1*8ddce416SDaniel Borkmann // SPDX-License-Identifier: GPL-2.0 2*8ddce416SDaniel Borkmann 3*8ddce416SDaniel Borkmann #include "vmlinux.h" 4*8ddce416SDaniel Borkmann #include <bpf/bpf_helpers.h> 5*8ddce416SDaniel Borkmann #include <bpf/bpf_tracing.h> 6*8ddce416SDaniel Borkmann 7*8ddce416SDaniel Borkmann char _license[] SEC("license") = "GPL"; 8*8ddce416SDaniel Borkmann 9*8ddce416SDaniel Borkmann __u32 monitored_tid; 10*8ddce416SDaniel Borkmann 11*8ddce416SDaniel Borkmann int sig_keyring_serial; 12*8ddce416SDaniel Borkmann int sig_keyring_type; 13*8ddce416SDaniel Borkmann int sig_verdict; 14*8ddce416SDaniel Borkmann int seen; 15*8ddce416SDaniel Borkmann 16*8ddce416SDaniel Borkmann SEC("lsm/bpf_prog_load") 17*8ddce416SDaniel Borkmann int BPF_PROG(inspect_prog_load, struct bpf_prog *prog, union bpf_attr *attr, 18*8ddce416SDaniel Borkmann struct bpf_token *token, bool kernel) 19*8ddce416SDaniel Borkmann { 20*8ddce416SDaniel Borkmann __u32 tid = bpf_get_current_pid_tgid() & 0xffffffff; 21*8ddce416SDaniel Borkmann 22*8ddce416SDaniel Borkmann if (!monitored_tid || tid != monitored_tid) 23*8ddce416SDaniel Borkmann return 0; 24*8ddce416SDaniel Borkmann 25*8ddce416SDaniel Borkmann seen++; 26*8ddce416SDaniel Borkmann sig_keyring_serial = prog->aux->sig.keyring_serial; 27*8ddce416SDaniel Borkmann sig_keyring_type = prog->aux->sig.keyring_type; 28*8ddce416SDaniel Borkmann sig_verdict = prog->aux->sig.verdict; 29*8ddce416SDaniel Borkmann return 0; 30*8ddce416SDaniel Borkmann } 31