1126288Smtm// SPDX-License-Identifier: GPL-2.0 298186Sgordon/* Copyright (c) 2023 Meta Platforms, Inc. and affiliates. */ 378344Sobrien 498186Sgordon#include "vmlinux.h" 578344Sobrien#include <bpf/bpf_helpers.h> 678344Sobrien 778344Sobrienchar _license[] SEC("license") = "GPL"; 878344Sobrien 978344Sobrienstruct { 1078344Sobrien __uint(type, BPF_MAP_TYPE_HASH); 1178344Sobrien __uint(max_entries, 1); 1278344Sobrien __type(key, int); 1378344Sobrien __type(value, int); 1478344Sobrien} hash_map SEC(".maps"); 1578344Sobrien 1678344Sobrienstruct { 1778344Sobrien __uint(type, BPF_MAP_TYPE_STACK); 1878344Sobrien __uint(max_entries, 1); 1978344Sobrien __type(value, int); 2078344Sobrien} stack_map SEC(".maps"); 2178344Sobrien 2278344Sobrienstruct { 2378344Sobrien __uint(type, BPF_MAP_TYPE_ARRAY); 2478344Sobrien __uint(max_entries, 1); 2578344Sobrien __type(key, int); 2678344Sobrien __type(value, int); 2778344Sobrien} array_map SEC(".maps"); 2878344Sobrien 2978344Sobrienconst volatile pid_t pid; 3078344Sobrienlong err = 0; 3178344Sobrien 3278344Sobrienstatic u64 callback(u64 map, u64 key, u64 val, u64 ctx, u64 flags) 3378344Sobrien{ 3478344Sobrien return 0; 3578344Sobrien} 3678344Sobrien 3778344SobrienSEC("tp/syscalls/sys_enter_getpid") 3878344Sobrienint map_update(void *ctx) 3978344Sobrien{ 4078344Sobrien const int key = 0; 4178344Sobrien const int val = 1; 4278344Sobrien 4398186Sgordon if (pid != (bpf_get_current_pid_tgid() >> 32)) 4498186Sgordon return 0; 4598186Sgordon 46131550Scperciva err = bpf_map_update_elem(&hash_map, &key, &val, BPF_NOEXIST); 47131550Scperciva 48131550Scperciva return 0; 49131550Scperciva} 5098186Sgordon 5198186SgordonSEC("tp/syscalls/sys_enter_getppid") 5298186Sgordonint map_delete(void *ctx) 53103018Sgordon{ 54124832Smtm const int key = 0; 55124832Smtm 5698186Sgordon if (pid != (bpf_get_current_pid_tgid() >> 32)) 57103018Sgordon return 0; 5898186Sgordon 5998186Sgordon err = bpf_map_delete_elem(&hash_map, &key); 6098186Sgordon 6198186Sgordon return 0; 6298186Sgordon} 6398186Sgordon 6498186SgordonSEC("tp/syscalls/sys_enter_getuid") 6598186Sgordonint map_push(void *ctx) 6698186Sgordon{ 6778344Sobrien const int val = 1; 6878344Sobrien 6978344Sobrien if (pid != (bpf_get_current_pid_tgid() >> 32)) 7078344Sobrien return 0; 7198186Sgordon 7298186Sgordon err = bpf_map_push_elem(&stack_map, &val, 0); 7398186Sgordon 7498186Sgordon return 0; 7598186Sgordon} 7698186Sgordon 7798186SgordonSEC("tp/syscalls/sys_enter_geteuid") 7898186Sgordonint map_pop(void *ctx) 7998186Sgordon{ 8098186Sgordon int val; 8198186Sgordon 8298186Sgordon if (pid != (bpf_get_current_pid_tgid() >> 32)) 8398186Sgordon return 0; 8498186Sgordon 8598186Sgordon err = bpf_map_pop_elem(&stack_map, &val); 8698186Sgordon 8798186Sgordon return 0; 88103018Sgordon} 8998186Sgordon 9098186SgordonSEC("tp/syscalls/sys_enter_getgid") 9198186Sgordonint map_peek(void *ctx) 9298186Sgordon{ 9398186Sgordon int val; 9498186Sgordon 9598186Sgordon if (pid != (bpf_get_current_pid_tgid() >> 32)) 9698186Sgordon return 0; 9798186Sgordon 9898186Sgordon err = bpf_map_peek_elem(&stack_map, &val); 9998186Sgordon 10098186Sgordon return 0; 10198186Sgordon} 10298186Sgordon 10398186SgordonSEC("tp/syscalls/sys_enter_gettid") 10498186Sgordonint map_for_each_pass(void *ctx) 10598186Sgordon{ 10698186Sgordon const int key = 0; 10798186Sgordon const int val = 1; 10898186Sgordon const u64 flags = 0; 10998186Sgordon int callback_ctx; 11098186Sgordon 11198186Sgordon if (pid != (bpf_get_current_pid_tgid() >> 32)) 11298186Sgordon return 0; 11398186Sgordon 11498186Sgordon bpf_map_update_elem(&array_map, &key, &val, flags); 11598186Sgordon 11698186Sgordon err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags); 11798186Sgordon 11898186Sgordon return 0; 11998186Sgordon} 12098186Sgordon 12178344SobrienSEC("tp/syscalls/sys_enter_getpgid") 12278344Sobrienint map_for_each_fail(void *ctx) 12378344Sobrien{ 12478344Sobrien const int key = 0; 12578344Sobrien const int val = 1; 12678344Sobrien const u64 flags = BPF_NOEXIST; 12778344Sobrien int callback_ctx; 12898186Sgordon 12978344Sobrien if (pid != (bpf_get_current_pid_tgid() >> 32)) 13078344Sobrien return 0; 13178344Sobrien 13278344Sobrien bpf_map_update_elem(&array_map, &key, &val, flags); 13378344Sobrien 13478344Sobrien /* calling for_each with non-zero flags will return error */ 13578344Sobrien err = bpf_for_each_map_elem(&array_map, callback, &callback_ctx, flags); 13678344Sobrien 13778344Sobrien return 0; 13878344Sobrien} 13978344Sobrien