1 // SPDX-License-Identifier: GPL-2.0 2 #include <stdio.h> 3 #include <stdlib.h> 4 #include <unistd.h> 5 #include <linux/filter.h> 6 #include <linux/seccomp.h> 7 #include <sys/prctl.h> 8 #include <bpf/bpf.h> 9 #include <bpf/libbpf.h> 10 #include "trace_helpers.h" 11 12 #ifdef __mips__ 13 #define MAX_ENTRIES 6000 /* MIPS n64 syscalls start at 5000 */ 14 #else 15 #define MAX_ENTRIES 1024 16 #endif 17 18 /* install fake seccomp program to enable seccomp code path inside the kernel, 19 * so that our kprobe attached to seccomp_phase1() can be triggered 20 */ 21 static void install_accept_all_seccomp(void) 22 { 23 struct sock_filter filter[] = { 24 BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), 25 }; 26 struct sock_fprog prog = { 27 .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])), 28 .filter = filter, 29 }; 30 if (prctl(PR_SET_SECCOMP, 2, &prog)) 31 perror("prctl"); 32 } 33 34 int main(int ac, char **argv) 35 { 36 struct bpf_link *link = NULL; 37 struct bpf_program *prog; 38 struct bpf_object *obj; 39 int key, fd, progs_fd; 40 const char *section; 41 char filename[256]; 42 FILE *f; 43 44 snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]); 45 obj = bpf_object__open_file(filename, NULL); 46 if (libbpf_get_error(obj)) { 47 fprintf(stderr, "ERROR: opening BPF object file failed\n"); 48 return 0; 49 } 50 51 prog = bpf_object__find_program_by_name(obj, "bpf_prog1"); 52 if (!prog) { 53 printf("finding a prog in obj file failed\n"); 54 goto cleanup; 55 } 56 57 /* load BPF program */ 58 if (bpf_object__load(obj)) { 59 fprintf(stderr, "ERROR: loading BPF object file failed\n"); 60 goto cleanup; 61 } 62 63 link = bpf_program__attach(prog); 64 if (libbpf_get_error(link)) { 65 fprintf(stderr, "ERROR: bpf_program__attach failed\n"); 66 link = NULL; 67 goto cleanup; 68 } 69 70 progs_fd = bpf_object__find_map_fd_by_name(obj, "progs"); 71 if (progs_fd < 0) { 72 fprintf(stderr, "ERROR: finding a map in obj file failed\n"); 73 goto cleanup; 74 } 75 76 bpf_object__for_each_program(prog, obj) { 77 section = bpf_program__section_name(prog); 78 /* register only syscalls to PROG_ARRAY */ 79 if (sscanf(section, "kprobe/%d", &key) != 1) 80 continue; 81 82 fd = bpf_program__fd(prog); 83 bpf_map_update_elem(progs_fd, &key, &fd, BPF_ANY); 84 } 85 86 install_accept_all_seccomp(); 87 88 f = popen("dd if=/dev/zero of=/dev/null count=5", "r"); 89 (void) f; 90 91 read_trace_pipe(); 92 93 cleanup: 94 bpf_link__destroy(link); 95 bpf_object__close(obj); 96 return 0; 97 } 98