.. | .. |
---|
10 | 10 | #include <uapi/linux/seccomp.h> |
---|
11 | 11 | #include <uapi/linux/unistd.h> |
---|
12 | 12 | #include "syscall_nrs.h" |
---|
13 | | -#include "bpf_helpers.h" |
---|
| 13 | +#include <bpf/bpf_helpers.h> |
---|
| 14 | +#include <bpf/bpf_tracing.h> |
---|
14 | 15 | |
---|
15 | 16 | #define PROG(F) SEC("kprobe/"__stringify(F)) int bpf_func_##F |
---|
16 | 17 | |
---|
17 | | -struct bpf_map_def SEC("maps") progs = { |
---|
18 | | - .type = BPF_MAP_TYPE_PROG_ARRAY, |
---|
19 | | - .key_size = sizeof(u32), |
---|
20 | | - .value_size = sizeof(u32), |
---|
| 18 | +struct { |
---|
| 19 | + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); |
---|
| 20 | + __uint(key_size, sizeof(u32)); |
---|
| 21 | + __uint(value_size, sizeof(u32)); |
---|
21 | 22 | #ifdef __mips__ |
---|
22 | | - .max_entries = 6000, /* MIPS n64 syscalls start at 5000 */ |
---|
| 23 | + __uint(max_entries, 6000); /* MIPS n64 syscalls start at 5000 */ |
---|
23 | 24 | #else |
---|
24 | | - .max_entries = 1024, |
---|
| 25 | + __uint(max_entries, 1024); |
---|
25 | 26 | #endif |
---|
26 | | -}; |
---|
| 27 | +} progs SEC(".maps"); |
---|
27 | 28 | |
---|
28 | 29 | SEC("kprobe/__seccomp_filter") |
---|
29 | 30 | int bpf_prog1(struct pt_regs *ctx) |
---|
.. | .. |
---|
46 | 47 | { |
---|
47 | 48 | struct seccomp_data sd; |
---|
48 | 49 | |
---|
49 | | - bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); |
---|
| 50 | + bpf_probe_read_kernel(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); |
---|
50 | 51 | if (sd.args[2] == 512) { |
---|
51 | 52 | char fmt[] = "write(fd=%d, buf=%p, size=%d)\n"; |
---|
52 | 53 | bpf_trace_printk(fmt, sizeof(fmt), |
---|
.. | .. |
---|
59 | 60 | { |
---|
60 | 61 | struct seccomp_data sd; |
---|
61 | 62 | |
---|
62 | | - bpf_probe_read(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); |
---|
| 63 | + bpf_probe_read_kernel(&sd, sizeof(sd), (void *)PT_REGS_PARM2(ctx)); |
---|
63 | 64 | if (sd.args[2] > 128 && sd.args[2] <= 1024) { |
---|
64 | 65 | char fmt[] = "read(fd=%d, buf=%p, size=%d)\n"; |
---|
65 | 66 | bpf_trace_printk(fmt, sizeof(fmt), |
---|
.. | .. |
---|
68 | 69 | return 0; |
---|
69 | 70 | } |
---|
70 | 71 | |
---|
71 | | -PROG(SYS__NR_mmap)(struct pt_regs *ctx) |
---|
| 72 | +#ifdef __NR_mmap2 |
---|
| 73 | +PROG(SYS__NR_mmap2)(struct pt_regs *ctx) |
---|
72 | 74 | { |
---|
73 | | - char fmt[] = "mmap\n"; |
---|
| 75 | + char fmt[] = "mmap2\n"; |
---|
| 76 | + |
---|
74 | 77 | bpf_trace_printk(fmt, sizeof(fmt)); |
---|
75 | 78 | return 0; |
---|
76 | 79 | } |
---|
| 80 | +#endif |
---|
| 81 | + |
---|
| 82 | +#ifdef __NR_mmap |
---|
| 83 | +PROG(SYS__NR_mmap)(struct pt_regs *ctx) |
---|
| 84 | +{ |
---|
| 85 | + char fmt[] = "mmap\n"; |
---|
| 86 | + |
---|
| 87 | + bpf_trace_printk(fmt, sizeof(fmt)); |
---|
| 88 | + return 0; |
---|
| 89 | +} |
---|
| 90 | +#endif |
---|
77 | 91 | |
---|
78 | 92 | char _license[] SEC("license") = "GPL"; |
---|
79 | 93 | u32 _version SEC("version") = LINUX_VERSION_CODE; |
---|