| 1 | |
| 2 |
|
| 3 | |
| 4 | * Copyright (C) 2025 Microsoft Corporation
|
| 5 | *
|
| 6 | * Author: Blaise Boscaccy <[email protected]>
|
| 7 |
|
| 8 |
|
| 9 | #include "vmlinux.h"
|
| 10 | #include <errno.h>
|
| 11 | #include <bpf/bpf_helpers.h>
|
| 12 | #include <bpf/bpf_tracing.h>
|
| 13 |
|
| 14 | char _license[] SEC("license") = "GPL";
|
| 15 |
|
| 16 | __u32 monitored_tid;
|
| 17 |
|
| 18 | SEC("lsm.s/bpf")
|
| 19 | int BPF_PROG(bpf, int cmd, union bpf_attr *attr, unsigned int size, bool kernel)
|
| 20 | {
|
| 21 | __u32 tid;
|
| 22 |
|
| 23 | tid = bpf_get_current_pid_tgid() & 0xFFFFFFFF;
|
| 24 | if (!kernel || tid != monitored_tid)
|
| 25 | return 0;
|
| 26 | else
|
| 27 | return -EINVAL;
|
| 28 | }
|