forked from bpftrace/bpftrace
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathlockdown.cpp
More file actions
58 lines (49 loc) · 1.54 KB
/
Copy pathlockdown.cpp
File metadata and controls
58 lines (49 loc) · 1.54 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
#include <cerrno>
#include <fcntl.h>
#include <fstream>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/utsname.h>
#include <unistd.h>
#include "lockdown.h"
namespace bpftrace::lockdown {
static LockdownState from_string(const std::string &s)
{
if (s == "none")
return LockdownState::None;
else if (s == "integrity")
return LockdownState::Integrity;
else if (s == "confidentiality")
return LockdownState::Confidentiality;
return LockdownState::Unknown;
}
static LockdownState read_security_lockdown()
{
std::ifstream file("/sys/kernel/security/lockdown");
if (file.fail())
return LockdownState::Unknown;
// Format: none [integrity] confidentiality
// read one field at a time, if it starts with [ it's the one we want
while (!file.fail()) {
std::string field;
file >> field;
if (field[0] == '[')
return from_string(field.substr(1, field.length() - 2));
}
return LockdownState::Unknown;
}
void emit_warning(std::ostream &out)
{
// clang-format off
// these lines are ~80 chars wide in terminal
out << "Kernel lockdown is enabled and set to 'confidentiality'. Lockdown mode blocks" << std::endl
<< "parts of BPF which makes it impossible for bpftrace to function. Please see " << std::endl
<< "https://github.com/bpftrace/bpftrace/blob/master/INSTALL.md#disable-lockdown" << std::endl
<< "for more details on lockdown and how to disable it." << std::endl;
// clang-format on
}
LockdownState detect()
{
return read_security_lockdown();
}
} // namespace bpftrace::lockdown