On Thu, 26 Mar 2020, KP Singh wrote:

From: KP Singh <redacted>

* Load/attach a BPF program that hooks to file_mprotect (int)
  and bprm_committed_creds (void).
* Perform an action that triggers the hook.
* Verify if the audit event was received using the shared global
  variables for the process executed.
* Verify if the mprotect returns a -EPERM.

Signed-off-by: KP Singh <redacted>
Reviewed-by: Brendan Jackman <jackmanb@google.com>
Reviewed-by: Florent Revest <redacted>
Reviewed-by: Thomas Garnier <redacted>

Cool stuff!

Reviewed-by: James Morris <redacted>


-- 
James Morris
[off-list ref]