Back to home page

OSCL-LXR

 
 

    


0001 // SPDX-License-Identifier: GPL-2.0
0002 
0003 #include "vmlinux.h"
0004 #include <bpf/bpf_helpers.h>
0005 #include <bpf/bpf_tracing.h>
0006 
0007 #define MAX_PATH_LEN        128
0008 #define MAX_FILES       7
0009 
0010 pid_t my_pid = 0;
0011 __u32 cnt_stat = 0;
0012 __u32 cnt_close = 0;
0013 char paths_stat[MAX_FILES][MAX_PATH_LEN] = {};
0014 char paths_close[MAX_FILES][MAX_PATH_LEN] = {};
0015 int rets_stat[MAX_FILES] = {};
0016 int rets_close[MAX_FILES] = {};
0017 
0018 int called_stat = 0;
0019 int called_close = 0;
0020 
0021 SEC("fentry/security_inode_getattr")
0022 int BPF_PROG(prog_stat, struct path *path, struct kstat *stat,
0023          __u32 request_mask, unsigned int query_flags)
0024 {
0025     pid_t pid = bpf_get_current_pid_tgid() >> 32;
0026     __u32 cnt = cnt_stat;
0027     int ret;
0028 
0029     called_stat = 1;
0030 
0031     if (pid != my_pid)
0032         return 0;
0033 
0034     if (cnt >= MAX_FILES)
0035         return 0;
0036     ret = bpf_d_path(path, paths_stat[cnt], MAX_PATH_LEN);
0037 
0038     rets_stat[cnt] = ret;
0039     cnt_stat++;
0040     return 0;
0041 }
0042 
0043 SEC("fentry/filp_close")
0044 int BPF_PROG(prog_close, struct file *file, void *id)
0045 {
0046     pid_t pid = bpf_get_current_pid_tgid() >> 32;
0047     __u32 cnt = cnt_close;
0048     int ret;
0049 
0050     called_close = 1;
0051 
0052     if (pid != my_pid)
0053         return 0;
0054 
0055     if (cnt >= MAX_FILES)
0056         return 0;
0057     ret = bpf_d_path(&file->f_path,
0058              paths_close[cnt], MAX_PATH_LEN);
0059 
0060     rets_close[cnt] = ret;
0061     cnt_close++;
0062     return 0;
0063 }
0064 
0065 char _license[] SEC("license") = "GPL";