1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/bpf.h> 3 #include <linux/errno.h> 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_tracing.h> 6 7 char _license[] SEC("license") = "GPL"; 8 9 struct inode { 10 unsigned long i_ino; 11 } __attribute__((preserve_access_index)); 12 13 struct file { 14 struct inode *f_inode; 15 } __attribute__((preserve_access_index)); 16 17 struct { 18 __uint(type, BPF_MAP_TYPE_HASH); 19 __uint(max_entries, 16); 20 __type(key, __u64); /* inode number */ 21 __type(value, __u32); /* tgid of the receiver being tested */ 22 } denied_inodes SEC(".maps"); 23 24 SEC("lsm/file_receive") BPF_PROG(scm_rights_deny,struct file * file)25int BPF_PROG(scm_rights_deny, struct file *file) 26 { 27 __u32 tgid = bpf_get_current_pid_tgid() >> 32; 28 __u64 ino = file->f_inode->i_ino; 29 __u32 *owner; 30 31 owner = bpf_map_lookup_elem(&denied_inodes, &ino); 32 if (owner && *owner == tgid) 33 return -EPERM; 34 35 return 0; 36 } 37