2, &prog)) 32 perror("prctl"); 33 } 34 35 int main(int ac, char **argv) 36 { 37 struct bpf_link *link = NULL; 38 struct bpf_program *prog; 39 struct bpf_object *obj; 40 int key, fd, progs_fd; 41 const char *section; 42 char filename[256]; 43 FILE *f; 44 45 snprintf(filename, sizeof(filename), "%s.bpf.o", argv[0]); 46 obj = bpf_object__open_file(filename, NULL); 47 if (libbpf_get_error(obj)) { 48 fprintf(stderr, "ERROR: opening BPF object file failed\n"); 49 return 0; 50 } 51 52 prog = bpf_object__find_program_by_name(obj, "bpf_prog1"); 53 if (!prog) { 54 printf("finding a prog in obj file failed\n"); 55 goto cleanup; 56 } 57 58 /* load BPF program */ 59 if (bpf_object__load(obj)) { 60 fprintf(stderr, "ERROR: loading BPF object file failed\n"); 61 goto cleanup; 62 } 63 64 link = bpf_program__attach(prog); 65 if (libbpf_get_error(link)) { 66 fprintf(stderr, "ERROR: bpf_program__attach failed\n"); 67 link = NULL; 68 goto cleanup; 69 } 70 71 progs_fd = bpf_object__find_map_fd_by_name(obj, "progs"); 72 if (progs_fd < 0) { 73 fprintf(stderr, "ERROR: finding a map in obj file failed\n"); 74 goto cleanup; 75 } 76 77 bpf_object__for_each_program(prog, obj) { 78 section = bpf_program__section_name(prog); 79 /* register only syscalls to PROG_ARRAY */ 80 if (sscanf(section, "kprobe/%d", &key) != 1) 81 continue; 82 83 fd = bpf_program__fd(prog); 84 bpf_map_update_elem(progs_fd, &key, &fd, BPF_ANY); 85 } 86 87 install_accept_all_seccomp(); 88 89 f = popen("dd if=/dev/zero of=/dev/null count=5", "r"); 90 (void) f; 91 92 read_trace_pipe(); 93 94 cleanup: 95 bpf_link__destroy(link); 96 bpf_object__close(obj); 97 return 0; 98 } 99