0001
0002
0003 #include <stdbool.h>
0004 #include <linux/types.h>
0005 #include <linux/bpf.h>
0006 #include <bpf/bpf_helpers.h>
0007 #include <bpf/bpf_tracing.h>
0008
0009 #define STRNCMP_STR_SZ 8
0010
0011 const char target[STRNCMP_STR_SZ] = "EEEEEEE";
0012 char str[STRNCMP_STR_SZ];
0013 int cmp_ret = 0;
0014 int target_pid = 0;
0015
0016 const char no_str_target[STRNCMP_STR_SZ] = "12345678";
0017 char writable_target[STRNCMP_STR_SZ];
0018 unsigned int no_const_str_size = STRNCMP_STR_SZ;
0019
0020 char _license[] SEC("license") = "GPL";
0021
0022 SEC("?tp/syscalls/sys_enter_nanosleep")
0023 int do_strncmp(void *ctx)
0024 {
0025 if ((bpf_get_current_pid_tgid() >> 32) != target_pid)
0026 return 0;
0027
0028 cmp_ret = bpf_strncmp(str, STRNCMP_STR_SZ, target);
0029 return 0;
0030 }
0031
0032 SEC("?tp/syscalls/sys_enter_nanosleep")
0033 int strncmp_bad_not_const_str_size(void *ctx)
0034 {
0035
0036 cmp_ret = bpf_strncmp(str, no_const_str_size, target);
0037 return 0;
0038 }
0039
0040 SEC("?tp/syscalls/sys_enter_nanosleep")
0041 int strncmp_bad_writable_target(void *ctx)
0042 {
0043
0044 cmp_ret = bpf_strncmp(str, STRNCMP_STR_SZ, writable_target);
0045 return 0;
0046 }
0047
0048 SEC("?tp/syscalls/sys_enter_nanosleep")
0049 int strncmp_bad_not_null_term_target(void *ctx)
0050 {
0051
0052 cmp_ret = bpf_strncmp(str, STRNCMP_STR_SZ, no_str_target);
0053 return 0;
0054 }