From patchwork Wed Mar 20 18:48:11 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Carlos Antonio Neira Bustos X-Patchwork-Id: 1059485 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="ngufOBxI"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44Pf7w4jgTz9sPf for ; Thu, 21 Mar 2019 05:48:28 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727265AbfCTSsS (ORCPT ); Wed, 20 Mar 2019 14:48:18 -0400 Received: from mail-qk1-f169.google.com ([209.85.222.169]:34901 "EHLO mail-qk1-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727166AbfCTSsR (ORCPT ); Wed, 20 Mar 2019 14:48:17 -0400 Received: by mail-qk1-f169.google.com with SMTP id z13so14790139qki.2 for ; Wed, 20 Mar 2019 11:48:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=Tuc9taHMb1yxLkcN4sZEJb3jdMY9PcTXFE1TRVzVOAU=; b=ngufOBxIvNiy++4Li381NFAfe/On7GVjKLyozeOE+p4yjhWIQX1sAOQGTI0RYT89WF lC3IlBWDdL/aUtyawiGXEJYCYe1ARSwhUsWi8GDXKlvjsdCkfOZvIl84dv9saGVCIh3s hPyatM7tt8+ofy7zTM0NRR3YvVkqPhru0voMyYidCCgdEyldZlx86J0xhHALqwX3tc0a 2wsuecMVpmWjF8Exu5YMCIRD/nY7ayX4DZCAjDhsZ+fOiz4EMs2CyJr8NVQCozrEGNzf rWJBgMU5c2HwtRvF9ImjQ6vzTI8o4fRXi7PAPaTx8i7pRM15CufyF8EriqvNu8fsspz+ j34g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=Tuc9taHMb1yxLkcN4sZEJb3jdMY9PcTXFE1TRVzVOAU=; b=DHAy0+YD7KyLclc5nJVIHzO8LQTb8pxicj3GFBh9/cBVOwxP3Z1LMs55i1vLty7Hao /77fNywEiUjrAjJWcKu/aONEk5iBbeMWi8DD3+ZYlIcT0ttdJISnRPourQTzSDby95C6 TrG3P9qU4LkahLt8lFLw/oAhXcqVOnwNx0QXjjF5g/V5cuz9nCht5PE4ELMdN0JdZ9Dy Vp38Wu5hohnc8XyblhrJCdQHD0fR4lUQGRSynU1bRfxLaJQlBM+FeBhfkVWH2pQx42Pb QULpvlkccNUE545D52oEk0ss/1AzSMNIhiovL+Uzt2X5jcVWL82xk8T1mkTYLxziNZrT 0Ilg== X-Gm-Message-State: APjAAAUJkbJAeM90sKv0fy2lHjuRz0iclQ5B/G14WYQJ5rNzO3pIQgYC H5V1O0jQqCAYCMo8z9CzCNyUEDPiiK0= X-Google-Smtp-Source: APXvYqw/NcA5ZpfAsnhJZMnnY/adJaZJP2glLRdK61Rx8iNjtkaqQkwC2yqoX+/NPBpC+cVB7DNqaQ== X-Received: by 2002:a37:e212:: with SMTP id g18mr7729062qki.152.1553107695868; Wed, 20 Mar 2019 11:48:15 -0700 (PDT) Received: from dev00 ([190.162.109.53]) by smtp.gmail.com with ESMTPSA id y21sm1819240qth.90.2019.03.20.11.48.13 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 20 Mar 2019 11:48:15 -0700 (PDT) Date: Wed, 20 Mar 2019 15:48:11 -0300 From: Carlos Antonio Neira Bustos To: netdev@vger.kernel.org Cc: ebiederm@xmission.com, quentin.monnet@netronome.com, ys114321@gmail.com, brouer@redhat.com, cneirabustos@gmail.com Subject: [PATCH v4 bpf-next 2/3] BPF: helpers: New helper to obtain namespace data from current task Message-ID: <20190320184809.vik43mov2nugt4nr@dev00> MIME-Version: 1.0 Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This is a fix for patch series 2 from v3.It fixes a typo on the helper documentation. From e505e591020ca1d2224e318d8502446b1821f07a Mon Sep 17 00:00:00 2001 From: Carlos Date: Wed, 20 Mar 2019 15:32:22 -0300 Subject: [PATCH] [PATCH bpf-next v4 2/3] BPF: New helper to obtain namespace data from current task This helper obtains the active namespace from current and returns pid, tgid, device and namespace id as seen from that namespace, allowing to instrument a process inside a container. Device is read from /proc/self/ns/pid, as in the future it's possible that different pid_ns files may belong to different devices, according to the discussion between Eric Biederman and Yonghong in 2017 linux plumbers conference. Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's scripts but this helper returns the pid as seen by the root namespace which is fine when a bcc script is not executed inside a container. When the process of interest is inside a container, pid filtering will not work if bpf_get_current_pid_tgid() is used. This helper addresses this limitation returning the pid as it's seen by the current namespace where the script is executing. This helper has the same use cases as bpf_get_current_pid_tgid() as it can be used to do pid filtering even inside a container. For example a bcc script using bpf_get_current_pid_tgid() (tools/funccount.py): u32 pid = bpf_get_current_pid_tgid() >> 32; if (pid != ) return 0; Could be modified to use bpf_get_current_pidns_info() as follows: struct bpf_pidns pidns; bpf_get_current_pidns_info(&pidns, sizeof(struct bpf_pidns)); u32 pid = pidns.tgid; u32 nsid = pidns.nsid; if ((pid != ) && (nsid != )) return 0; To find out the name PID namespace id of a process, you could use this command: $ ps -h -o pidns -p Or this other command: $ ls -Li /proc//ns/pid Signed-off-by: Carlos Antonio Neira Bustos --- tools/include/uapi/linux/bpf.h | 26 +++++++++++++++++++++++++- tools/testing/selftests/bpf/bpf_helpers.h | 3 +++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 3c38ac9a92a7..facc701c7873 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -2366,6 +2366,18 @@ union bpf_attr { * current value is ect (ECN capable). Works with IPv6 and IPv4. * Return * 1 if set, 0 if not set. + * + * int bpf_get_current_pidns_info(struct bpf_pidns_info *pidns, u32 size_of_pidns) + * Description + * Copies into *pidns* pid, namespace id and tgid as seen by the + * current namespace and also device from /proc/self/ns/pid. + * *size_of_pidns* must be the size of *pidns* + * + * This helper is used when pid filtering is needed inside a + * container as bpf_get_current_tgid() helper returns always the + * pid id as seen by the root namespace. + * Return + * 0 on success -EINVAL on error. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2465,7 +2477,8 @@ union bpf_attr { FN(spin_unlock), \ FN(sk_fullsock), \ FN(tcp_sock), \ - FN(skb_ecn_set_ce), + FN(skb_ecn_set_ce), \ + FN(get_current_pidns_info), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call @@ -3152,4 +3165,15 @@ struct bpf_line_info { struct bpf_spin_lock { __u32 val; }; + +/* helper bpf_get_current_pidns_info will store the following + * data, dev will contain major/minor from /proc/self/pid. +*/ +struct bpf_pidns_info { + __u32 dev; + __u32 nsid; + __u32 tgid; + __u32 pid; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h index c9433a496d54..8cd630d84c07 100644 --- a/tools/testing/selftests/bpf/bpf_helpers.h +++ b/tools/testing/selftests/bpf/bpf_helpers.h @@ -182,6 +182,9 @@ static struct bpf_tcp_sock *(*bpf_tcp_sock)(struct bpf_sock *sk) = (void *) BPF_FUNC_tcp_sock; static int (*bpf_skb_ecn_set_ce)(void *ctx) = (void *) BPF_FUNC_skb_ecn_set_ce; +static int (*bpf_get_current_pidns_info)(struct bpf_pidns_info *buf, + unsigned int buf_size) = + (void *) BPF_FUNC_get_current_pidns_info; /* llvm builtin functions that eBPF C program may use to * emit BPF_LD_ABS and BPF_LD_IND instructions