| .. | .. |
|---|
| 1 | 1 | // SPDX-License-Identifier: GPL-2.0 |
|---|
| 2 | 2 | #include <stdio.h> |
|---|
| 3 | | -#include <linux/bpf.h> |
|---|
| 3 | +#include <stdlib.h> |
|---|
| 4 | 4 | #include <unistd.h> |
|---|
| 5 | 5 | #include <linux/filter.h> |
|---|
| 6 | 6 | #include <linux/seccomp.h> |
|---|
| 7 | 7 | #include <sys/prctl.h> |
|---|
| 8 | 8 | #include <bpf/bpf.h> |
|---|
| 9 | | -#include "bpf_load.h" |
|---|
| 9 | +#include <bpf/libbpf.h> |
|---|
| 10 | 10 | #include <sys/resource.h> |
|---|
| 11 | +#include "trace_helpers.h" |
|---|
| 12 | + |
|---|
| 13 | +#ifdef __mips__ |
|---|
| 14 | +#define MAX_ENTRIES 6000 /* MIPS n64 syscalls start at 5000 */ |
|---|
| 15 | +#else |
|---|
| 16 | +#define MAX_ENTRIES 1024 |
|---|
| 17 | +#endif |
|---|
| 11 | 18 | |
|---|
| 12 | 19 | /* install fake seccomp program to enable seccomp code path inside the kernel, |
|---|
| 13 | 20 | * so that our kprobe attached to seccomp_phase1() can be triggered |
|---|
| .. | .. |
|---|
| 27 | 34 | |
|---|
| 28 | 35 | int main(int ac, char **argv) |
|---|
| 29 | 36 | { |
|---|
| 30 | | - FILE *f; |
|---|
| 31 | | - char filename[256]; |
|---|
| 32 | 37 | struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY}; |
|---|
| 38 | + struct bpf_link *link = NULL; |
|---|
| 39 | + struct bpf_program *prog; |
|---|
| 40 | + struct bpf_object *obj; |
|---|
| 41 | + int key, fd, progs_fd; |
|---|
| 42 | + const char *section; |
|---|
| 43 | + char filename[256]; |
|---|
| 44 | + FILE *f; |
|---|
| 33 | 45 | |
|---|
| 34 | | - snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]); |
|---|
| 35 | 46 | setrlimit(RLIMIT_MEMLOCK, &r); |
|---|
| 36 | 47 | |
|---|
| 37 | | - if (load_bpf_file(filename)) { |
|---|
| 38 | | - printf("%s", bpf_log_buf); |
|---|
| 39 | | - return 1; |
|---|
| 48 | + snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]); |
|---|
| 49 | + obj = bpf_object__open_file(filename, NULL); |
|---|
| 50 | + if (libbpf_get_error(obj)) { |
|---|
| 51 | + fprintf(stderr, "ERROR: opening BPF object file failed\n"); |
|---|
| 52 | + return 0; |
|---|
| 53 | + } |
|---|
| 54 | + |
|---|
| 55 | + prog = bpf_object__find_program_by_name(obj, "bpf_prog1"); |
|---|
| 56 | + if (!prog) { |
|---|
| 57 | + printf("finding a prog in obj file failed\n"); |
|---|
| 58 | + goto cleanup; |
|---|
| 59 | + } |
|---|
| 60 | + |
|---|
| 61 | + /* load BPF program */ |
|---|
| 62 | + if (bpf_object__load(obj)) { |
|---|
| 63 | + fprintf(stderr, "ERROR: loading BPF object file failed\n"); |
|---|
| 64 | + goto cleanup; |
|---|
| 65 | + } |
|---|
| 66 | + |
|---|
| 67 | + link = bpf_program__attach(prog); |
|---|
| 68 | + if (libbpf_get_error(link)) { |
|---|
| 69 | + fprintf(stderr, "ERROR: bpf_program__attach failed\n"); |
|---|
| 70 | + link = NULL; |
|---|
| 71 | + goto cleanup; |
|---|
| 72 | + } |
|---|
| 73 | + |
|---|
| 74 | + progs_fd = bpf_object__find_map_fd_by_name(obj, "progs"); |
|---|
| 75 | + if (progs_fd < 0) { |
|---|
| 76 | + fprintf(stderr, "ERROR: finding a map in obj file failed\n"); |
|---|
| 77 | + goto cleanup; |
|---|
| 78 | + } |
|---|
| 79 | + |
|---|
| 80 | + bpf_object__for_each_program(prog, obj) { |
|---|
| 81 | + section = bpf_program__section_name(prog); |
|---|
| 82 | + /* register only syscalls to PROG_ARRAY */ |
|---|
| 83 | + if (sscanf(section, "kprobe/%d", &key) != 1) |
|---|
| 84 | + continue; |
|---|
| 85 | + |
|---|
| 86 | + fd = bpf_program__fd(prog); |
|---|
| 87 | + bpf_map_update_elem(progs_fd, &key, &fd, BPF_ANY); |
|---|
| 40 | 88 | } |
|---|
| 41 | 89 | |
|---|
| 42 | 90 | install_accept_all_seccomp(); |
|---|
| .. | .. |
|---|
| 46 | 94 | |
|---|
| 47 | 95 | read_trace_pipe(); |
|---|
| 48 | 96 | |
|---|
| 97 | +cleanup: |
|---|
| 98 | + bpf_link__destroy(link); |
|---|
| 99 | + bpf_object__close(obj); |
|---|
| 49 | 100 | return 0; |
|---|
| 50 | 101 | } |
|---|