0
#!/usr/bin/env python3
from bcc import BPF

BPF_PROGRAM = """
#include <linux/fs.h>
#include <linux/fs_struct.h>
#include <linux/errno.h>

#define __LOWER(x) (x & 0xffffffff)
#define __UPPER(x) (x >> 32)
#define MAX_SIZE 256


LSM_PROBE(bprm_check_security, struct linux_binprm *bprm) {{
    u64 times_ret;
    char dest[MAX_SIZE];

    times_ret = krsi_get_env_var(ctx, "LD_PRELOAD", 11, dest, MAX_SIZE);

    // Handle errors (lower 32-bits have the error code)
    if (_UPPER(times_ret) > 1)
        return EPERM;

    return 0;
}
"""

b = BPF(text=BPF_PROGRAM)
print("BPF program loaded")

while True:
    try:
        b.trace_print()
    except KeyboardInterrupt:
        break

I try to get the environment var LD_PRELOAD but I get error: warning: implicit declaration of function 'krsi_get_env_var' is invalid in C99 [-Wimplicit-function-declaration] times_ret = krsi_get_env_var(ctx, "LD_PRELOAD", 11, dest, MAX_SIZE);

warning: implicit declaration of function '_UPPER' is invalid in C99 [-Wimplicit-function-declaration] if (_UPPER(times_ret) > 1)

I try to get anther function but I don't find one

0 Answers0