BPF Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v16 0/5]  BPF: New helper to obtain namespace data from current task
@ 2019-12-18 17:38 Carlos Neira
  2019-12-18 17:38 ` [PATCH v16 1/5] fs/nsfs.c: added ns_match Carlos Neira
                   ` (5 more replies)
  0 siblings, 6 replies; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
scripts but this helper returns the pid as seen by the root namespace which is
fine when a bcc script is not executed inside a container.
When the process of interest is inside a container, pid filtering will not work
if bpf_get_current_pid_tgid() is used.
This helper addresses this limitation returning the pid as it's seen by the current
namespace where the script is executing.

In the future different pid_ns files may belong to different devices, according to the
discussion between Eric Biederman and Yonghong in 2017 Linux plumbers conference.
To address that situation the helper requires inum and dev_t from /proc/self/ns/pid.
This helper has the same use cases as bpf_get_current_pid_tgid() as it can be
used to do pid filtering even inside a container.

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>


Carlos Neira (5):
  fs/nsfs.c: added ns_match
  bpf: added new helper bpf_get_ns_current_pid_tgid
  tools: Added bpf_get_ns_current_pid_tgid helper
  tools/testing/selftests/bpf: Add self-tests for new helper
    bpf_get_ns_current_pid_tgid.
  bpf_helpers_doc.py: Add struct bpf_pidns_info to known types

 fs/nsfs.c                                     | 14 +++
 include/linux/bpf.h                           |  1 +
 include/linux/proc_ns.h                       |  2 +
 include/uapi/linux/bpf.h                      | 19 +++-
 kernel/bpf/core.c                             |  1 +
 kernel/bpf/helpers.c                          | 45 ++++++++++
 kernel/trace/bpf_trace.c                      |  2 +
 scripts/bpf_helpers_doc.py                    |  1 +
 tools/include/uapi/linux/bpf.h                | 19 +++-
 .../bpf/prog_tests/ns_current_pid_tgid.c      | 88 +++++++++++++++++++
 .../bpf/progs/test_ns_current_pid_tgid.c      | 37 ++++++++
 11 files changed, 227 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c

-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v16 1/5] fs/nsfs.c: added ns_match
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
@ 2019-12-18 17:38 ` Carlos Neira
  2019-12-19 18:45   ` Yonghong Song
  2019-12-18 17:38 ` [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid Carlos Neira
                   ` (4 subsequent siblings)
  5 siblings, 1 reply; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

ns_match returns true if the namespace inode and dev_t matches the ones
provided by the caller.

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
---
 fs/nsfs.c               | 14 ++++++++++++++
 include/linux/proc_ns.h |  2 ++
 2 files changed, 16 insertions(+)

diff --git a/fs/nsfs.c b/fs/nsfs.c
index a0431642c6b5..ef59cf347285 100644
--- a/fs/nsfs.c
+++ b/fs/nsfs.c
@@ -245,6 +245,20 @@ struct file *proc_ns_fget(int fd)
 	return ERR_PTR(-EINVAL);
 }
 
+/**
+ * ns_match() - Returns true if current namespace matches dev/ino provided.
+ * @ns_common: current ns
+ * @dev: dev_t from nsfs that will be matched against current nsfs
+ * @ino: ino_t from nsfs that will be matched against current nsfs
+ *
+ * Return: true if dev and ino matches the current nsfs.
+ */
+bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
+{
+	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
+}
+
+
 static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
 {
 	struct inode *inode = d_inode(dentry);
diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h
index d31cb6215905..1da9f33489f3 100644
--- a/include/linux/proc_ns.h
+++ b/include/linux/proc_ns.h
@@ -82,6 +82,8 @@ typedef struct ns_common *ns_get_path_helper_t(void *);
 extern void *ns_get_path_cb(struct path *path, ns_get_path_helper_t ns_get_cb,
 			    void *private_data);
 
+extern bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino);
+
 extern int ns_get_name(char *buf, size_t size, struct task_struct *task,
 			const struct proc_ns_operations *ns_ops);
 extern void nsfs_init(void);
-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
  2019-12-18 17:38 ` [PATCH v16 1/5] fs/nsfs.c: added ns_match Carlos Neira
@ 2019-12-18 17:38 ` Carlos Neira
  2019-12-19 18:31   ` Yonghong Song
  2019-12-18 17:38 ` [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper Carlos Neira
                   ` (3 subsequent siblings)
  5 siblings, 1 reply; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

New bpf helper bpf_get_ns_current_pid_tgid,
This helper will return pid and tgid from current task
which namespace matches dev_t and inode number provided,
this will allows us to instrument a process inside a container.

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
---
 include/linux/bpf.h      |  1 +
 include/uapi/linux/bpf.h | 19 ++++++++++++++++-
 kernel/bpf/core.c        |  1 +
 kernel/bpf/helpers.c     | 45 ++++++++++++++++++++++++++++++++++++++++
 kernel/trace/bpf_trace.c |  2 ++
 5 files changed, 67 insertions(+), 1 deletion(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 35903f148be5..a40b3e13cf98 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1224,6 +1224,7 @@ extern const struct bpf_func_proto bpf_get_local_storage_proto;
 extern const struct bpf_func_proto bpf_strtol_proto;
 extern const struct bpf_func_proto bpf_strtoul_proto;
 extern const struct bpf_func_proto bpf_tcp_sock_proto;
+extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto;
 
 /* Shared helpers among cBPF and eBPF. */
 void bpf_user_rnd_init_once(void);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index dbbcf0b02970..75864cd91b50 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -2821,6 +2821,18 @@ union bpf_attr {
  * 	Return
  * 		On success, the strictly positive length of the string,	including
  * 		the trailing NUL character. On error, a negative value.
+ * int bpf_get_ns_current_pid_tgid(u64 dev, u64 ino, struct bpf_pidns_info *nsdata, u32 size)
+ *	Description
+ *		Returns 0 on success, values for *pid* and *tgid* as seen from the current
+ *		*namespace* will be returned in *nsdata*.
+ *
+ *		On failure, the returned value is one of the following:
+ *
+ *		**-EINVAL** if dev and inum supplied don't match dev_t and inode number
+ *              with nsfs of current task, or if dev conversion to dev_t lost high bits.
+ *
+ *		**-ENOENT** if pidns does not exists for the current task.
+ *
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -2938,7 +2950,8 @@ union bpf_attr {
 	FN(probe_read_user),		\
 	FN(probe_read_kernel),		\
 	FN(probe_read_user_str),	\
-	FN(probe_read_kernel_str),
+	FN(probe_read_kernel_str),	\
+	FN(get_ns_current_pid_tgid),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -3689,4 +3702,8 @@ struct bpf_sockopt {
 	__s32	retval;
 };
 
+struct bpf_pidns_info {
+	__u32 pid;
+	__u32 tgid;
+};
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 49e32acad7d8..59b892ab2acb 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2145,6 +2145,7 @@ const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak;
 const struct bpf_func_proto bpf_get_current_comm_proto __weak;
 const struct bpf_func_proto bpf_get_current_cgroup_id_proto __weak;
 const struct bpf_func_proto bpf_get_local_storage_proto __weak;
+const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto __weak;
 
 const struct bpf_func_proto * __weak bpf_get_trace_printk_proto(void)
 {
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index cada974c9f4e..4aea086c20e5 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -11,6 +11,8 @@
 #include <linux/uidgid.h>
 #include <linux/filter.h>
 #include <linux/ctype.h>
+#include <linux/pid_namespace.h>
+#include <linux/proc_ns.h>
 
 #include "../../lib/kstrtox.h"
 
@@ -487,3 +489,46 @@ const struct bpf_func_proto bpf_strtoul_proto = {
 	.arg4_type	= ARG_PTR_TO_LONG,
 };
 #endif
+
+BPF_CALL_4(bpf_get_ns_current_pid_tgid, u64, dev, u64, ino,
+	   struct bpf_pidns_info *, nsdata, u32, size)
+{
+	struct task_struct *task = current;
+	struct pid_namespace *pidns;
+	int err = -EINVAL;
+
+	if (unlikely(size != sizeof(struct bpf_pidns_info)))
+		goto clear;
+
+	if (unlikely((u64)(dev_t)dev != dev))
+		goto clear;
+
+	if (unlikely(!task))
+		goto clear;
+
+	pidns = task_active_pid_ns(task);
+	if (unlikely(!pidns)) {
+		err = -ENOENT;
+		goto clear;
+	}
+
+	if (!ns_match(&pidns->ns, (dev_t)dev, ino))
+		goto clear;
+
+	nsdata->pid = task_pid_nr_ns(task, pidns);
+	nsdata->tgid = task_tgid_nr_ns(task, pidns);
+	return 0;
+clear:
+	memset((void *)nsdata, 0, (size_t) size);
+	return err;
+}
+
+const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto = {
+	.func		= bpf_get_ns_current_pid_tgid,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_ANYTHING,
+	.arg2_type	= ARG_ANYTHING,
+	.arg3_type      = ARG_PTR_TO_UNINIT_MEM,
+	.arg4_type      = ARG_CONST_SIZE,
+};
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index e5ef4ae9edb5..8c931cd1a768 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -822,6 +822,8 @@ tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 #endif
 	case BPF_FUNC_send_signal:
 		return &bpf_send_signal_proto;
+	case BPF_FUNC_get_ns_current_pid_tgid:
+		return &bpf_get_ns_current_pid_tgid_proto;
 	default:
 		return NULL;
 	}
-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
  2019-12-18 17:38 ` [PATCH v16 1/5] fs/nsfs.c: added ns_match Carlos Neira
  2019-12-18 17:38 ` [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid Carlos Neira
@ 2019-12-18 17:38 ` Carlos Neira
  2019-12-19 18:31   ` Yonghong Song
  2019-12-18 17:38 ` [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid Carlos Neira
                   ` (2 subsequent siblings)
  5 siblings, 1 reply; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

sync tools/include/uapi/linux/bpf.h to include new helper.

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
---
 tools/include/uapi/linux/bpf.h | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index dbbcf0b02970..75864cd91b50 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -2821,6 +2821,18 @@ union bpf_attr {
  * 	Return
  * 		On success, the strictly positive length of the string,	including
  * 		the trailing NUL character. On error, a negative value.
+ * int bpf_get_ns_current_pid_tgid(u64 dev, u64 ino, struct bpf_pidns_info *nsdata, u32 size)
+ *	Description
+ *		Returns 0 on success, values for *pid* and *tgid* as seen from the current
+ *		*namespace* will be returned in *nsdata*.
+ *
+ *		On failure, the returned value is one of the following:
+ *
+ *		**-EINVAL** if dev and inum supplied don't match dev_t and inode number
+ *              with nsfs of current task, or if dev conversion to dev_t lost high bits.
+ *
+ *		**-ENOENT** if pidns does not exists for the current task.
+ *
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -2938,7 +2950,8 @@ union bpf_attr {
 	FN(probe_read_user),		\
 	FN(probe_read_kernel),		\
 	FN(probe_read_user_str),	\
-	FN(probe_read_kernel_str),
+	FN(probe_read_kernel_str),	\
+	FN(get_ns_current_pid_tgid),
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
  * function eBPF program intends to call
@@ -3689,4 +3702,8 @@ struct bpf_sockopt {
 	__s32	retval;
 };
 
+struct bpf_pidns_info {
+	__u32 pid;
+	__u32 tgid;
+};
 #endif /* _UAPI__LINUX_BPF_H__ */
-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid.
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
                   ` (2 preceding siblings ...)
  2019-12-18 17:38 ` [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper Carlos Neira
@ 2019-12-18 17:38 ` Carlos Neira
  2019-12-19 18:40   ` Yonghong Song
  2019-12-18 17:38 ` [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types Carlos Neira
  2020-01-10  1:46 ` [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Alexei Starovoitov
  5 siblings, 1 reply; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

Self tests added for new helper bpf_get_ns_current_pid_tgid

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
---
 .../bpf/prog_tests/ns_current_pid_tgid.c      | 88 +++++++++++++++++++
 .../bpf/progs/test_ns_current_pid_tgid.c      | 37 ++++++++
 2 files changed, 125 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c

diff --git a/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
new file mode 100644
index 000000000000..afd4a19dda14
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/ns_current_pid_tgid.c
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2019 Carlos Neira cneirabustos@gmail.com */
+#include <test_progs.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+
+struct bss {
+	__u64 dev;
+	__u64 ino;
+	__u64 pid_tgid;
+	__u64 user_pid_tgid;
+};
+
+void test_ns_current_pid_tgid(void)
+{
+	const char *probe_name = "raw_tracepoint/sys_enter";
+	const char *file = "test_ns_current_pid_tgid.o";
+	int err, key = 0, duration = 0;
+	struct bpf_link *link = NULL;
+	struct bpf_program *prog;
+	struct bpf_map *bss_map;
+	struct bpf_object *obj;
+	struct bss bss;
+	struct stat st;
+	__u64 id;
+
+	obj = bpf_object__open_file(file, NULL);
+	if (CHECK(IS_ERR(obj), "obj_open", "err %ld\n", PTR_ERR(obj)))
+		return;
+
+	err = bpf_object__load(obj);
+	if (CHECK(err, "obj_load", "err %d errno %d\n", err, errno))
+		goto cleanup;
+
+	bss_map = bpf_object__find_map_by_name(obj, "test_ns_.bss");
+	if (CHECK(!bss_map, "find_bss_map", "failed\n"))
+		goto cleanup;
+
+	prog = bpf_object__find_program_by_title(obj, probe_name);
+	if (CHECK(!prog, "find_prog", "prog '%s' not found\n",
+		  probe_name))
+		goto cleanup;
+
+	memset(&bss, 0, sizeof(bss));
+	pid_t tid = syscall(SYS_gettid);
+	pid_t pid = getpid();
+
+	id = (__u64) tid << 32 | pid;
+	bss.user_pid_tgid = id;
+
+	if (CHECK_FAIL(stat("/proc/self/ns/pid", &st))) {
+		perror("Failed to stat /proc/self/ns/pid");
+		goto cleanup;
+	}
+
+	bss.dev = st.st_dev;
+	bss.ino = st.st_ino;
+
+	err = bpf_map_update_elem(bpf_map__fd(bss_map), &key, &bss, 0);
+	if (CHECK(err, "setting_bss", "failed to set bss : %d\n", err))
+		goto cleanup;
+
+	link = bpf_program__attach_raw_tracepoint(prog, "sys_enter");
+	if (CHECK(IS_ERR(link), "attach_raw_tp", "err %ld\n",
+		  PTR_ERR(link))) {
+		link = NULL;
+		goto cleanup;
+	}
+
+	/* trigger some syscalls */
+	usleep(1);
+
+	err = bpf_map_lookup_elem(bpf_map__fd(bss_map), &key, &bss);
+	if (CHECK(err, "set_bss", "failed to get bss : %d\n", err))
+		goto cleanup;
+
+	if (CHECK(id != bss.pid_tgid, "Compare user pid/tgid vs. bpf pid/tgid",
+		  "User pid/tgid %llu BPF pid/tgid %llu\n", id, bss.pid_tgid))
+		goto cleanup;
+cleanup:
+	if (!link) {
+		bpf_link__destroy(link);
+		link = NULL;
+	}
+	bpf_object__close(obj);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
new file mode 100644
index 000000000000..cdb77eb1a4fb
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_ns_current_pid_tgid.c
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2019 Carlos Neira cneirabustos@gmail.com */
+
+#include <linux/bpf.h>
+#include <stdint.h>
+#include "bpf_helpers.h"
+
+static volatile struct {
+	__u64 dev;
+	__u64 ino;
+	__u64 pid_tgid;
+	__u64 user_pid_tgid;
+} res;
+
+SEC("raw_tracepoint/sys_enter")
+int trace(void *ctx)
+{
+	__u64  ns_pid_tgid, expected_pid;
+	struct bpf_pidns_info nsdata;
+	__u32 key = 0;
+
+	if (bpf_get_ns_current_pid_tgid(res.dev, res.ino, &nsdata,
+		   sizeof(struct bpf_pidns_info)))
+		return 0;
+
+	ns_pid_tgid = (__u64)nsdata.tgid << 32 | nsdata.pid;
+	expected_pid = res.user_pid_tgid;
+
+	if (expected_pid != ns_pid_tgid)
+		return 0;
+
+	res.pid_tgid = ns_pid_tgid;
+
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
                   ` (3 preceding siblings ...)
  2019-12-18 17:38 ` [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid Carlos Neira
@ 2019-12-18 17:38 ` Carlos Neira
  2019-12-19 18:43   ` Yonghong Song
  2020-01-10  1:46 ` [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Alexei Starovoitov
  5 siblings, 1 reply; 13+ messages in thread
From: Carlos Neira @ 2019-12-18 17:38 UTC (permalink / raw)
  To: netdev; +Cc: yhs, ebiederm, brouer, bpf, cneirabustos

Add struct bpf_pidns_info to known types

Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
---
 scripts/bpf_helpers_doc.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/bpf_helpers_doc.py b/scripts/bpf_helpers_doc.py
index 7548569e8076..021cc387d414 100755
--- a/scripts/bpf_helpers_doc.py
+++ b/scripts/bpf_helpers_doc.py
@@ -437,6 +437,7 @@ class PrinterHelpers(Printer):
             'struct bpf_fib_lookup',
             'struct bpf_perf_event_data',
             'struct bpf_perf_event_value',
+            'struct bpf_pidns_info',
             'struct bpf_sock',
             'struct bpf_sock_addr',
             'struct bpf_sock_ops',
-- 
2.20.1


^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid
  2019-12-18 17:38 ` [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid Carlos Neira
@ 2019-12-19 18:31   ` Yonghong Song
  0 siblings, 0 replies; 13+ messages in thread
From: Yonghong Song @ 2019-12-19 18:31 UTC (permalink / raw)
  To: Carlos Neira, netdev; +Cc: ebiederm, brouer, bpf



On 12/18/19 9:38 AM, Carlos Neira wrote:
> New bpf helper bpf_get_ns_current_pid_tgid,
> This helper will return pid and tgid from current task
> which namespace matches dev_t and inode number provided,
> this will allows us to instrument a process inside a container.
> 
> Signed-off-by: Carlos Neira <cneirabustos@gmail.com>

Acked-by: Yonghong Song <yhs@fb.com>

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper
  2019-12-18 17:38 ` [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper Carlos Neira
@ 2019-12-19 18:31   ` Yonghong Song
  0 siblings, 0 replies; 13+ messages in thread
From: Yonghong Song @ 2019-12-19 18:31 UTC (permalink / raw)
  To: Carlos Neira, netdev; +Cc: ebiederm, brouer, bpf



On 12/18/19 9:38 AM, Carlos Neira wrote:
> sync tools/include/uapi/linux/bpf.h to include new helper.
> 
> Signed-off-by: Carlos Neira <cneirabustos@gmail.com>

Acked-by: Yonghong Song <yhs@fb.com>

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid.
  2019-12-18 17:38 ` [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid Carlos Neira
@ 2019-12-19 18:40   ` Yonghong Song
  0 siblings, 0 replies; 13+ messages in thread
From: Yonghong Song @ 2019-12-19 18:40 UTC (permalink / raw)
  To: Carlos Neira, netdev; +Cc: ebiederm, brouer, bpf



On 12/18/19 9:38 AM, Carlos Neira wrote:
> Self tests added for new helper bpf_get_ns_current_pid_tgid
> 
> Signed-off-by: Carlos Neira <cneirabustos@gmail.com>

Acked-by: Yonghong Song <yhs@fb.com>

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types
  2019-12-18 17:38 ` [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types Carlos Neira
@ 2019-12-19 18:43   ` Yonghong Song
  0 siblings, 0 replies; 13+ messages in thread
From: Yonghong Song @ 2019-12-19 18:43 UTC (permalink / raw)
  To: Carlos Neira, netdev; +Cc: ebiederm, brouer, bpf



On 12/18/19 9:38 AM, Carlos Neira wrote:
> Add struct bpf_pidns_info to known types
> 
> Signed-off-by: Carlos Neira <cneirabustos@gmail.com>

Acked-by: Yonghong Song <yhs@fb.com>

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 1/5] fs/nsfs.c: added ns_match
  2019-12-18 17:38 ` [PATCH v16 1/5] fs/nsfs.c: added ns_match Carlos Neira
@ 2019-12-19 18:45   ` Yonghong Song
  0 siblings, 0 replies; 13+ messages in thread
From: Yonghong Song @ 2019-12-19 18:45 UTC (permalink / raw)
  To: ebiederm; +Cc: Carlos Neira, netdev, brouer, bpf


On 12/18/19 9:38 AM, Carlos Neira wrote:
> ns_match returns true if the namespace inode and dev_t matches the ones
> provided by the caller.
> 
> Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
> ---
>   fs/nsfs.c               | 14 ++++++++++++++
>   include/linux/proc_ns.h |  2 ++
>   2 files changed, 16 insertions(+)
> 
> diff --git a/fs/nsfs.c b/fs/nsfs.c
> index a0431642c6b5..ef59cf347285 100644
> --- a/fs/nsfs.c
> +++ b/fs/nsfs.c
> @@ -245,6 +245,20 @@ struct file *proc_ns_fget(int fd)
>   	return ERR_PTR(-EINVAL);
>   }
>   
> +/**
> + * ns_match() - Returns true if current namespace matches dev/ino provided.
> + * @ns_common: current ns
> + * @dev: dev_t from nsfs that will be matched against current nsfs
> + * @ino: ino_t from nsfs that will be matched against current nsfs
> + *
> + * Return: true if dev and ino matches the current nsfs.
> + */
> +bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino)
> +{
> +	return (ns->inum == ino) && (nsfs_mnt->mnt_sb->s_dev == dev);
> +}
> +
> +
>   static int nsfs_show_path(struct seq_file *seq, struct dentry *dentry)
>   {
>   	struct inode *inode = d_inode(dentry);
> diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h
> index d31cb6215905..1da9f33489f3 100644
> --- a/include/linux/proc_ns.h
> +++ b/include/linux/proc_ns.h
> @@ -82,6 +82,8 @@ typedef struct ns_common *ns_get_path_helper_t(void *);
>   extern void *ns_get_path_cb(struct path *path, ns_get_path_helper_t ns_get_cb,
>   			    void *private_data);
>   
> +extern bool ns_match(const struct ns_common *ns, dev_t dev, ino_t ino);
> +
>   extern int ns_get_name(char *buf, size_t size, struct task_struct *task,
>   			const struct proc_ns_operations *ns_ops);
>   extern void nsfs_init(void);

Eric, the above ns_match mechanism is what we discussed and you 
suggested. It would be good to get you look at it again and ack
if no further questions. Thanks!

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task
  2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
                   ` (4 preceding siblings ...)
  2019-12-18 17:38 ` [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types Carlos Neira
@ 2020-01-10  1:46 ` Alexei Starovoitov
  2020-01-10 13:27   ` Carlos Antonio Neira Bustos
  5 siblings, 1 reply; 13+ messages in thread
From: Alexei Starovoitov @ 2020-01-10  1:46 UTC (permalink / raw)
  To: Carlos Neira
  Cc: Network Development, Yonghong Song, Eric W. Biederman,
	Jesper Dangaard Brouer, bpf, Daniel Borkmann

On Wed, Dec 18, 2019 at 9:38 AM Carlos Neira <cneirabustos@gmail.com> wrote:
>
> Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> scripts but this helper returns the pid as seen by the root namespace which is
> fine when a bcc script is not executed inside a container.
> When the process of interest is inside a container, pid filtering will not work
> if bpf_get_current_pid_tgid() is used.
> This helper addresses this limitation returning the pid as it's seen by the current
> namespace where the script is executing.
>
> In the future different pid_ns files may belong to different devices, according to the
> discussion between Eric Biederman and Yonghong in 2017 Linux plumbers conference.
> To address that situation the helper requires inum and dev_t from /proc/self/ns/pid.
> This helper has the same use cases as bpf_get_current_pid_tgid() as it can be
> used to do pid filtering even inside a container.

I think the set looks like fine. Please respin against bpf-next
carrying over Yonghong's ack and I'll apply it.
Please squash patch 2 and 3 together.
Updates to tools/uapi/bpf.h don't need to be separated anymore.
Patch 5 can be squashed into them as well.
Could you also improve selftest from patch 4 to test new helper
both inside and outside of some container?
With unshare(CLONE_NEWPID) or something.
Do you have corresponding bcc change to show how it's going to be used?

^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task
  2020-01-10  1:46 ` [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Alexei Starovoitov
@ 2020-01-10 13:27   ` Carlos Antonio Neira Bustos
  0 siblings, 0 replies; 13+ messages in thread
From: Carlos Antonio Neira Bustos @ 2020-01-10 13:27 UTC (permalink / raw)
  To: Alexei Starovoitov
  Cc: Network Development, Yonghong Song, Eric W. Biederman,
	Jesper Dangaard Brouer, bpf, Daniel Borkmann

On Thu, Jan 09, 2020 at 05:46:29PM -0800, Alexei Starovoitov wrote:
> On Wed, Dec 18, 2019 at 9:38 AM Carlos Neira <cneirabustos@gmail.com> wrote:
> >
> > Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> > scripts but this helper returns the pid as seen by the root namespace which is
> > fine when a bcc script is not executed inside a container.
> > When the process of interest is inside a container, pid filtering will not work
> > if bpf_get_current_pid_tgid() is used.
> > This helper addresses this limitation returning the pid as it's seen by the current
> > namespace where the script is executing.
> >
> > In the future different pid_ns files may belong to different devices, according to the
> > discussion between Eric Biederman and Yonghong in 2017 Linux plumbers conference.
> > To address that situation the helper requires inum and dev_t from /proc/self/ns/pid.
> > This helper has the same use cases as bpf_get_current_pid_tgid() as it can be
> > used to do pid filtering even inside a container.
> 
> I think the set looks like fine. Please respin against bpf-next
> carrying over Yonghong's ack and I'll apply it.
> Please squash patch 2 and 3 together.
> Updates to tools/uapi/bpf.h don't need to be separated anymore.
> Patch 5 can be squashed into them as well.
> Could you also improve selftest from patch 4 to test new helper
> both inside and outside of some container?
> With unshare(CLONE_NEWPID) or something.
> Do you have corresponding bcc change to show how it's going to be used?

Thanks Alexei,
I'll squash patches 2, 3, 5 together and improve the new helper test, regarding bcc
changes, I also need to work on that as the one I created a while ago now
is not valid https://github.com/iovisor/bcc/pull/1901/commits/a81b4352173cb82922d4d4bb965a39f781fd7693

Bests 

^ permalink raw reply	[flat|nested] 13+ messages in thread

end of thread, back to index

Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-18 17:38 [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Carlos Neira
2019-12-18 17:38 ` [PATCH v16 1/5] fs/nsfs.c: added ns_match Carlos Neira
2019-12-19 18:45   ` Yonghong Song
2019-12-18 17:38 ` [PATCH v16 2/5] bpf: added new helper bpf_get_ns_current_pid_tgid Carlos Neira
2019-12-19 18:31   ` Yonghong Song
2019-12-18 17:38 ` [PATCH v16 3/5] tools: Added bpf_get_ns_current_pid_tgid helper Carlos Neira
2019-12-19 18:31   ` Yonghong Song
2019-12-18 17:38 ` [PATCH v16 4/5] tools/testing/selftests/bpf: Add self-tests for new helper bpf_get_ns_current_pid_tgid Carlos Neira
2019-12-19 18:40   ` Yonghong Song
2019-12-18 17:38 ` [PATCH v16 5/5] bpf_helpers_doc.py: Add struct bpf_pidns_info to known types Carlos Neira
2019-12-19 18:43   ` Yonghong Song
2020-01-10  1:46 ` [PATCH v16 0/5] BPF: New helper to obtain namespace data from current task Alexei Starovoitov
2020-01-10 13:27   ` Carlos Antonio Neira Bustos

BPF Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \
		bpf@vger.kernel.org
	public-inbox-index bpf

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.bpf


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git