1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2025 Meta Platforms, Inc. and affiliates. */ 3 4 #include <vmlinux.h> 5 #include <asm/unistd.h> 6 #include <bpf/bpf_tracing.h> 7 #include <bpf/bpf_core_read.h> 8 #include <bpf/bpf_helpers.h> 9 10 char _license[] SEC("license") = "GPL"; 11 12 int target_pid; 13 int prog_triggered; 14 long err; 15 char copied_byte; 16 17 static int copy_getcwd_arg(char *ubuf) 18 { 19 err = bpf_copy_from_user(&copied_byte, sizeof(copied_byte), ubuf); 20 if (err) 21 return err; 22 23 prog_triggered = 1; 24 return 0; 25 } 26 27 SEC("tp_btf.s/sys_enter") 28 int BPF_PROG(handle_sys_enter_tp_btf, struct pt_regs *regs, long id) 29 { 30 if ((bpf_get_current_pid_tgid() >> 32) != target_pid || 31 id != __NR_getcwd) 32 return 0; 33 34 return copy_getcwd_arg((void *)PT_REGS_PARM1_SYSCALL(regs)); 35 } 36 37 SEC("raw_tp.s/sys_enter") 38 int BPF_PROG(handle_sys_enter_raw_tp, struct pt_regs *regs, long id) 39 { 40 if ((bpf_get_current_pid_tgid() >> 32) != target_pid || 41 id != __NR_getcwd) 42 return 0; 43 44 return copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs)); 45 } 46 47 SEC("tp.s/syscalls/sys_enter_getcwd") 48 int handle_sys_enter_tp(struct syscall_trace_enter *args) 49 { 50 if ((bpf_get_current_pid_tgid() >> 32) != target_pid) 51 return 0; 52 53 return copy_getcwd_arg((void *)args->args[0]); 54 } 55 56 SEC("tp.s/syscalls/sys_exit_getcwd") 57 int handle_sys_exit_tp(struct syscall_trace_exit *args) 58 { 59 struct pt_regs *regs; 60 61 if ((bpf_get_current_pid_tgid() >> 32) != target_pid) 62 return 0; 63 64 regs = (struct pt_regs *)bpf_task_pt_regs(bpf_get_current_task_btf()); 65 return copy_getcwd_arg((void *)PT_REGS_PARM1_CORE_SYSCALL(regs)); 66 } 67 68 SEC("raw_tp.s") 69 int BPF_PROG(handle_raw_tp_bare, struct pt_regs *regs, long id) 70 { 71 return 0; 72 } 73 74 SEC("tp.s") 75 int handle_tp_bare(void *ctx) 76 { 77 return 0; 78 } 79 80 SEC("tracepoint.s/syscalls/sys_enter_getcwd") 81 int handle_sys_enter_tp_alias(struct syscall_trace_enter *args) 82 { 83 return 0; 84 } 85 86 SEC("raw_tracepoint.s/sys_enter") 87 int BPF_PROG(handle_sys_enter_raw_tp_alias, struct pt_regs *regs, long id) 88 { 89 return 0; 90 } 91 92 SEC("raw_tp.s/sys_enter") 93 int BPF_PROG(handle_test_run, struct pt_regs *regs, long id) 94 { 95 if ((__u64)regs == 0x1234ULL && (__u64)id == 0x5678ULL) 96 return (__u64)regs + (__u64)id; 97 98 return 0; 99 } 100 101 SEC("raw_tp.s/sched_switch") 102 int BPF_PROG(handle_raw_tp_non_faultable, bool preempt, 103 struct task_struct *prev, struct task_struct *next) 104 { 105 return 0; 106 } 107 108 SEC("tp.s/sched/sched_switch") 109 int handle_tp_non_syscall(void *ctx) 110 { 111 return 0; 112 } 113