95 lines
2.2 KiB
C
95 lines
2.2 KiB
C
// ©AngelaMos | 2026
|
|
// system_tracer.c
|
|
|
|
#include <uapi/linux/ptrace.h>
|
|
#include <linux/sched.h>
|
|
|
|
#define EVENT_PTRACE 12
|
|
#define EVENT_MOUNT 13
|
|
#define EVENT_INIT_MODULE 14
|
|
#define FILENAME_LEN 256
|
|
|
|
struct event {
|
|
u64 timestamp_ns;
|
|
u32 pid;
|
|
u32 ppid;
|
|
u32 uid;
|
|
u32 gid;
|
|
u32 event_type;
|
|
u32 flags;
|
|
char comm[TASK_COMM_LEN];
|
|
char filename[FILENAME_LEN];
|
|
u32 addr_v4;
|
|
u16 port;
|
|
u16 protocol;
|
|
u32 target_uid;
|
|
u32 target_gid;
|
|
u32 ptrace_request;
|
|
u32 target_pid;
|
|
};
|
|
|
|
BPF_RINGBUF_OUTPUT(events, 1 << 18);
|
|
|
|
static __always_inline void fill_base(struct event *e, u32 etype) {
|
|
u64 pid_tgid = bpf_get_current_pid_tgid();
|
|
u64 uid_gid = bpf_get_current_uid_gid();
|
|
struct task_struct *task = (struct task_struct *)bpf_get_current_task();
|
|
|
|
e->timestamp_ns = bpf_ktime_get_ns();
|
|
e->pid = pid_tgid >> 32;
|
|
e->uid = uid_gid & 0xFFFFFFFF;
|
|
e->gid = uid_gid >> 32;
|
|
e->event_type = etype;
|
|
e->flags = 0;
|
|
|
|
bpf_probe_read_kernel(&e->ppid, sizeof(e->ppid),
|
|
&task->real_parent->tgid);
|
|
bpf_get_current_comm(&e->comm, sizeof(e->comm));
|
|
__builtin_memset(e->filename, 0, sizeof(e->filename));
|
|
|
|
e->addr_v4 = 0;
|
|
e->port = 0;
|
|
e->protocol = 0;
|
|
e->target_uid = 0;
|
|
e->target_gid = 0;
|
|
e->ptrace_request = 0;
|
|
e->target_pid = 0;
|
|
}
|
|
|
|
TRACEPOINT_PROBE(syscalls, sys_enter_ptrace) {
|
|
struct event *e = events.ringbuf_reserve(sizeof(*e));
|
|
if (!e)
|
|
return 0;
|
|
|
|
fill_base(e, EVENT_PTRACE);
|
|
e->ptrace_request = args->request;
|
|
e->target_pid = args->pid;
|
|
|
|
events.ringbuf_submit(e, 0);
|
|
return 0;
|
|
}
|
|
|
|
TRACEPOINT_PROBE(syscalls, sys_enter_mount) {
|
|
struct event *e = events.ringbuf_reserve(sizeof(*e));
|
|
if (!e)
|
|
return 0;
|
|
|
|
fill_base(e, EVENT_MOUNT);
|
|
bpf_probe_read_user_str(e->filename, sizeof(e->filename),
|
|
args->dev_name);
|
|
|
|
events.ringbuf_submit(e, 0);
|
|
return 0;
|
|
}
|
|
|
|
TRACEPOINT_PROBE(syscalls, sys_enter_init_module) {
|
|
struct event *e = events.ringbuf_reserve(sizeof(*e));
|
|
if (!e)
|
|
return 0;
|
|
|
|
fill_base(e, EVENT_INIT_MODULE);
|
|
|
|
events.ringbuf_submit(e, 0);
|
|
return 0;
|
|
}
|