mirror of https://github.com/aya-rs/aya
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.1 KiB
Rust
63 lines
2.1 KiB
Rust
use core::ffi::c_void;
|
|
|
|
use crate::{args::FromBtfArgument, BpfContext};
|
|
|
|
pub struct LsmContext {
|
|
ctx: *mut c_void,
|
|
}
|
|
|
|
impl LsmContext {
|
|
pub fn new(ctx: *mut c_void) -> LsmContext {
|
|
LsmContext { ctx }
|
|
}
|
|
|
|
/// Returns the `n`th argument passed to the LSM hook, starting from 0.
|
|
///
|
|
/// You can refer to [the kernel's list of LSM hook definitions][1] to find the
|
|
/// appropriate argument list for your LSM hook, where the argument list starts
|
|
/// _after_ the third parameter to the kernel's `LSM_HOOK` macro.
|
|
///
|
|
/// LSM probes specifically have access to an additional argument `retval: int`
|
|
/// which provides the return value of the previous LSM program that was called on
|
|
/// this code path, or 0 if this is the first LSM program to be called. This phony
|
|
/// argument is always last in the argument list.
|
|
///
|
|
/// SAFETY: This function is deeply unsafe, as we are reading raw pointers into kernel memory.
|
|
/// In particular, the value of `n` must not exceed the number of function arguments.
|
|
/// Luckily, the BPF verifier will catch this for us.
|
|
///
|
|
/// # Examples
|
|
///
|
|
/// ```no_run
|
|
/// # #![allow(dead_code)]
|
|
/// # use aya_bpf::{programs::LsmContext, cty::{c_int, c_ulong}};
|
|
/// unsafe fn try_lsm_mmap_addr(ctx: LsmContext) -> Result<i32, i32> {
|
|
/// // In the kernel, this hook is defined as:
|
|
/// // LSM_HOOK(int, 0, mmap_addr, unsigned long addr)
|
|
/// let addr: c_ulong = ctx.arg(0);
|
|
/// let retval: c_int = ctx.arg(1);
|
|
///
|
|
/// // You can then do stuff with addr and retval down here.
|
|
///
|
|
/// // To practice good LSM hygiene, let's defer to a previous retval
|
|
/// // if available:
|
|
/// if (retval != 0) {
|
|
/// return Ok(retval);
|
|
/// }
|
|
///
|
|
/// Ok(0)
|
|
/// }
|
|
/// ```
|
|
///
|
|
/// [1]: https://elixir.bootlin.com/linux/latest/source/include/linux/lsm_hook_defs.h
|
|
pub unsafe fn arg<T: FromBtfArgument>(&self, n: usize) -> T {
|
|
T::from_argument(self.ctx as *const _, n)
|
|
}
|
|
}
|
|
|
|
impl BpfContext for LsmContext {
|
|
fn as_ptr(&self) -> *mut c_void {
|
|
self.ctx
|
|
}
|
|
}
|