Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2
3/*
4 * Copyright (C) 2025 Microsoft Corporation
5 *
6 * Author: Blaise Boscaccy <bboscaccy@linux.microsoft.com>
7 */
8
9#include "vmlinux.h"
10#include <errno.h>
11#include <bpf/bpf_helpers.h>
12#include <bpf/bpf_tracing.h>
13
14char _license[] SEC("license") = "GPL";
15
16__u32 monitored_tid;
17
18SEC("lsm.s/bpf")
19int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
20{
21 __u32 tid;
22
23 tid = bpf_get_current_pid_tgid() & 0xFFFFFFFF;
24 if (!kernel || tid != monitored_tid)
25 return 0;
26 else
27 return -EINVAL;
28}