1 // SPDX-License-Identifier: GPL-2.0
2 // Copyright (c) 2020 Wenbo Zhang
3 #include <vmlinux.h>
4 #include <bpf/bpf_helpers.h>
5 #include <bpf/bpf_core_read.h>
6 #include <bpf/bpf_tracing.h>
7 #include "filelife.h"
8 #include "core_fixes.bpf.h"
9
10 /* linux: include/linux/fs.h */
11 #define FMODE_CREATED 0x100000
12
13 const volatile pid_t targ_tgid = 0;
14
15 struct {
16 __uint(type, BPF_MAP_TYPE_HASH);
17 __uint(max_entries, 8192);
18 __type(key, struct dentry *);
19 __type(value, u64);
20 } start SEC(".maps");
21
22 struct {
23 __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
24 __uint(key_size, sizeof(u32));
25 __uint(value_size, sizeof(u32));
26 } events SEC(".maps");
27
28 static __always_inline int
probe_create(struct dentry * dentry)29 probe_create(struct dentry *dentry)
30 {
31 u64 id = bpf_get_current_pid_tgid();
32 u32 tgid = id >> 32;
33 u64 ts;
34
35 if (targ_tgid && targ_tgid != tgid)
36 return 0;
37
38 ts = bpf_ktime_get_ns();
39 bpf_map_update_elem(&start, &dentry, &ts, 0);
40 return 0;
41 }
42
43 /**
44 * In different kernel versions, function vfs_create() has two declarations,
45 * and their parameter lists are as follows:
46 *
47 * int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
48 * bool want_excl);
49 * int vfs_create(struct user_namespace *mnt_userns, struct inode *dir,
50 * struct dentry *dentry, umode_t mode, bool want_excl);
51 * int vfs_create(struct mnt_idmap *idmap, struct inode *dir,
52 * struct dentry *dentry, umode_t mode, bool want_excl);
53 */
54 SEC("kprobe/vfs_create")
BPF_KPROBE(vfs_create,void * arg0,void * arg1,void * arg2)55 int BPF_KPROBE(vfs_create, void *arg0, void *arg1, void *arg2)
56 {
57 if (renamedata_has_old_mnt_userns_field()
58 || renamedata_has_new_mnt_idmap_field())
59 return probe_create(arg2);
60 else
61 return probe_create(arg1);
62 }
63
64 SEC("kprobe/vfs_open")
BPF_KPROBE(vfs_open,struct path * path,struct file * file)65 int BPF_KPROBE(vfs_open, struct path *path, struct file *file)
66 {
67 struct dentry *dentry = BPF_CORE_READ(path, dentry);
68 int fmode = BPF_CORE_READ(file, f_mode);
69
70 if (!(fmode & FMODE_CREATED))
71 return 0;
72
73 return probe_create(dentry);
74 }
75
76 SEC("kprobe/security_inode_create")
BPF_KPROBE(security_inode_create,struct inode * dir,struct dentry * dentry)77 int BPF_KPROBE(security_inode_create, struct inode *dir,
78 struct dentry *dentry)
79 {
80 return probe_create(dentry);
81 }
82
83 /**
84 * In different kernel versions, function vfs_unlink() has two declarations,
85 * and their parameter lists are as follows:
86 *
87 * int vfs_unlink(struct inode *dir, struct dentry *dentry,
88 * struct inode **delegated_inode);
89 * int vfs_unlink(struct user_namespace *mnt_userns, struct inode *dir,
90 * struct dentry *dentry, struct inode **delegated_inode);
91 * int vfs_unlink(struct mnt_idmap *idmap, struct inode *dir,
92 * struct dentry *dentry, struct inode **delegated_inode);
93 */
94 SEC("kprobe/vfs_unlink")
BPF_KPROBE(vfs_unlink,void * arg0,void * arg1,void * arg2)95 int BPF_KPROBE(vfs_unlink, void *arg0, void *arg1, void *arg2)
96 {
97 u64 id = bpf_get_current_pid_tgid();
98 struct event event = {};
99 const u8 *qs_name_ptr;
100 u32 tgid = id >> 32;
101 u64 *tsp, delta_ns;
102 bool has_arg = renamedata_has_old_mnt_userns_field()
103 || renamedata_has_new_mnt_idmap_field();
104
105 tsp = has_arg
106 ? bpf_map_lookup_elem(&start, &arg2)
107 : bpf_map_lookup_elem(&start, &arg1);
108 if (!tsp)
109 return 0; // missed entry
110
111 delta_ns = bpf_ktime_get_ns() - *tsp;
112
113 if (has_arg)
114 bpf_map_delete_elem(&start, &arg2);
115 else
116 bpf_map_delete_elem(&start, &arg1);
117
118 qs_name_ptr = has_arg
119 ? BPF_CORE_READ((struct dentry *)arg2, d_name.name)
120 : BPF_CORE_READ((struct dentry *)arg1, d_name.name);
121
122 bpf_probe_read_kernel_str(&event.file, sizeof(event.file), qs_name_ptr);
123 bpf_get_current_comm(&event.task, sizeof(event.task));
124 event.delta_ns = delta_ns;
125 event.tgid = tgid;
126
127 /* output */
128 bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU,
129 &event, sizeof(event));
130 return 0;
131 }
132
133 char LICENSE[] SEC("license") = "GPL";
134