1 // SPDX-License-Identifier: GPL-2.0-only 2 3 #include "vmlinux.h" 4 #include <bpf/bpf_tracing.h> 5 #include <bpf/bpf_helpers.h> 6 7 char _license[] SEC("license") = "GPL"; 8 9 #define EPERM 1 /* Operation not permitted */ 10 11 /* From include/linux/mm.h. */ 12 #define FMODE_WRITE 0x2 13 14 struct map; 15 16 struct { 17 __uint(type, BPF_MAP_TYPE_ARRAY); 18 __type(key, __u32); 19 __type(value, __u32); 20 __uint(max_entries, 1); 21 } prot_status_map SEC(".maps"); 22 23 struct { 24 __uint(type, BPF_MAP_TYPE_HASH); 25 __type(key, __u32); 26 __type(value, __u32); 27 __uint(max_entries, 3); 28 } prot_map SEC(".maps"); 29 30 struct { 31 __uint(type, BPF_MAP_TYPE_HASH); 32 __type(key, __u32); 33 __type(value, __u32); 34 __uint(max_entries, 3); 35 } not_prot_map SEC(".maps"); 36 37 SEC("fmod_ret/security_bpf_map") 38 int BPF_PROG(fmod_bpf_map, struct bpf_map *map, int fmode) 39 { 40 __u32 key = 0; 41 __u32 *status_ptr = bpf_map_lookup_elem(&prot_status_map, &key); 42 43 if (!status_ptr || !*status_ptr) 44 return 0; 45 46 if (map == &prot_map) { 47 /* Allow read-only access */ 48 if (fmode & FMODE_WRITE) 49 return -EPERM; 50 } 51 52 return 0; 53 } 54 55 /* 56 * This program keeps references to maps. This is needed to prevent 57 * optimizing them out. 58 */ 59 SEC("fentry/bpf_fentry_test1") 60 int BPF_PROG(fentry_dummy1, int a) 61 { 62 __u32 key = 0; 63 __u32 val1 = a; 64 __u32 val2 = a + 1; 65 66 bpf_map_update_elem(&prot_map, &key, &val1, BPF_ANY); 67 bpf_map_update_elem(¬_prot_map, &key, &val2, BPF_ANY); 68 return 0; 69 } 70