forked from falcosecurity/libs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathppm_tp.h
84 lines (70 loc) · 1.85 KB
/
ppm_tp.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
#pragma once
/* | name | path | */
#define TP_FIELDS \
X(SYS_ENTER, "sys_enter") \
X(SYS_EXIT, "sys_exit") \
X(SCHED_PROC_EXIT, "sched_process_exit") \
X(SCHED_SWITCH, "sched_switch") \
X(PAGE_FAULT_USER, "page_fault_user") \
X(PAGE_FAULT_KERN, "page_fault_kernel") \
X(SIGNAL_DELIVER, "signal_deliver") \
X(SCHED_PROC_FORK, "sched_process_fork") \
X(SCHED_PROC_EXEC, "sched_process_exec")
typedef enum {
#define X(name, path) name,
TP_FIELDS
#undef X
TP_VAL_MAX,
} ppm_tp_code;
extern const char *tp_names[];
#ifndef __KERNEL__
#include <stdbool.h>
typedef struct
{
bool tp[TP_VAL_MAX];
} interesting_ppm_tp_set;
void tp_set_from_sc_set(const bool *sc_set, bool *tp_set);
#ifdef SCAP_HANDLE_T
static int handle_ppm_sc_mask(SCAP_HANDLE_T *handle, bool *sc_set, bool enable, unsigned int ppm_sc,
int (*sc_enabler)(SCAP_HANDLE_T *handle, unsigned int sc, bool enable),
int (*tp_enabler)(SCAP_HANDLE_T *handle, ppm_tp_code tp, bool enable))
{
int ret = 0;
// Load initial tp_set
bool curr_tp_set[TP_VAL_MAX];
tp_set_from_sc_set(sc_set, curr_tp_set);
if (enable)
{
if(sc_set[ppm_sc])
{
// nothing to do
return ret;
}
sc_set[ppm_sc] = true;
}
else
{
if(!sc_set[ppm_sc])
{
// nothing to do
return ret;
}
sc_set[ppm_sc] = false;
}
// This won't do anything if the sc is a syscall
sc_enabler(handle, ppm_sc, enable);
// Load final tp_set -> note we must check this for syscalls too
// because we want to be able to enable/disable sys_{enter,exit} tracepoints dynamically.
bool final_tp_set[TP_VAL_MAX];
tp_set_from_sc_set(sc_set, final_tp_set);
for (int tp = 0; tp < TP_VAL_MAX && ret == 0; tp++)
{
if (curr_tp_set[tp] != final_tp_set[tp])
{
ret = tp_enabler(handle, tp, final_tp_set[tp]);
}
}
return ret;
}
#endif /* SCAP_HANDLE_T */
#endif /* __KERNEL__ */