kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
linux-hardened/samples/bpf
History
Alexei Starovoitov 5bacd7805a samples/bpf: bpf_tail_call example for tracing 
kprobe example that demonstrates how future seccomp programs may look like.
It attaches to seccomp_phase1() function and tail-calls other BPF programs
depending on syscall number.

Existing optimized classic BPF seccomp programs generated by Chrome look like:
if (sd.nr < 121) {
  if (sd.nr < 57) {
    if (sd.nr < 22) {
      if (sd.nr < 7) {
        if (sd.nr < 4) {
          if (sd.nr < 1) {
            check sys_read
          } else {
            if (sd.nr < 3) {
              check sys_write and sys_open
            } else {
              check sys_close
            }
          }
        } else {
      } else {
    } else {
  } else {
} else {
}

the future seccomp using native eBPF may look like:
  bpf_tail_call(&sd, &syscall_jmp_table, sd.nr);
which is simpler, faster and leaves more room for per-syscall checks.

Usage:
$ sudo ./tracex5
<...>-366   [001] d...     4.870033: : read(fd=1, buf=00007f6d5bebf000, size=771)
<...>-369   [003] d...     4.870066: : mmap
<...>-369   [003] d...     4.870077: : syscall=110 (one of get/set uid/pid/gid)
<...>-369   [003] d...     4.870089: : syscall=107 (one of get/set uid/pid/gid)
   sh-369   [000] d...     4.891740: : read(fd=0, buf=00000000023d1000, size=512)
   sh-369   [000] d...     4.891747: : write(fd=1, buf=00000000023d3000, size=512)
   sh-369   [000] d...     4.891747: : read(fd=1, buf=00000000023d3000, size=512)

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-05-21 17:07:59 -04:00
..
bpf_helpers.h samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00
bpf_load.c samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00
bpf_load.h samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
libbpf.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
libbpf.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
Makefile samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00
sock_example.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
sockex1_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex1_user.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_user.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
tcbpf1_kern.c bpf: fix bpf helpers to use skb->mac_header relative offsets 2015-04-16 14:08:49 -04:00
test_maps.c samples: bpf: relax test_maps check 2015-01-26 17:20:40 -08:00
test_verifier.c bpf: fix two bugs in verification logic when accessing 'ctx' pointer 2015-04-16 14:08:49 -04:00
tracex1_kern.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
tracex1_user.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
tracex2_kern.c samples/bpf: Add counting example for kfree_skb() function calls and the write() syscall 2015-04-02 13:25:50 +02:00
tracex2_user.c samples/bpf: Add counting example for kfree_skb() function calls and the write() syscall 2015-04-02 13:25:50 +02:00
tracex3_kern.c samples/bpf: Add IO latency analysis (iosnoop/heatmap) tool 2015-04-02 13:25:51 +02:00
tracex3_user.c samples/bpf: Add IO latency analysis (iosnoop/heatmap) tool 2015-04-02 13:25:51 +02:00
tracex4_kern.c samples/bpf: Add kmem_alloc()/free() tracker tool 2015-04-02 13:25:51 +02:00
tracex4_user.c samples/bpf: Add kmem_alloc()/free() tracker tool 2015-04-02 13:25:51 +02:00
tracex5_kern.c samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00
tracex5_user.c samples/bpf: bpf_tail_call example for tracing 2015-05-21 17:07:59 -04:00