From: Carlos Neira <cneirabustos@gmail.com>
To: netdev@vger.kernel.org
Cc: yhs@fb.com, ebiederm@xmission.com, brouer@redhat.com,
cneirabustos@gmail.com, bpf@vger.kernel.org
Subject: [PATCH bpf-next v10 0/4] BPF: New helper to obtain namespace data from current task
Date: Fri, 6 Sep 2019 11:09:48 -0400 [thread overview]
Message-ID: <20190906150952.23066-1-cneirabustos@gmail.com> (raw)
This helper obtains the active namespace from current and returns pid, tgid,
device and namespace id as seen from that namespace, allowing to instrument
a process inside a container.
Device is read from /proc/self/ns/pid, as in the future it's possible that
different pid_ns files may belong to different devices, according
to the discussion between Eric Biederman and Yonghong in 2017 linux plumbers
conference.
Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
scripts but this helper returns the pid as seen by the root namespace which is
fine when a bcc script is not executed inside a container.
When the process of interest is inside a container, pid filtering will not work
if bpf_get_current_pid_tgid() is used. This helper addresses this limitation
returning the pid as it's seen by the current namespace where the script is
executing.
This helper has the same use cases as bpf_get_current_pid_tgid() as it can be
used to do pid filtering even inside a container.
For example a bcc script using bpf_get_current_pid_tgid() (tools/funccount.py):
u32 pid = bpf_get_current_pid_tgid() >> 32;
if (pid != <pid_arg_passed_in>)
return 0;
Could be modified to use bpf_get_current_pidns_info() as follows:
struct bpf_pidns pidns;
bpf_get_current_pidns_info(&pidns, sizeof(struct bpf_pidns));
u32 pid = pidns.tgid;
u32 nsid = pidns.nsid;
if ((pid != <pid_arg_passed_in>) && (nsid != <nsid_arg_passed_in>))
return 0;
To find out the name PID namespace id of a process, you could use this command:
$ ps -h -o pidns -p <pid_of_interest>
Or this other command:
$ ls -Li /proc/<pid_of_interest>/ns/pid
Changes from v9 :
Removed samples/bpf in favor of tools/testing/selftests/bpf
Fixed bug when bpf helper is called in an interrupt context.
Code style fixes.
Added more comments on bpf helper struct member.
Signed-off-by: Carlos Neira <cneirabustos@gmail.com>
Carlos Neira (4):
fs/namei.c: make available filename_lookup() for bpf helpers.
bpf: new helper to obtain namespace data from current task New bpf
helper bpf_get_current_pidns_info.
tools: Added bpf_get_current_pidns_info helper.
tools/testing/selftests/bpf: Add self-tests for helper
bpf_get_pidns_info.
fs/internal.h | 2 -
fs/namei.c | 1 -
include/linux/bpf.h | 1 +
include/linux/namei.h | 4 +
include/uapi/linux/bpf.h | 35 ++++-
kernel/bpf/core.c | 1 +
kernel/bpf/helpers.c | 86 ++++++++++++
kernel/trace/bpf_trace.c | 2 +
tools/include/uapi/linux/bpf.h | 35 ++++-
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/bpf_helpers.h | 3 +
.../testing/selftests/bpf/progs/test_pidns_kern.c | 52 ++++++++
.../selftests/bpf/progs/test_pidns_nmi_kern.c | 52 ++++++++
tools/testing/selftests/bpf/test_pidns.c | 146 +++++++++++++++++++++
tools/testing/selftests/bpf/test_pidns_nmi.c | 139 ++++++++++++++++++++
15 files changed, 555 insertions(+), 6 deletions(-)
create mode 100644 tools/testing/selftests/bpf/progs/test_pidns_kern.c
create mode 100644 tools/testing/selftests/bpf/progs/test_pidns_nmi_kern.c
create mode 100644 tools/testing/selftests/bpf/test_pidns.c
create mode 100644 tools/testing/selftests/bpf/test_pidns_nmi.c
--
2.11.0
next reply other threads:[~2019-09-06 15:10 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-06 15:09 Carlos Neira [this message]
2019-09-06 15:09 ` [PATCH bpf-next v10 1/4] fs/namei.c: make available filename_lookup() for bpf helpers Carlos Neira
2019-09-06 15:09 ` [PATCH bpf-next v10 2/4] bpf: new helper to obtain namespace data from current task New bpf helper bpf_get_current_pidns_info Carlos Neira
2019-09-06 15:24 ` Al Viro
2019-09-06 15:46 ` Al Viro
2019-09-06 16:00 ` Al Viro
2019-09-06 23:21 ` Yonghong Song
2019-09-07 0:10 ` Al Viro
2019-09-07 6:34 ` Yonghong Song
2019-09-09 17:45 ` Carlos Antonio Neira Bustos
2019-09-10 22:35 ` Yonghong Song
2019-09-10 23:15 ` Al Viro
2019-09-11 8:16 ` Eric W. Biederman
2019-09-12 5:49 ` Yonghong Song
[not found] ` <CACiB22j9M2gmccnh7XqqFp8g7qKFuiOrSAVJiA2tQHLB0pmoSQ@mail.gmail.com>
2019-09-13 2:56 ` Yonghong Song
2019-09-13 11:58 ` Carlos Antonio Neira Bustos
2019-09-13 16:59 ` Eric W. Biederman
2019-09-13 17:28 ` Yonghong Song
2019-09-11 4:32 ` Carlos Antonio Neira Bustos
2019-09-11 8:17 ` Eric W. Biederman
2019-09-10 22:46 ` Yonghong Song
2019-09-11 4:33 ` Carlos Antonio Neira Bustos
2019-09-06 15:09 ` [PATCH bpf-next v10 3/4] tools: Added bpf_get_current_pidns_info helper Carlos Neira
2019-09-06 15:09 ` [PATCH bpf-next v10 4/4] tools/testing/selftests/bpf: Add self-tests for helper bpf_get_pidns_info Carlos Neira
2019-09-10 22:55 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190906150952.23066-1-cneirabustos@gmail.com \
--to=cneirabustos@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=ebiederm@xmission.com \
--cc=netdev@vger.kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).