From patchwork Wed Mar 20 05:33:15 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Carlos Antonio Neira Bustos X-Patchwork-Id: 1058872 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="AWMLUflj"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44PJVb4Zf3z9sBr for ; Wed, 20 Mar 2019 16:33:27 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726891AbfCTFdX (ORCPT ); Wed, 20 Mar 2019 01:33:23 -0400 Received: from mail-qk1-f176.google.com ([209.85.222.176]:45904 "EHLO mail-qk1-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725300AbfCTFdW (ORCPT ); Wed, 20 Mar 2019 01:33:22 -0400 Received: by mail-qk1-f176.google.com with SMTP id z76so13381287qkb.12 for ; Tue, 19 Mar 2019 22:33:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=6zTrfZZ4YjcBMP2tH31e5891WFKeZW4FC73DAi+DoNo=; b=AWMLUflj/wY69SjyCE5amaSRSSMdWIvmgshBVqo/XC9DZU1Ak1Mp0FBi+mGiGJErpJ O96mXT89S/VLSR/+UsIS1fb3DyLUTfwM7HWI+wMuGfRK0ziv2S6EUm6W9n2hbwfjz0V3 0ks7/4q1YlyHPi7Yw7NaWED7NB6lSFZ676L+gdim/m1rUAciIGCdKjJ20PVb6M+IaK/U GGO+ItOGqdxYTM5tM7IbCeYnLkmWT5Ngh11NN4NYr/7L49m7GRNwvrOQGCIOxddEa+FV aMUCFikecLTefowbZ6icM5lpHJHeEXw4GqeBT4mQFfCB4pJp4FYR1v2XnPI8tz0jWqf/ 9gdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=6zTrfZZ4YjcBMP2tH31e5891WFKeZW4FC73DAi+DoNo=; b=Zf6pmLzVX0fLFbq9dmjRpWzR5sJ0lKywEwThQtnHF12vrTulJ4j6s++9Hql4FZAi4J eXqu2g7ezXxsFbAYPrycHVWMGAAX8Qq2Czx76Ggbkxdb/Wro4VkxC5QYV41WODXNiiOJ aEyipsTCo7HEWK2qNmAZD5/wjIuDHZyTdYWlNjacn2plbhIgAIIAU+dsFHTMiXrAVe1p 0navtbNefVgFRWA4wiTig4kXG0HZ4v3d6mESby+lsQlxCfvN/V8x52S/uzbutS9YUMPa 40h+xDx3iwm0D3gPJra6ERNpw4CqVZhQdlAQ6Qxthkhg3Ny+CMu5V+ZPotrSNZWwuw1I btCw== X-Gm-Message-State: APjAAAUojpF2lziKyhjk2hMBheJ49Tu6VcbjLCw63ZmAzJ49g+GgiiOf TKR92jiFwAL/0xBGYLFPAOb1bBcxW2A= X-Google-Smtp-Source: APXvYqxQ/qs2//4ydQAy4uikhBCoQuqLy+F9d+5tOIQ9sMwm5t0+mgMrpCLahVbEgY5CFvI5XvgkCw== X-Received: by 2002:a37:d459:: with SMTP id l86mr5044056qki.37.1553060001342; Tue, 19 Mar 2019 22:33:21 -0700 (PDT) Received: from dev00 ([190.162.109.53]) by smtp.gmail.com with ESMTPSA id k42sm1020741qtk.58.2019.03.19.22.33.18 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 19 Mar 2019 22:33:19 -0700 (PDT) Date: Wed, 20 Mar 2019 02:33:15 -0300 From: Carlos Neira To: netdev@vger.kernel.org Cc: ebiederm@xmission.com, quentin.monnet@netronome.com, ys114321@gmail.com, brouer@redhat.com, cneirabustos@gmail.com Subject: [PATCH v3 bpf-next 1/3] BPF: helpers: New helper to obtain namespace data from current task Message-ID: <20190320053313.amhaibzsx5d2r65w@dev00> MIME-Version: 1.0 Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This is a series of patches to introduce a new helper called bpf_get_current_pidns_info, this change has been splitted into the following patches: 1- Feature introduction 2- Update tools/.../bpf.h 3- Self tests and samples Signed-off-by: Carlos Antonio Neira Bustos Signed-off-by: Carlos Antonio Neira Bustos From 852a65906122b05b4d1a23af868b2c245d240402 Mon Sep 17 00:00:00 2001 From: Carlos Date: Tue, 19 Mar 2019 19:38:48 -0300 Subject: [PATCH] [PATCH bpf-next 1/3] BPF: New helper to obtain namespace data from current task This helper obtains the active namespace from current and returns pid, tgid, device and namespace id as seen from that namespace, allowing to instrument a process inside a container. Device is read from /proc/self/ns/pid, as in the future it's possible that different pid_ns files may belong to different devices, according to the discussion between Eric Biederman and Yonghong in 2017 linux plumbers conference. Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's scripts but this helper returns the pid as seen by the root namespace which is fine when a bcc script is not executed inside a container. When the process of interest is inside a container, pid filtering will not work if bpf_get_current_pid_tgid() is used. This helper addresses this limitation returning the pid as it's seen by the current namespace where the script is executing. This helper has the same use cases as bpf_get_current_pid_tgid() as it can be used to do pid filtering even inside a container. For example a bcc script using bpf_get_current_pid_tgid() (tools/funccount.py): u32 pid = bpf_get_current_pid_tgid() >> 32; if (pid != ) return 0; Could be modified to use bpf_get_current_pidns_info() as follows: struct bpf_pidns pidns; bpf_get_current_pidns_info(&pidns, sizeof(struct bpf_pidns)); u32 pid = pidns.tgid; u32 nsid = pidns.nsid; if ((pid != ) && (nsid != )) return 0; To find out the name PID namespace id of a process, you could use this command: $ ps -h -o pidns -p Or this other command: $ ls -Li /proc//ns/pid Signed-off-by: Carlos Antonio Neira Bustos - --- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 26 ++++++++++++++++++- kernel/bpf/core.c | 1 + kernel/bpf/helpers.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++ kernel/trace/bpf_trace.c | 2 ++ 5 files changed, 96 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index a2132e09dc1c..a77f5bd77bd8 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -930,6 +930,7 @@ extern const struct bpf_func_proto bpf_sk_redirect_map_proto; extern const struct bpf_func_proto bpf_spin_lock_proto; extern const struct bpf_func_proto bpf_spin_unlock_proto; extern const struct bpf_func_proto bpf_get_local_storage_proto; +extern const struct bpf_func_proto bpf_get_current_pidns_info_proto; /* Shared helpers among cBPF and eBPF. */ void bpf_user_rnd_init_once(void); diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 3c38ac9a92a7..facc701c7873 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -2366,6 +2366,18 @@ union bpf_attr { * current value is ect (ECN capable). Works with IPv6 and IPv4. * Return * 1 if set, 0 if not set. + * + * int bpf_get_current_pidns_info(struct bpf_pidns_info *pidns, u32 size_of_pidns) + * Description + * Copies into *pidns* pid, namespace id and tgid as seen by the + * current namespace and also device from /proc/self/ns/pid. + * *size_of_pidns* must be the size of *pidns* + * + * This helper is used when pid filtering is needed inside a + * container as bpf_get_current_tgid() helper returns always the + * pid id as seen by the root namespace. + * Return + * 0 on success -EINVAL on error. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2465,7 +2477,8 @@ union bpf_attr { FN(spin_unlock), \ FN(sk_fullsock), \ FN(tcp_sock), \ - FN(skb_ecn_set_ce), + FN(skb_ecn_set_ce), \ + FN(get_current_pidns_info), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call @@ -3152,4 +3165,15 @@ struct bpf_line_info { struct bpf_spin_lock { __u32 val; }; + +/* helper bpf_get_current_pidns_info will store the following + * data, dev will contain major/minor from /proc/self/pid. +*/ +struct bpf_pidns_info { + __u32 dev; + __u32 nsid; + __u32 tgid; + __u32 pid; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 3f08c257858e..06329fbed95f 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2044,6 +2044,7 @@ const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak; const struct bpf_func_proto bpf_get_current_comm_proto __weak; const struct bpf_func_proto bpf_get_current_cgroup_id_proto __weak; const struct bpf_func_proto bpf_get_local_storage_proto __weak; +const struct bpf_func_proto bpf_get_current_pidns_info __weak; const struct bpf_func_proto * __weak bpf_get_trace_printk_proto(void) { diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index a411fc17d265..95c3780a6ba7 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -18,6 +18,11 @@ #include #include #include +#include +#include +#include +#include +#include /* If kernel subsystem is allowing eBPF programs to call this function, * inside its own verifier_ops->get_func_proto() callback it should return @@ -364,3 +369,65 @@ const struct bpf_func_proto bpf_get_local_storage_proto = { }; #endif #endif + +BPF_CALL_2(bpf_get_current_pidns_info, struct bpf_pidns_info *, pidns_info, u32, + size) +{ + const char *nspid = "/proc/self/ns/pid"; + struct pid_namespace *pidns = NULL; + struct kstat ks; + struct path kp; + pid_t tgid = 0; + pid_t pid = 0; + int res = 0; + + if (unlikely(size != sizeof(struct bpf_pidns_info))) + goto clear; + + pidns = task_active_pid_ns(current); + + if (unlikely(!pidns)) + goto clear; + + pidns_info->nsid = pidns->ns.inum; + pid = task_pid_nr_ns(current, pidns); + + if (unlikely(!pid)) + goto clear; + + tgid = task_tgid_nr_ns(current, pidns); + + if (unlikely(!tgid)) + goto clear; + + pidns_info->tgid = (u32) tgid; + pidns_info->pid = (u32) pid; + + kern_path(nspid, 0, &kp); + +#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,11,0) + res = vfs_getattr(&kp, &ks, STATX_ALL, 0); +#else + res = vfs_getattr(&kp, &ks); +#endif + if (unlikely(res)) + goto clear; + + pidns_info->dev = ks.dev; + + return 0; + + clear: + if (pidns_info) + memset((void *)pidns, 0, (size_t) size); + + return -EINVAL; +} + +const struct bpf_func_proto bpf_get_current_pidns_info_proto = { + .func = bpf_get_current_pidns_info, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_UNINIT_MEM, + .arg2_type = ARG_CONST_SIZE, +}; diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index f1a86a0d881d..48c86bc8680f 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -604,6 +604,8 @@ tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_get_current_cgroup_id: return &bpf_get_current_cgroup_id_proto; #endif + case BPF_FUNC_get_current_pidns_info: + return &bpf_get_current_pidns_info_proto; default: return NULL; } -- 2.11.0 From patchwork Wed Mar 20 05:42:17 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Carlos Antonio Neira Bustos X-Patchwork-Id: 1058877 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="UHD8nrJG"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44PJhy3NxFz9sNH for ; Wed, 20 Mar 2019 16:42:26 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726891AbfCTFmZ (ORCPT ); Wed, 20 Mar 2019 01:42:25 -0400 Received: from mail-qt1-f175.google.com ([209.85.160.175]:44576 "EHLO mail-qt1-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726065AbfCTFmY (ORCPT ); Wed, 20 Mar 2019 01:42:24 -0400 Received: by mail-qt1-f175.google.com with SMTP id w5so1138878qtb.11 for ; Tue, 19 Mar 2019 22:42:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :user-agent; bh=a9yK1PMQcK8nMMdxCo/8nQnorhIJ/4/M5R9RWHW2D9k=; b=UHD8nrJGl7Sf3ATUnCZuiNENbQJTQcJ+qLDdIpldZv11L1THCkYu+c0dpxy7bD5B+j f8MM6Pt+iXZbW7FhclhAOB6TkBYfTDCR8rm8Du0fY3FpSdebxythUTijCZxl990bHtkl GXvPg+RSZ0hZszY7cMoGTv9iqDClIh+bbg2wyCq2FCCK2D6jIRoJfLhzxdD0Phh5tfa6 HChkC9uK3JzJ3HlbgkoP3u046oEUumvwQwisv7gene8LDym26GWP70nYMn94VAfn9FRu w/5Z0yph2zkKViBtRxmqOt2vgo3XYDe86QN13+dUApMLZUjU8HnnZN8573ghqSNcyuVa +0hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:user-agent; bh=a9yK1PMQcK8nMMdxCo/8nQnorhIJ/4/M5R9RWHW2D9k=; b=KKy4ae8Ypoi7PF6+k1f9iqhpeVkNgJdXfHMFe0azbPLv13U3aPfTLKy5seXGnD7JgI uq67I6oqKyYp1WzIbr8MKHWjVMP4lrNWdHGDkYByRV9ua5ZB/m64kIbjgg7s/FHt6iXQ upTOJw7DWqJHeRirxH0CKxU6nwJwrL0ZBcI9H0mh/snIBeVOB3Xs8tdNTDeJlHJQjE0i wGfi7aJ+/9rXNxsICXtDQFfHNFRvW1kOzjUUrAyrbHxp8DhNaicbcaxguIIhvk/0S5lo VsuZeeJgCHXAXODfT4JEiRH/zCHImtpJ5zO9pwe1H6B4OEQCNUyhaHbmBSENkK6upfU2 P5PQ== X-Gm-Message-State: APjAAAVGOGI61qRoozww82vwD8S01DOyL/d7UHjs4e9c9H9s1lddTnoB S9oubl/O4CPQdclWjAo1EqEHu7FVxBA= X-Google-Smtp-Source: APXvYqwj9aT5o/607yqhPuamUzcsuCSJIquUWA2uRt8VoSDlQ1cSA2v2/CD5fe2XW2lqsMPYw2ukXw== X-Received: by 2002:ac8:c89:: with SMTP id n9mr2158530qti.386.1553060543102; Tue, 19 Mar 2019 22:42:23 -0700 (PDT) Received: from dev00 ([190.162.109.53]) by smtp.gmail.com with ESMTPSA id p127sm583177qke.97.2019.03.19.22.42.20 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 19 Mar 2019 22:42:21 -0700 (PDT) Date: Wed, 20 Mar 2019 02:42:17 -0300 From: Carlos Neira To: netdev@vger.kernel.org Cc: ebiederm@xmission.com, quentin.monnet@netronome.com, ys114321@gmail.com, brouer@redhat.com, cneirabustos@gmail.com Subject: [PATCH v3 bpf-next 2/3] BPF: helpers: New helper to obtain namespace data from current task Message-ID: <20190320054215.swv7ojkpsz5irmqb@dev00> MIME-Version: 1.0 Content-Disposition: inline User-Agent: NeoMutt/20170113 (1.7.2) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This is a series of patches to introduce a new helper called bpf_get_current_pidns_info, this change has been splitted into the following patches: 1- Feature introduction 2- Update tools/.../bpf.h 3- Self tests and samples From b7f5af5c1513b6e89fc5b68ddb1ad65e4fbede02 Mon Sep 17 00:00:00 2001 From: Carlos Date: Mon, 18 Mar 2019 13:09:35 -0300 Subject: [PATCH] [PATCH bpf-next 2/3] BPF: New helper to obtain namespace data from current task This helper obtains the active namespace from current and returns pid, tgid, device and namespace id as seen from that namespace, allowing to instrument a process inside a container. Device is read from /proc/self/ns/pid, as in the future it's possible that different pid_ns files may belong to different devices, according to the discussion between Eric Biederman and Yonghong in 2017 linux plumbers conference. Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's scripts but this helper returns the pid as seen by the root namespace which is fine when a bcc script is not executed inside a container. When the process of interest is inside a container, pid filtering will not work if bpf_get_current_pid_tgid() is used. This helper addresses this limitation returning the pid as it's seen by the current namespace where the script is executing. This helper has the same use cases as bpf_get_current_pid_tgid() as it can be used to do pid filtering even inside a container. For example a bcc script using bpf_get_current_pid_tgid() (tools/funccount.py): u32 pid = bpf_get_current_pid_tgid() >> 32; if (pid != ) return 0; Could be modified to use bpf_get_current_pidns_info() as follows: struct bpf_pidns pidns; bpf_get_current_pidns_info(&pidns, sizeof(struct bpf_pidns)); u32 pid = pidns.tgid; u32 nsid = pidns.nsid; if ((pid != ) && (nsid != )) return 0; To find out the name PID namespace id of a process, you could use this command: $ ps -h -o pidns -p Or this other command: $ ls -Li /proc//ns/pid Signed-off-by: Carlos Antonio Neira Bustos --- tools/include/uapi/linux/bpf.h | 25 ++++++++++++++++++++++++- tools/testing/selftests/bpf/bpf_helpers.h | 3 +++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 3c38ac9a92a7..5c7e517a59a6 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -2366,6 +2366,18 @@ union bpf_attr { * current value is ect (ECN capable). Works with IPv6 and IPv4. * Return * 1 if set, 0 if not set. + * + * int bpf_get_current_pidns(struct bpf_pidns_info *pidns, u32 size_of_pidns) + * Description + * Copies into *pidns* pid, namespace id and tgid as seen by the + * current namespace and also device from /proc/self/ns/pid. + * *size_of_pidns* must be the size of *pidns* + * + * This helper is used when pid filtering is needed inside a + * container as bpf_get_current_tgid() helper returns always the + * pid id as seen by the root namespace. + * Return + * 0 on success -EINVAL on error. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -2465,7 +2477,8 @@ union bpf_attr { FN(spin_unlock), \ FN(sk_fullsock), \ FN(tcp_sock), \ - FN(skb_ecn_set_ce), + FN(skb_ecn_set_ce), \ + FN(get_current_pidns_info), /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call @@ -3152,4 +3165,14 @@ struct bpf_line_info { struct bpf_spin_lock { __u32 val; }; + +/* helper bpf_get_current_pidns_info will store the following + * data, dev will contain major/minor from /proc/self/pid. + */ +struct bpf_pidns_info { + __u32 dev; + __u32 nsid; + __u32 tgid; + __u32 pid; +}; #endif /* _UAPI__LINUX_BPF_H__ */ diff --git a/tools/testing/selftests/bpf/bpf_helpers.h b/tools/testing/selftests/bpf/bpf_helpers.h index c9433a496d54..8cd630d84c07 100644 --- a/tools/testing/selftests/bpf/bpf_helpers.h +++ b/tools/testing/selftests/bpf/bpf_helpers.h @@ -182,6 +182,9 @@ static struct bpf_tcp_sock *(*bpf_tcp_sock)(struct bpf_sock *sk) = (void *) BPF_FUNC_tcp_sock; static int (*bpf_skb_ecn_set_ce)(void *ctx) = (void *) BPF_FUNC_skb_ecn_set_ce; +static int (*bpf_get_current_pidns_info)(struct bpf_pidns_info *buf, + unsigned int buf_size) = + (void *) BPF_FUNC_get_current_pidns_info; /* llvm builtin functions that eBPF C program may use to * emit BPF_LD_ABS and BPF_LD_IND instructions -- 2.11.0