tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Augment the filename syscalls with the contents of the filename pointer argument
4 * filtering only those that do not start with /etc/.
5 *
6 * Test it with:
7 *
8 * perf trace -e tools/perf/examples/bpf/augmented_syscalls.c cat /etc/passwd > /dev/null
9 *
10 * It'll catch some openat syscalls related to the dynamic linked and
11 * the last one should be the one for '/etc/passwd'.
12 *
13 * This matches what is marshalled into the raw_syscall:sys_enter payload
14 * expected by the 'perf trace' beautifiers, and can be used by them unmodified,
15 * which will be done as that feature is implemented in the next csets, for now
16 * it will appear in a dump done by the default tracepoint handler in 'perf trace',
17 * that uses bpf_output__fprintf() to just dump those contents, as done with
18 * the bpf-output event associated with the __bpf_output__ map declared in
19 * tools/perf/include/bpf/stdio.h.
20 */
21
22#include <stdio.h>
23
24struct bpf_map SEC("maps") __augmented_syscalls__ = {
25 .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
26 .key_size = sizeof(int),
27 .value_size = sizeof(u32),
28 .max_entries = __NR_CPUS__,
29};
30
31struct augmented_filename {
32 int size;
33 int reserved;
34 char value[64];
35};
36
37#define augmented_filename_syscall_enter(syscall) \
38struct augmented_enter_##syscall##_args { \
39 struct syscall_enter_##syscall##_args args; \
40 struct augmented_filename filename; \
41}; \
42int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args) \
43{ \
44 char etc[6] = "/etc/"; \
45 struct augmented_enter_##syscall##_args augmented_args = { .filename.reserved = 0, }; \
46 probe_read(&augmented_args.args, sizeof(augmented_args.args), args); \
47 augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, \
48 sizeof(augmented_args.filename.value), \
49 args->filename_ptr); \
50 if (__builtin_memcmp(augmented_args.filename.value, etc, 4) != 0) \
51 return 0; \
52 perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, \
53 &augmented_args, \
54 (sizeof(augmented_args) - sizeof(augmented_args.filename.value) + \
55 augmented_args.filename.size)); \
56 return 0; \
57}
58
59struct syscall_enter_openat_args {
60 unsigned long long common_tp_fields;
61 long syscall_nr;
62 long dfd;
63 char *filename_ptr;
64 long flags;
65 long mode;
66};
67
68augmented_filename_syscall_enter(openat);
69
70struct syscall_enter_open_args {
71 unsigned long long common_tp_fields;
72 long syscall_nr;
73 char *filename_ptr;
74 long flags;
75 long mode;
76};
77
78augmented_filename_syscall_enter(open);
79
80license(GPL);