1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
ELF � p3 @ @ @ .strtab .symtab .text lsm/bprm_check_security lsm/file_open lsm/file_permission lsm/file_truncate lsm/path_truncate lsm/path_unlink lsm/path_rename lsm/socket_connect tp/sched/sched_process_fork tp/sched/sched_process_exec tp/sched/sched_process_exit tp/syscalls/sys_enter_openat tp/syscalls/sys_exit_openat tp/syscalls/sys_enter_open tp/syscalls/sys_exit_open tp/syscalls/sys_enter_openat2 tp/syscalls/sys_exit_openat2 tp/syscalls/sys_enter_creat tp/syscalls/sys_exit_creat tp/syscalls/sys_enter_truncate tp/syscalls/sys_exit_truncate tp/syscalls/sys_enter_unlink tp/syscalls/sys_enter_unlinkat tp/syscalls/sys_enter_rename tp/syscalls/sys_enter_renameat tp/syscalls/sys_enter_renameat2 tp/syscalls/sys_enter_connect .rodata license .maps process.bpf.c LBB0_22 LBB0_5 LBB0_6 LBB0_8 te_check_labels LBB0_21 LBB0_12 LBB0_18 LBB0_15 LBB0_17 LBB1_63 LBB1_5 LBB1_4 LBB1_62 LBB1_7 LBB1_12 LBB1_9 LBB1_11 LBB1_14 LBB1_16 LBB1_20 LBB1_18 te_file_src LBB1_27 LBB1_23 LBB1_25 LBB1_28 LBB1_40 LBB1_31 LBB1_37 LBB1_34 LBB1_36 LBB1_50 LBB1_43 LBB1_45 LBB1_46 te_inval_hits LBB1_49 te_tick te_stamp LBB1_53 LBB1_56 LBB1_58 LBB1_61 LBB2_64 LBB2_6 LBB2_5 LBB2_63 LBB2_8 LBB2_13 LBB2_10 LBB2_12 LBB2_15 LBB2_17 LBB2_21 LBB2_19 LBB2_28 LBB2_24 LBB2_26 LBB2_29 LBB2_41 LBB2_32 LBB2_38 LBB2_35 LBB2_37 LBB2_51 LBB2_44 LBB2_46 LBB2_47 LBB2_50 LBB2_54 LBB2_57 LBB2_59 LBB2_62 LBB3_38 LBB3_5 LBB3_4 LBB3_37 LBB3_7 LBB3_11 LBB3_8 LBB3_10 LBB3_13 LBB3_26 LBB3_17 LBB3_23 LBB3_20 LBB3_22 LBB3_28 LBB3_31 LBB3_33 LBB3_36 LBB4_34 LBB4_4 LBB4_8 LBB4_5 LBB4_7 LBB4_10 LBB4_23 LBB4_14 LBB4_20 LBB4_17 LBB4_19 LBB4_25 LBB4_28 LBB4_30 LBB4_33 LBB5_49 LBB5_17 LBB5_5 LBB5_7 LBB5_8 LBB5_12 LBB5_13 LBB5_16 LBB5_19 LBB5_23 LBB5_20 LBB5_22 LBB5_25 LBB5_38 LBB5_29 LBB5_35 LBB5_32 LBB5_34 LBB5_40 LBB5_43 LBB5_45 LBB5_48 LBB6_51 LBB6_17 LBB6_5 LBB6_7 LBB6_8 LBB6_12 LBB6_13 LBB6_16 LBB6_19 LBB6_24 LBB6_21 LBB6_23 LBB6_26 LBB6_39 LBB6_30 LBB6_36 LBB6_33 LBB6_35 LBB6_89 LBB6_88 LBB6_41 LBB6_50 LBB6_44 LBB6_46 LBB6_49 LBB6_102 LBB6_68 LBB6_56 LBB6_58 LBB6_59 LBB6_63 LBB6_64 LBB6_67 LBB6_70 LBB6_74 LBB6_71 LBB6_73 LBB6_76 LBB6_90 LBB6_80 LBB6_86 LBB6_83 LBB6_85 LBB6_92 LBB6_101 LBB6_95 LBB6_97 LBB6_100 LBB7_29 LBB7_4 LBB7_5 LBB7_7 te_endp_src_ip te_connect_check_labels LBB7_20 LBB7_11 LBB7_17 LBB7_14 LBB7_16 LBB7_22 LBB7_23 LBB7_28 LBB7_27 LBB8_2 LBB8_4 te_exec_update LBB9_7 LBB9_6 LBB9_4 te_tok_cb LBB9_20 LBB9_10 LBB9_12 LBB9_18 LBB9_15 LBB9_17 LBB10_2 te_exec_src_cb LBB10_4 te_exec_xform_cb LBB10_6 te_exec_gate_cb LBB10_8 LBB10_12 LBB10_11 LBB11_2 LBB13_55 LBB13_54 LBB13_5 LBB13_7 LBB13_9 LBB13_11 LBB13_15 LBB13_13 LBB13_22 LBB13_18 LBB13_20 LBB13_23 LBB13_32 LBB13_24 LBB13_30 LBB13_27 LBB13_29 LBB13_42 LBB13_35 LBB13_37 LBB13_38 LBB13_41 LBB13_45 LBB13_48 LBB13_50 LBB13_53 LBB15_55 LBB15_54 LBB15_5 LBB15_7 LBB15_9 LBB15_11 LBB15_15 LBB15_13 LBB15_22 LBB15_18 LBB15_20 LBB15_23 LBB15_32 LBB15_24 LBB15_30 LBB15_27 LBB15_29 LBB15_42 LBB15_35 LBB15_37 LBB15_38 LBB15_41 LBB15_45 LBB15_48 LBB15_50 LBB15_53 LBB17_55 LBB17_54 LBB17_5 LBB17_7 LBB17_9 LBB17_11 LBB17_15 LBB17_13 LBB17_22 LBB17_18 LBB17_20 LBB17_23 LBB17_32 LBB17_24 LBB17_30 LBB17_27 LBB17_29 LBB17_42 LBB17_35 LBB17_37 LBB17_38 LBB17_41 LBB17_45 LBB17_48 LBB17_50 LBB17_53 LBB19_55 LBB19_54 LBB19_5 LBB19_7 LBB19_9 LBB19_11 LBB19_15 LBB19_13 LBB19_22 LBB19_18 LBB19_20 LBB19_23 LBB19_32 LBB19_24 LBB19_30 LBB19_27 LBB19_29 LBB19_42 LBB19_35 LBB19_37 LBB19_38 LBB19_41 LBB19_45 LBB19_48 LBB19_50 LBB19_53 LBB21_55 LBB21_54 LBB21_5 LBB21_7 LBB21_9 LBB21_11 LBB21_15 LBB21_13 LBB21_22 LBB21_18 LBB21_20 LBB21_23 LBB21_32 LBB21_24 LBB21_30 LBB21_27 LBB21_29 LBB21_42 LBB21_35 LBB21_37 LBB21_38 LBB21_41 LBB21_45 LBB21_48 LBB21_50 LBB21_53 LBB22_28 LBB22_3 LBB22_5 LBB22_7 LBB22_17 LBB22_9 LBB22_15 LBB22_12 LBB22_14 LBB22_19 LBB22_22 LBB22_24 LBB22_27 LBB23_28 LBB23_3 LBB23_5 LBB23_7 LBB23_17 LBB23_9 LBB23_15 LBB23_12 LBB23_14 LBB23_19 LBB23_22 LBB23_24 LBB23_27 LBB24_28 LBB24_3 LBB24_5 LBB24_7 LBB24_17 LBB24_9 LBB24_15 LBB24_12 LBB24_14 LBB24_19 LBB24_22 LBB24_24 LBB24_27 LBB25_28 LBB25_3 LBB25_5 LBB25_7 LBB25_17 LBB25_9 LBB25_15 LBB25_12 LBB25_14 LBB25_19 LBB25_22 LBB25_24 LBB25_27 LBB26_28 LBB26_3 LBB26_5 LBB26_7 LBB26_17 LBB26_9 LBB26_15 LBB26_12 LBB26_14 LBB26_19 LBB26_22 LBB26_24 LBB26_27 LBB27_25 LBB27_4 LBB27_5 LBB27_7 LBB27_17 LBB27_9 LBB27_15 LBB27_12 LBB27_14 LBB27_19 LBB27_20 LBB27_24 LBB28_11 LBB28_10 LBB28_9 LBB28_6 LBB28_7 taint_prefix LBB28_8 taint_suffix taint_streq LBB29_12 LBB29_8 LBB29_5 LBB29_6 LBB29_7 LBB29_11 LBB29_10 LBB30_10 LBB30_8 LBB30_5 LBB30_6 LBB30_7 LBB30_9 LBB31_2 te_inval_cb LBB32_11 LBB32_4 LBB32_6 LBB32_8 LBB32_10 LBB33_2 LBB33_5 LBB33_4 LBB33_6 LBB34_1 LBB34_2 LBB34_4 LBB34_6 LBB35_1 LBB35_15 LBB35_12 LBB35_6 LBB35_8 LBB35_9 LBB35_14 LBB35_10 LBB36_1 LBB36_2 LBB36_4 LBB37_11 LBB37_10 LBB37_9 LBB37_6 LBB37_7 LBB37_8 LBB38_11 LBB38_4 LBB38_10 LBB39_2 te_endp_src_cb LBB40_2 te_rule_cb LBB40_4 LBB41_2 te_conn_rule_cb LBB41_4 LBB42_2 te_file_src_cb LBB43_11 LBB43_10 LBB43_9 LBB43_6 LBB43_7 LBB43_8 LBB44_5 LBB44_4 te_rule_effect LBB45_5 LBB45_3 LBB45_4 LBB46_39 LBB46_5 LBB46_15 LBB46_11 LBB46_12 LBB46_13 LBB46_19 taint_arg_match LBB46_38 LBB46_25 LBB46_26 LBB46_37 te_after_satisfied LBB46_34 LBB46_30 LBB46_31 LBB46_32 LBB46_33 LBB46_36 LBB47_2 LBB47_9 LBB47_4 LBB47_3 LBB47_7 LBB47_6 LBB48_2 LBB48_6 LBB48_7 LBB48_5 LBB48_10 LBB48_15 LBB48_16 LBB48_11 LBB49_21 LBB49_5 LBB49_14 LBB49_13 LBB49_17 LBB49_16 LBB49_19 LBB49_20 enforce_bprm_check_security enforce_mode ts_proc rb enforce_file_open ts_file ts_root enforce_file_permission enforce_file_truncate enforce_path_truncate enforce_path_unlink enforce_path_rename enforce_socket_connect ts_endp handle_fork handle_exec ts_argslots ts_counts handle_exit trace_openat ts_openpend trace_openat_exit trace_open trace_open_exit trace_openat2 trace_openat2_exit trace_creat trace_creat_exit trace_truncate trace_truncate_exit trace_unlink trace_unlinkat trace_rename trace_renameat trace_renameat2 trace_connect taint_sources taint_xforms taint_gates ts_sess ts_sess_zero taint_invals taint_rules n_sources n_rules n_xforms n_gates n_invals LICENSE .rel.text .rellsm/bprm_check_security .rellsm/file_open .rellsm/file_permission .rellsm/file_truncate .rellsm/path_truncate .rellsm/path_unlink .rellsm/path_rename .rellsm/socket_connect .reltp/sched/sched_process_fork .reltp/sched/sched_process_exec .reltp/sched/sched_process_exit .reltp/syscalls/sys_enter_openat .reltp/syscalls/sys_exit_openat .reltp/syscalls/sys_enter_open .reltp/syscalls/sys_exit_open .reltp/syscalls/sys_enter_openat2 .reltp/syscalls/sys_exit_openat2 .reltp/syscalls/sys_enter_creat .reltp/syscalls/sys_exit_creat .reltp/syscalls/sys_enter_truncate .reltp/syscalls/sys_exit_truncate .reltp/syscalls/sys_enter_unlink .reltp/syscalls/sys_enter_unlinkat .reltp/syscalls/sys_enter_rename .reltp/syscalls/sys_enter_renameat .reltp/syscalls/sys_enter_renameat2 .reltp/syscalls/sys_enter_connect .BTF .BTF.ext � �� � � � p � 8 � � ( p 0 � 8 p @ H P H W @ ^ f p m � u � | � � h � 0 � @ � p � � � � � � � � X � � � � � � � � � ( � � H
�
0 � � & � . �
6 P h ? � G � O @
W �
_ � g X n H u H } � � � � � � � h � ( � 8 � p � � � � � � @ � � � x � � � x � � 8
�
$ � , x 4 � < 0
D �
L P T � [ � b H j q � y 8 � � � � � P � � � � � � � � � � 0 � � � � � � � � � � � � � � � ` � ` p X $ � , ( 4 � < � D @ L �
T x \ � c 8 j @ q � y � � h � � � � � � � p � � � p � � � h � � 8 � � � � � P
�
�
�
h
p
� &
.
� 6
� >
P F
N
H V
� ^
� f
� n
� v
� ~
P �
� �
p �
` �
�
�
� �
�
p
�
� �
P �
� �
�
�
�
�
�
�
@ �
h
�
�
�
H '
� /
H 7
X ?
@ G
� O
W
x `
h h
� p
y 8 � � � � � 8 � � � � � � � � H � 8 � H � � � � � P � 0 � � �
� "
( )
� 0
� 7 � � A
� I
� Q
� Y
� a
� i
H q � y � � � � X � � � � � � ( � x � 8 � � � � � � � � � � � `
P
)
� 2
� ;
8 D
� M
X V
p _
X h
� q
� z
� �
h �
� �
@ �
�
p
�
�
�
�
� �
� �
� �
� �
` �
�
�
P � � " 8 + � 4 X = p F X O � X � a � j h s � | @ �
� p
� �
� � � � � � � � � � ` � � � P � � � � 8 � X $ p - X 6 � ? � H � Q h Z � c @ l
u p
~ �
� � � � � � � � � � ` � � � P � � � � � � 8 � �
X
p
X
� &
� /
� 8
h A
� J
@ S
\
p
e
�
n
w
� �
� �
� �
� �
` �
�
�
P �
�
� �
� �
8 �
� �
X �
p �
X �
� � h ( � 1 @ :
C p
L �
U ^ � g o h w � � � � � � � � � 8 � @ � � � � � P � � � � h � � � � � � �
� 8 @ % � . � 7 P @ � I Q h Y � a � j � r � { � � 8 � @ � � � � � P � � � � h � � � � � � � � � � � 8 � @ � � P " � + 3 h ; � C � L � T � ] � f 8 o @ x � � � � P � � � � � � � H � 0 � ( � � ( � � � � � � � � P H
( � � % � � 2 : � � G ` � S \ � d � l � t � | � � � � � p � @ � P � X � � � � � � �
� 8
�
� �
� h
� �
�
@ � � % x - � 5 � = � E �
N X W 8 _ X g � o � x @ � p � � � � � � � � � � � ` � � � � � p � � � ` � � � � � � � �( � � 02 � / 7 p ? � � N � W � ` ` h p 0 x @ � x( � p( � p) � � `) � ) � X) � P/