1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2024 Google LLC. */
3
4 #include <vmlinux.h>
5 #include <errno.h>
6 #include <bpf/bpf_helpers.h>
7 #include <bpf/bpf_tracing.h>
8
9 #include "bpf_misc.h"
10 #include "bpf_experimental.h"
11
12 static char buf[64];
13
14 SEC("lsm.s/file_open")
15 __success
BPF_PROG(get_task_exe_file_and_put_kfunc_from_current_sleepable)16 int BPF_PROG(get_task_exe_file_and_put_kfunc_from_current_sleepable)
17 {
18 struct file *acquired;
19
20 acquired = bpf_get_task_exe_file(bpf_get_current_task_btf());
21 if (!acquired)
22 return 0;
23
24 bpf_put_file(acquired);
25 return 0;
26 }
27
28 SEC("lsm/file_open")
29 __success
BPF_PROG(get_task_exe_file_and_put_kfunc_from_current_non_sleepable,struct file * file)30 int BPF_PROG(get_task_exe_file_and_put_kfunc_from_current_non_sleepable, struct file *file)
31 {
32 struct file *acquired;
33
34 acquired = bpf_get_task_exe_file(bpf_get_current_task_btf());
35 if (!acquired)
36 return 0;
37
38 bpf_put_file(acquired);
39 return 0;
40 }
41
42 SEC("lsm.s/task_alloc")
43 __success
BPF_PROG(get_task_exe_file_and_put_kfunc_from_argument,struct task_struct * task)44 int BPF_PROG(get_task_exe_file_and_put_kfunc_from_argument,
45 struct task_struct *task)
46 {
47 struct file *acquired;
48
49 acquired = bpf_get_task_exe_file(task);
50 if (!acquired)
51 return 0;
52
53 bpf_put_file(acquired);
54 return 0;
55 }
56
57 SEC("lsm.s/inode_getattr")
58 __success
BPF_PROG(path_d_path_from_path_argument,struct path * path)59 int BPF_PROG(path_d_path_from_path_argument, struct path *path)
60 {
61 int ret;
62
63 ret = bpf_path_d_path(path, buf, sizeof(buf));
64 __sink(ret);
65 return 0;
66 }
67
68 SEC("lsm.s/file_open")
69 __success
BPF_PROG(path_d_path_from_file_argument,struct file * file)70 int BPF_PROG(path_d_path_from_file_argument, struct file *file)
71 {
72 int ret;
73 struct path *path;
74
75 /* The f_path member is a path which is embedded directly within a
76 * file. Therefore, a pointer to such embedded members are still
77 * recognized by the BPF verifier as being PTR_TRUSTED as it's
78 * essentially PTR_TRUSTED w/ a non-zero fixed offset.
79 */
80 path = &file->f_path;
81 ret = bpf_path_d_path(path, buf, sizeof(buf));
82 __sink(ret);
83 return 0;
84 }
85
86 SEC("lsm.s/inode_rename")
87 __success
BPF_PROG(inode_rename,struct inode * old_dir,struct dentry * old_dentry,struct inode * new_dir,struct dentry * new_dentry,unsigned int flags)88 int BPF_PROG(inode_rename, struct inode *old_dir, struct dentry *old_dentry,
89 struct inode *new_dir, struct dentry *new_dentry,
90 unsigned int flags)
91 {
92 struct inode *inode = new_dentry->d_inode;
93 ino_t ino;
94
95 if (!inode)
96 return 0;
97 ino = inode->i_ino;
98 if (ino == 0)
99 return -EACCES;
100 return 0;
101 }
102
103 char _license[] SEC("license") = "GPL";
104