Cybersecurity-Projects/PROJECTS/beginner/linux-ebpf-security-tracer/src/ebpf/system_tracer.c

95 lines
2.2 KiB
C

// ©AngelaMos | 2026
// system_tracer.c
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>
#define EVENT_PTRACE 12
#define EVENT_MOUNT 13
#define EVENT_INIT_MODULE 14
#define FILENAME_LEN 256
struct event {
u64 timestamp_ns;
u32 pid;
u32 ppid;
u32 uid;
u32 gid;
u32 event_type;
u32 flags;
char comm[TASK_COMM_LEN];
char filename[FILENAME_LEN];
u32 addr_v4;
u16 port;
u16 protocol;
u32 target_uid;
u32 target_gid;
u32 ptrace_request;
u32 target_pid;
};
BPF_RINGBUF_OUTPUT(events, 1 << 18);
static __always_inline void fill_base(struct event *e, u32 etype) {
u64 pid_tgid = bpf_get_current_pid_tgid();
u64 uid_gid = bpf_get_current_uid_gid();
struct task_struct *task = (struct task_struct *)bpf_get_current_task();
e->timestamp_ns = bpf_ktime_get_ns();
e->pid = pid_tgid >> 32;
e->uid = uid_gid & 0xFFFFFFFF;
e->gid = uid_gid >> 32;
e->event_type = etype;
e->flags = 0;
bpf_probe_read_kernel(&e->ppid, sizeof(e->ppid),
&task->real_parent->tgid);
bpf_get_current_comm(&e->comm, sizeof(e->comm));
__builtin_memset(e->filename, 0, sizeof(e->filename));
e->addr_v4 = 0;
e->port = 0;
e->protocol = 0;
e->target_uid = 0;
e->target_gid = 0;
e->ptrace_request = 0;
e->target_pid = 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_ptrace) {
struct event *e = events.ringbuf_reserve(sizeof(*e));
if (!e)
return 0;
fill_base(e, EVENT_PTRACE);
e->ptrace_request = args->request;
e->target_pid = args->pid;
events.ringbuf_submit(e, 0);
return 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_mount) {
struct event *e = events.ringbuf_reserve(sizeof(*e));
if (!e)
return 0;
fill_base(e, EVENT_MOUNT);
bpf_probe_read_user_str(e->filename, sizeof(e->filename),
args->dev_name);
events.ringbuf_submit(e, 0);
return 0;
}
TRACEPOINT_PROBE(syscalls, sys_enter_init_module) {
struct event *e = events.ringbuf_reserve(sizeof(*e));
if (!e)
return 0;
fill_base(e, EVENT_INIT_MODULE);
events.ringbuf_submit(e, 0);
return 0;
}