1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2023 Bytedance */
3
4#include <vmlinux.h>
5#include <bpf/bpf_tracing.h>
6#include <bpf/bpf_helpers.h>
7
8#include "bpf_misc.h"
9
10struct cgroup *bpf_cgroup_from_id(u64 cgid) __ksym;
11long bpf_task_under_cgroup(struct task_struct *task, struct cgroup *ancestor) __ksym;
12void bpf_cgroup_release(struct cgroup *p) __ksym;
13struct task_struct *bpf_task_acquire(struct task_struct *p) __ksym;
14void bpf_task_release(struct task_struct *p) __ksym;
15
16const volatile int local_pid;
17const volatile __u64 cgid;
18int remote_pid;
19
20SEC("tp_btf/task_newtask")
21int BPF_PROG(tp_btf_run, struct task_struct *task, u64 clone_flags)
22{
23	struct cgroup *cgrp = NULL;
24	struct task_struct *acquired;
25
26	if (local_pid != (bpf_get_current_pid_tgid() >> 32))
27		return 0;
28
29	acquired = bpf_task_acquire(task);
30	if (!acquired)
31		return 0;
32
33	if (local_pid == acquired->tgid)
34		goto out;
35
36	cgrp = bpf_cgroup_from_id(cgid);
37	if (!cgrp)
38		goto out;
39
40	if (bpf_task_under_cgroup(acquired, cgrp))
41		remote_pid = acquired->tgid;
42
43out:
44	if (cgrp)
45		bpf_cgroup_release(cgrp);
46	bpf_task_release(acquired);
47
48	return 0;
49}
50
51SEC("lsm.s/bpf")
52int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
53{
54	struct cgroup *cgrp = NULL;
55	struct task_struct *task;
56	int ret = 0;
57
58	task = bpf_get_current_task_btf();
59	if (local_pid != task->pid)
60		return 0;
61
62	if (cmd != BPF_LINK_CREATE)
63		return 0;
64
65	/* 1 is the root cgroup */
66	cgrp = bpf_cgroup_from_id(1);
67	if (!cgrp)
68		goto out;
69	if (!bpf_task_under_cgroup(task, cgrp))
70		ret = -1;
71	bpf_cgroup_release(cgrp);
72
73out:
74	return ret;
75}
76
77char _license[] SEC("license") = "GPL";
78