1 // SPDX-License-Identifier: GPL-2.0
2
3 #include "vmlinux.h"
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_tracing.h>
6
7 #define MAX_PATH_LEN 128
8 #define MAX_FILES 7
9
10 pid_t my_pid = 0;
11 __u32 cnt_stat = 0;
12 __u32 cnt_close = 0;
13 char paths_stat[MAX_FILES][MAX_PATH_LEN] = {};
14 char paths_close[MAX_FILES][MAX_PATH_LEN] = {};
15 int rets_stat[MAX_FILES] = {};
16 int rets_close[MAX_FILES] = {};
17
18 int called_stat = 0;
19 int called_close = 0;
20 int path_match_fallocate = 0;
21
22 SEC("fentry/security_inode_getattr")
BPF_PROG(prog_stat,struct path * path,struct kstat * stat,__u32 request_mask,unsigned int query_flags)23 int BPF_PROG(prog_stat, struct path *path, struct kstat *stat,
24 __u32 request_mask, unsigned int query_flags)
25 {
26 pid_t pid = bpf_get_current_pid_tgid() >> 32;
27 __u32 cnt = cnt_stat;
28 int ret;
29
30 called_stat = 1;
31
32 if (pid != my_pid)
33 return 0;
34
35 if (cnt >= MAX_FILES)
36 return 0;
37 ret = bpf_d_path(path, paths_stat[cnt], MAX_PATH_LEN);
38
39 rets_stat[cnt] = ret;
40 cnt_stat++;
41 return 0;
42 }
43
44 SEC("fentry/filp_close")
BPF_PROG(prog_close,struct file * file,void * id)45 int BPF_PROG(prog_close, struct file *file, void *id)
46 {
47 pid_t pid = bpf_get_current_pid_tgid() >> 32;
48 __u32 cnt = cnt_close;
49 int ret;
50
51 called_close = 1;
52
53 if (pid != my_pid)
54 return 0;
55
56 if (cnt >= MAX_FILES)
57 return 0;
58 ret = bpf_d_path(&file->f_path,
59 paths_close[cnt], MAX_PATH_LEN);
60
61 rets_close[cnt] = ret;
62 cnt_close++;
63 return 0;
64 }
65
66 SEC("fentry/vfs_fallocate")
BPF_PROG(prog_fallocate,struct file * file,int mode,loff_t offset,loff_t len)67 int BPF_PROG(prog_fallocate, struct file *file, int mode, loff_t offset, loff_t len)
68 {
69 pid_t pid = bpf_get_current_pid_tgid() >> 32;
70 int ret = 0;
71 char path_fallocate[MAX_PATH_LEN] = {};
72
73 if (pid != my_pid)
74 return 0;
75
76 ret = bpf_d_path(&file->f_path,
77 path_fallocate, MAX_PATH_LEN);
78 if (ret < 0)
79 return 0;
80
81 if (!path_fallocate[0])
82 return 0;
83
84 path_match_fallocate = 1;
85 return 0;
86 }
87
88 char _license[] SEC("license") = "GPL";
89