1// SPDX-License-Identifier: GPL-2.0
 2/* Copyright (C) 2023 Yafang Shao <laoar.shao@gmail.com> */
 3
 4#include "vmlinux.h"
 5#include <bpf/bpf_helpers.h>
 6#include <bpf/bpf_tracing.h>
 7#include <bpf/bpf_core_read.h>
 8
 9__u32 target_ancestor_level;
10__u64 target_ancestor_cgid;
11int target_pid, target_hid;
12
13struct cgroup *bpf_task_get_cgroup1(struct task_struct *task, int hierarchy_id) __ksym;
14struct cgroup *bpf_cgroup_ancestor(struct cgroup *cgrp, int level) __ksym;
15void bpf_cgroup_release(struct cgroup *cgrp) __ksym;
16
17static int bpf_link_create_verify(int cmd)
18{
19	struct cgroup *cgrp, *ancestor;
20	struct task_struct *task;
21	int ret = 0;
22
23	if (cmd != BPF_LINK_CREATE)
24		return 0;
25
26	task = bpf_get_current_task_btf();
27
28	/* Then it can run in parallel with others */
29	if (task->pid != target_pid)
30		return 0;
31
32	cgrp = bpf_task_get_cgroup1(task, target_hid);
33	if (!cgrp)
34		return 0;
35
36	/* Refuse it if its cgid or its ancestor's cgid is the target cgid */
37	if (cgrp->kn->id == target_ancestor_cgid)
38		ret = -1;
39
40	ancestor = bpf_cgroup_ancestor(cgrp, target_ancestor_level);
41	if (!ancestor)
42		goto out;
43
44	if (ancestor->kn->id == target_ancestor_cgid)
45		ret = -1;
46	bpf_cgroup_release(ancestor);
47
48out:
49	bpf_cgroup_release(cgrp);
50	return ret;
51}
52
53SEC("lsm/bpf")
54int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
55{
56	return bpf_link_create_verify(cmd);
57}
58
59SEC("lsm.s/bpf")
60int BPF_PROG(lsm_s_run, int cmd, union bpf_attr *attr, unsigned int size)
61{
62	return bpf_link_create_verify(cmd);
63}
64
65SEC("fentry")
66int BPF_PROG(fentry_run)
67{
68	return 0;
69}
70
71char _license[] SEC("license") = "GPL";

 1// SPDX-License-Identifier: GPL-2.0
 2/* Copyright (C) 2023 Yafang Shao <laoar.shao@gmail.com> */
 3
 4#include "vmlinux.h"
 5#include <bpf/bpf_helpers.h>
 6#include <bpf/bpf_tracing.h>
 7#include <bpf/bpf_core_read.h>
 8
 9__u32 target_ancestor_level;
10__u64 target_ancestor_cgid;
11int target_pid, target_hid;
12
13struct cgroup *bpf_task_get_cgroup1(struct task_struct *task, int hierarchy_id) __ksym;
14struct cgroup *bpf_cgroup_ancestor(struct cgroup *cgrp, int level) __ksym;
15void bpf_cgroup_release(struct cgroup *cgrp) __ksym;
16
17static int bpf_link_create_verify(int cmd)
18{
19	struct cgroup *cgrp, *ancestor;
20	struct task_struct *task;
21	int ret = 0;
22
23	if (cmd != BPF_LINK_CREATE)
24		return 0;
25
26	task = bpf_get_current_task_btf();
27
28	/* Then it can run in parallel with others */
29	if (task->pid != target_pid)
30		return 0;
31
32	cgrp = bpf_task_get_cgroup1(task, target_hid);
33	if (!cgrp)
34		return 0;
35
36	/* Refuse it if its cgid or its ancestor's cgid is the target cgid */
37	if (cgrp->kn->id == target_ancestor_cgid)
38		ret = -1;
39
40	ancestor = bpf_cgroup_ancestor(cgrp, target_ancestor_level);
41	if (!ancestor)
42		goto out;
43
44	if (ancestor->kn->id == target_ancestor_cgid)
45		ret = -1;
46	bpf_cgroup_release(ancestor);
47
48out:
49	bpf_cgroup_release(cgrp);
50	return ret;
51}
52
53SEC("lsm/bpf")
54int BPF_PROG(lsm_run, int cmd, union bpf_attr *attr, unsigned int size)
55{
56	return bpf_link_create_verify(cmd);
57}
58
59SEC("lsm.s/bpf")
60int BPF_PROG(lsm_s_run, int cmd, union bpf_attr *attr, unsigned int size)
61{
62	return bpf_link_create_verify(cmd);
63}
64
65SEC("fentry")
66int BPF_PROG(fentry_run)
67{
68	return 0;
69}
70
71char _license[] SEC("license") = "GPL";