149e0263aSFeng Zhou // SPDX-License-Identifier: GPL-2.0
249e0263aSFeng Zhou /* Copyright (c) 2023 Bytedance */
349e0263aSFeng Zhou
449e0263aSFeng Zhou #include <vmlinux.h>
549e0263aSFeng Zhou #include <bpf/bpf_tracing.h>
649e0263aSFeng Zhou #include <bpf/bpf_helpers.h>
749e0263aSFeng Zhou
849e0263aSFeng Zhou #include "bpf_misc.h"
949e0263aSFeng Zhou
1049e0263aSFeng Zhou struct cgroup *bpf_cgroup_from_id(u64 cgid) __ksym;
1149e0263aSFeng Zhou long bpf_task_under_cgroup(struct task_struct *task, struct cgroup *ancestor) __ksym;
1249e0263aSFeng Zhou void bpf_cgroup_release(struct cgroup *p) __ksym;
1349e0263aSFeng Zhou struct task_struct *bpf_task_acquire(struct task_struct *p) __ksym;
1449e0263aSFeng Zhou void bpf_task_release(struct task_struct *p) __ksym;
1549e0263aSFeng Zhou
1649e0263aSFeng Zhou const volatile int local_pid;
1749e0263aSFeng Zhou const volatile __u64 cgid;
1849e0263aSFeng Zhou int remote_pid;
1949e0263aSFeng Zhou
2049e0263aSFeng Zhou SEC("tp_btf/task_newtask")
BPF_PROG(tp_btf_run,struct task_struct * task,u64 clone_flags)21*44cb03f1SYafang Shao int BPF_PROG(tp_btf_run, struct task_struct *task, u64 clone_flags)
2249e0263aSFeng Zhou {
2349e0263aSFeng Zhou struct cgroup *cgrp = NULL;
2449e0263aSFeng Zhou struct task_struct *acquired;
2549e0263aSFeng Zhou
2649e0263aSFeng Zhou if (local_pid != (bpf_get_current_pid_tgid() >> 32))
2749e0263aSFeng Zhou return 0;
2849e0263aSFeng Zhou
2949e0263aSFeng Zhou acquired = bpf_task_acquire(task);
3049e0263aSFeng Zhou if (!acquired)
3149e0263aSFeng Zhou return 0;
3249e0263aSFeng Zhou
3349e0263aSFeng Zhou if (local_pid == acquired->tgid)
3449e0263aSFeng Zhou goto out;
3549e0263aSFeng Zhou
3649e0263aSFeng Zhou cgrp = bpf_cgroup_from_id(cgid);
3749e0263aSFeng Zhou if (!cgrp)
3849e0263aSFeng Zhou goto out;
3949e0263aSFeng Zhou
4049e0263aSFeng Zhou if (bpf_task_under_cgroup(acquired, cgrp))
4149e0263aSFeng Zhou remote_pid = acquired->tgid;
4249e0263aSFeng Zhou
4349e0263aSFeng Zhou out:
4449e0263aSFeng Zhou if (cgrp)
4549e0263aSFeng Zhou bpf_cgroup_release(cgrp);
4649e0263aSFeng Zhou bpf_task_release(acquired);
4749e0263aSFeng Zhou
4849e0263aSFeng Zhou return 0;
4949e0263aSFeng Zhou }
5049e0263aSFeng Zhou
51*44cb03f1SYafang Shao SEC("lsm.s/bpf")
BPF_PROG(lsm_run,int cmd,union bpf_attr * attr,unsigned int size)52*44cb03f1SYafang Shao int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
53*44cb03f1SYafang Shao {
54*44cb03f1SYafang Shao struct cgroup *cgrp = NULL;
55*44cb03f1SYafang Shao struct task_struct *task;
56*44cb03f1SYafang Shao int ret = 0;
57*44cb03f1SYafang Shao
58*44cb03f1SYafang Shao task = bpf_get_current_task_btf();
59*44cb03f1SYafang Shao if (local_pid != task->pid)
60*44cb03f1SYafang Shao return 0;
61*44cb03f1SYafang Shao
62*44cb03f1SYafang Shao if (cmd != BPF_LINK_CREATE)
63*44cb03f1SYafang Shao return 0;
64*44cb03f1SYafang Shao
65*44cb03f1SYafang Shao /* 1 is the root cgroup */
66*44cb03f1SYafang Shao cgrp = bpf_cgroup_from_id(1);
67*44cb03f1SYafang Shao if (!cgrp)
68*44cb03f1SYafang Shao goto out;
69*44cb03f1SYafang Shao if (!bpf_task_under_cgroup(task, cgrp))
70*44cb03f1SYafang Shao ret = -1;
71*44cb03f1SYafang Shao bpf_cgroup_release(cgrp);
72*44cb03f1SYafang Shao
73*44cb03f1SYafang Shao out:
74*44cb03f1SYafang Shao return ret;
75*44cb03f1SYafang Shao }
76*44cb03f1SYafang Shao
7749e0263aSFeng Zhou char _license[] SEC("license") = "GPL";
78