20 lines
420 B
C
20 lines
420 B
C
#include "vmlinux.h"
|
|
#include <bpf/bpf_core_read.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
|
|
char LICENSE[] SEC("license") = "GPL";
|
|
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_RINGBUF);
|
|
__uint(max_entries, 256 * 1024);
|
|
} rb SEC(".maps");
|
|
|
|
#define EPERM 1
|
|
|
|
SEC("fmod_ret/__x64_sys_setuid")
|
|
long BPF_PROG(handle_setuid, struct pt_regs *regs, int ret)
|
|
{
|
|
// Block the setuid call
|
|
return -EPERM;
|
|
}
|