1e4d1af4bSJiri Olsa // SPDX-License-Identifier: GPL-2.0
2e4d1af4bSJiri Olsa 
3e4d1af4bSJiri Olsa #include "vmlinux.h"
4e4d1af4bSJiri Olsa #include <bpf/bpf_helpers.h>
5e4d1af4bSJiri Olsa #include <bpf/bpf_tracing.h>
6e4d1af4bSJiri Olsa 
7e4d1af4bSJiri Olsa #define MAX_PATH_LEN		128
8e4d1af4bSJiri Olsa #define MAX_FILES		7
9e4d1af4bSJiri Olsa 
10e4d1af4bSJiri Olsa pid_t my_pid = 0;
11e4d1af4bSJiri Olsa __u32 cnt_stat = 0;
12e4d1af4bSJiri Olsa __u32 cnt_close = 0;
13e4d1af4bSJiri Olsa char paths_stat[MAX_FILES][MAX_PATH_LEN] = {};
14e4d1af4bSJiri Olsa char paths_close[MAX_FILES][MAX_PATH_LEN] = {};
15e4d1af4bSJiri Olsa int rets_stat[MAX_FILES] = {};
16e4d1af4bSJiri Olsa int rets_close[MAX_FILES] = {};
17e4d1af4bSJiri Olsa 
18a8a71796SJiri Olsa int called_stat = 0;
19a8a71796SJiri Olsa int called_close = 0;
20a8a71796SJiri Olsa 
21a8a71796SJiri Olsa SEC("fentry/security_inode_getattr")
BPF_PROG(prog_stat,struct path * path,struct kstat * stat,__u32 request_mask,unsigned int query_flags)22e4d1af4bSJiri Olsa int BPF_PROG(prog_stat, struct path *path, struct kstat *stat,
23e4d1af4bSJiri Olsa 	     __u32 request_mask, unsigned int query_flags)
24e4d1af4bSJiri Olsa {
25e4d1af4bSJiri Olsa 	pid_t pid = bpf_get_current_pid_tgid() >> 32;
26e4d1af4bSJiri Olsa 	__u32 cnt = cnt_stat;
27e4d1af4bSJiri Olsa 	int ret;
28e4d1af4bSJiri Olsa 
29a8a71796SJiri Olsa 	called_stat = 1;
30a8a71796SJiri Olsa 
31e4d1af4bSJiri Olsa 	if (pid != my_pid)
32e4d1af4bSJiri Olsa 		return 0;
33e4d1af4bSJiri Olsa 
34e4d1af4bSJiri Olsa 	if (cnt >= MAX_FILES)
35e4d1af4bSJiri Olsa 		return 0;
36e4d1af4bSJiri Olsa 	ret = bpf_d_path(path, paths_stat[cnt], MAX_PATH_LEN);
37e4d1af4bSJiri Olsa 
38e4d1af4bSJiri Olsa 	rets_stat[cnt] = ret;
39e4d1af4bSJiri Olsa 	cnt_stat++;
40e4d1af4bSJiri Olsa 	return 0;
41e4d1af4bSJiri Olsa }
42e4d1af4bSJiri Olsa 
43e4d1af4bSJiri Olsa SEC("fentry/filp_close")
BPF_PROG(prog_close,struct file * file,void * id)44e4d1af4bSJiri Olsa int BPF_PROG(prog_close, struct file *file, void *id)
45e4d1af4bSJiri Olsa {
46e4d1af4bSJiri Olsa 	pid_t pid = bpf_get_current_pid_tgid() >> 32;
47e4d1af4bSJiri Olsa 	__u32 cnt = cnt_close;
48e4d1af4bSJiri Olsa 	int ret;
49e4d1af4bSJiri Olsa 
50a8a71796SJiri Olsa 	called_close = 1;
51a8a71796SJiri Olsa 
52e4d1af4bSJiri Olsa 	if (pid != my_pid)
53e4d1af4bSJiri Olsa 		return 0;
54e4d1af4bSJiri Olsa 
55e4d1af4bSJiri Olsa 	if (cnt >= MAX_FILES)
56e4d1af4bSJiri Olsa 		return 0;
57e4d1af4bSJiri Olsa 	ret = bpf_d_path(&file->f_path,
58e4d1af4bSJiri Olsa 			 paths_close[cnt], MAX_PATH_LEN);
59e4d1af4bSJiri Olsa 
60e4d1af4bSJiri Olsa 	rets_close[cnt] = ret;
61e4d1af4bSJiri Olsa 	cnt_close++;
62e4d1af4bSJiri Olsa 	return 0;
63e4d1af4bSJiri Olsa }
64e4d1af4bSJiri Olsa 
65e4d1af4bSJiri Olsa char _license[] SEC("license") = "GPL";
66