1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2023 Bytedance */
3
4 #include <vmlinux.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_helpers.h>
7
8 #include "bpf_misc.h"
9
10 struct cgroup *bpf_cgroup_from_id(u64 cgid) __ksym;
11 long bpf_task_under_cgroup(struct task_struct *task, struct cgroup *ancestor) __ksym;
12 void bpf_cgroup_release(struct cgroup *p) __ksym;
13 struct task_struct *bpf_task_acquire(struct task_struct *p) __ksym;
14 void bpf_task_release(struct task_struct *p) __ksym;
15
16 const volatile int local_pid;
17 const volatile __u64 cgid;
18 int remote_pid;
19
20 SEC("tp_btf/task_newtask")
BPF_PROG(tp_btf_run,struct task_struct * task,u64 clone_flags)21 int BPF_PROG(tp_btf_run, struct task_struct *task, u64 clone_flags)
22 {
23 struct cgroup *cgrp = NULL;
24 struct task_struct *acquired;
25
26 if (local_pid != (bpf_get_current_pid_tgid() >> 32))
27 return 0;
28
29 acquired = bpf_task_acquire(task);
30 if (!acquired)
31 return 0;
32
33 if (local_pid == acquired->tgid)
34 goto out;
35
36 cgrp = bpf_cgroup_from_id(cgid);
37 if (!cgrp)
38 goto out;
39
40 if (bpf_task_under_cgroup(acquired, cgrp))
41 remote_pid = acquired->tgid;
42
43 out:
44 if (cgrp)
45 bpf_cgroup_release(cgrp);
46 bpf_task_release(acquired);
47
48 return 0;
49 }
50
51 SEC("lsm.s/bpf")
BPF_PROG(lsm_run,int cmd,union bpf_attr * attr,unsigned int size)52 int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
53 {
54 struct cgroup *cgrp = NULL;
55 struct task_struct *task;
56 int ret = 0;
57
58 task = bpf_get_current_task_btf();
59 if (local_pid != task->pid)
60 return 0;
61
62 if (cmd != BPF_LINK_CREATE)
63 return 0;
64
65 /* 1 is the root cgroup */
66 cgrp = bpf_cgroup_from_id(1);
67 if (!cgrp)
68 goto out;
69 if (!bpf_task_under_cgroup(task, cgrp))
70 ret = -1;
71 bpf_cgroup_release(cgrp);
72
73 out:
74 return ret;
75 }
76
77 char _license[] SEC("license") = "GPL";
78