chore(modern_bpf): add fields to enum bpf_func_id

The added fields were added in newer kernels and can be used to check for access of some newer helpers. Signed-off-by: Mauro Ezequiel Moltrasio <[email protected]>
falcosecurity · Oct 3, 2024 · f96a41b · f96a41b
1 parent d3ef8ee
commit f96a41b
Show file tree

Hide file tree

Showing 4 changed files with 66 additions and 10 deletions.
diff --git a/driver/modern_bpf/definitions/aarch64/vmlinux.h b/driver/modern_bpf/definitions/aarch64/vmlinux.h
@@ -7538,7 +7538,38 @@ enum bpf_func_id {
 	BPF_FUNC_ktime_get_coarse_ns = 160,
 	BPF_FUNC_ima_inode_hash = 161,
 	BPF_FUNC_sock_from_file = 162,
-	__BPF_FUNC_MAX_ID = 163,
+	BPF_FUNC_check_mtu = 163,
+	BPF_FUNC_for_each_map_elem = 164,
+	BPF_FUNC_snprintf = 165,
+	BPF_FUNC_sys_bpf = 166,
+	BPF_FUNC_btf_find_by_name_kind = 167,
+	BPF_FUNC_sys_close = 168,
+	BPF_FUNC_timer_init = 169,
+	BPF_FUNC_timer_set_callback = 170,
+	BPF_FUNC_timer_start = 171,
+	BPF_FUNC_timer_cancel = 172,
+	BPF_FUNC_get_func_ip = 173,
+	BPF_FUNC_get_attach_cookie = 174,
+	BPF_FUNC_task_pt_regs = 175,
+	BPF_FUNC_get_branch_snapshot = 176,
+	BPF_FUNC_trace_vprintk = 177,
+	BPF_FUNC_skc_to_unix_sock = 178,
+	BPF_FUNC_kallsyms_lookup_name = 179,
+	BPF_FUNC_find_vma = 180,
+	BPF_FUNC_loop = 181,
+	BPF_FUNC_strncmp = 182,
+	BPF_FUNC_get_func_arg = 183,
+	BPF_FUNC_get_func_ret = 184,
+	BPF_FUNC_get_func_arg_cnt = 185,
+	BPF_FUNC_get_retval = 186,
+	BPF_FUNC_set_retval = 187,
+	BPF_FUNC_xdp_get_buff_len = 188,
+	BPF_FUNC_xdp_load_bytes = 189,
+	BPF_FUNC_xdp_store_bytes = 190,
+	BPF_FUNC_copy_from_user_task = 191,
+	BPF_FUNC_skb_set_tstamp = 192,
+	BPF_FUNC_ima_file_hash = 193,
+	__BPF_FUNC_MAX_ID = 194,
 };
 
 struct bpf_func_info {

diff --git a/driver/modern_bpf/definitions/x86_64/vmlinux.h b/driver/modern_bpf/definitions/x86_64/vmlinux.h
@@ -39754,7 +39754,38 @@ enum bpf_func_id {
 	BPF_FUNC_ktime_get_coarse_ns = 160,
 	BPF_FUNC_ima_inode_hash = 161,
 	BPF_FUNC_sock_from_file = 162,
-	__BPF_FUNC_MAX_ID = 163,
+	BPF_FUNC_check_mtu = 163,
+	BPF_FUNC_for_each_map_elem = 164,
+	BPF_FUNC_snprintf = 165,
+	BPF_FUNC_sys_bpf = 166,
+	BPF_FUNC_btf_find_by_name_kind = 167,
+	BPF_FUNC_sys_close = 168,
+	BPF_FUNC_timer_init = 169,
+	BPF_FUNC_timer_set_callback = 170,
+	BPF_FUNC_timer_start = 171,
+	BPF_FUNC_timer_cancel = 172,
+	BPF_FUNC_get_func_ip = 173,
+	BPF_FUNC_get_attach_cookie = 174,
+	BPF_FUNC_task_pt_regs = 175,
+	BPF_FUNC_get_branch_snapshot = 176,
+	BPF_FUNC_trace_vprintk = 177,
+	BPF_FUNC_skc_to_unix_sock = 178,
+	BPF_FUNC_kallsyms_lookup_name = 179,
+	BPF_FUNC_find_vma = 180,
+	BPF_FUNC_loop = 181,
+	BPF_FUNC_strncmp = 182,
+	BPF_FUNC_get_func_arg = 183,
+	BPF_FUNC_get_func_ret = 184,
+	BPF_FUNC_get_func_arg_cnt = 185,
+	BPF_FUNC_get_retval = 186,
+	BPF_FUNC_set_retval = 187,
+	BPF_FUNC_xdp_get_buff_len = 188,
+	BPF_FUNC_xdp_load_bytes = 189,
+	BPF_FUNC_xdp_store_bytes = 190,
+	BPF_FUNC_copy_from_user_task = 191,
+	BPF_FUNC_skb_set_tstamp = 192,
+	BPF_FUNC_ima_file_hash = 193,
+	__BPF_FUNC_MAX_ID = 194,
 };
 
 enum {

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c
@@ -9,8 +9,6 @@
 #include <helpers/interfaces/fixed_size_event.h>
 #include <helpers/interfaces/variable_size_event.h>
 
-extern int LINUX_KERNEL_VERSION __kconfig;
-
 /*=============================== ENTER EVENT ===========================*/
 
 SEC("tp_btf/sys_enter")
@@ -152,8 +150,7 @@ int BPF_PROG(recvmmsg_x, struct pt_regs *regs, long ret) {
 	        .ctx = ctx,
 	};
 
-	// TODO: Update vmlinux.h so we can test against BPF_FUNC_loop
-	if(LINUX_KERNEL_VERSION >= KERNEL_VERSION(5, 17, 0)) {
+	if(bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_loop)) {
 		uint32_t nr_loops = ret < 1024 ? ret : 1024;
 		bpf_loop(nr_loops, handle_exit, &data, 0);
 		return 0;

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c
@@ -9,8 +9,6 @@
 #include <helpers/interfaces/fixed_size_event.h>
 #include <helpers/interfaces/variable_size_event.h>
 
-extern int LINUX_KERNEL_VERSION __kconfig;
-
 /*=============================== ENTER EVENT ===========================*/
 
 SEC("tp_btf/sys_enter")
@@ -147,8 +145,7 @@ int BPF_PROG(sendmmsg_x, struct pt_regs *regs, long ret) {
 	        .ctx = ctx,
 	};
 
-	// TODO: Update vmlinux.h so we can test against BPF_FUNC_loop
-	if(LINUX_KERNEL_VERSION >= KERNEL_VERSION(5, 17, 0)) {
+	if(bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_loop)) {
 		uint32_t nr_loops = ret < 1024 ? ret : 1024;
 		bpf_loop(nr_loops, handle_exit, &data, 0);
 		return 0;