This group is locked. No changes can be made to the group while it is locked.
Re: New bcc helpers
|
Hi, I have implemented helper bpf_get_current_ns_info(void* buf, int size) as was proposed. Let me know if something else is needed or if any other change in the code is required, I'm currently testing this change on bcc tools. Here are the diffs against Kernel 4.13 diff -uN linux/linux-4.13/kernel/bpf/core.c ebpf-backports/new-bcc-helpers/linux-4.13/kernel/bpf/core.c --- linux/linux-4.13/kernel/bpf/core.c 2017-09-03 13:56:17.000000000 -0700 +++ ebpf-backports/new-bcc-helpers/linux-4.13/kernel/bpf/core.c 2017-09-11 04:25:04.200417393 -0700 @@ -1379,6 +1379,9 @@ const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak; const struct bpf_func_proto bpf_get_current_comm_proto __weak; +const struct bpf_func_proto bpf_get_current_ns_info __weak; + + const struct bpf_func_proto * __weak bpf_get_trace_printk_proto(void) { return NULL; diff -uN linux/linux-4.13/kernel/bpf/helpers.c ebpf-backports/new-bcc-helpers/linux-4.13/kernel/bpf/helpers.c --- linux/linux-4.13/kernel/bpf/helpers.c 2017-09-03 13:56:17.000000000 -0700 +++ ebpf-backports/new-bcc-helpers/linux-4.13/kernel/bpf/helpers.c 2017-09-11 06:23:55.329880482 -0700 @@ -18,6 +18,7 @@ #include <linux/sched.h> #include <linux/uidgid.h> #include <linux/filter.h> +#include <linux/pid_namespace.h> /* If kernel subsystem is allowing eBPF programs to call this function, * inside its own verifier_ops->get_func_proto() callback it should return @@ -177,5 +178,51 @@ .gpl_only = false, .ret_type = RET_INTEGER, .arg1_type = ARG_PTR_TO_UNINIT_MEM, + .arg2_type = ARG_CONST_SIZE, +}; + +BPF_CALL_2(bpf_get_current_ns_info, void *, buf, u32, size) +{ + struct task_struct *ts = current; + struct task_struct *ns_task = NULL; + const struct cred *cred = NULL; + pid_t pid; + + if (unlikely(!ts)) + goto err_clear; + + ((struct bpf_current_ns_info*)buf)->ns_id = + ts->nsproxy->pid_ns_for_children->ns.inum; + + pid = task_pid_nr_ns(ts, + ts->nsproxy->pid_ns_for_children); + + ns_task = find_task_by_pid_ns(pid, + ts->nsproxy->pid_ns_for_children); + + if (unlikely(!ns_task)) + goto err_clear; + + ((struct bpf_current_ns_info*)buf)->tgid = ns_task->tgid; + + cred = get_task_cred(ns_task); + + if (unlikely(!cred)) + goto err_clear; + + ((struct bpf_current_ns_info*)buf)->gid = cred->gid.val; + + return 0; + +err_clear: + memset(buf, 0, size); + return -EINVAL; +} + +const struct bpf_func_proto bpf_get_current_ns_info_proto = { + .func = bpf_get_current_ns_info, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_PTR_TO_UNINIT_MEM, .arg2_type = ARG_CONST_SIZE, }; --- linux/linux-4.13/include/linux/bpf.h 2017-09-03 13:56:17.000000000 -0700 +++ ebpf-backports/new-bcc-helpers/linux-4.13/include/linux/bpf.h 2017-09-11 04:36:30.460969799 -0700 @@ -226,6 +226,12 @@ struct file *map_file; struct rcu_head rcu; }; +/* struct used by helper bpf_get_current_ns_info */ +struct bpf_current_ns_info { + u64 ns_id; /*namespace id*/ + u32 tgid; /*tgid inside namespace*/ + u32 gid; /*gid inside namespace*/ +}; u64 bpf_tail_call(u64 ctx, u64 r2, u64 index, u64 r4, u64 r5); u64 bpf_get_stackid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); @@ -375,6 +381,9 @@ extern const struct bpf_func_proto bpf_skb_vlan_pop_proto; extern const struct bpf_func_proto bpf_get_stackid_proto; + +extern const struct bpf_func_proto bpf_get_current_ns_info_proto; + /* Shared helpers among cBPF and eBPF. */ void bpf_user_rnd_init_once(void); u64 bpf_user_rnd_u32(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); --- linux/linux-4.13/include/uapi/linux/bpf.h 2017-09-03 13:56:17.000000000 -0700 +++ ebpf-backports/new-bcc-helpers/linux-4.13/include/uapi/linux/bpf.h 2017-09-11 04:32:08.127055536 -0700 @@ -539,6 +539,15 @@ * @mode: operation mode (enum bpf_adj_room_mode) * @flags: reserved for future use * Return: 0 on success or negative error code + * + * int bpf_get_current_ns_info(void *buf, int size_of_buf) + * stores the following namespace data into + * bpf_current_ns_info struct: + * namespace id + * tgid inside namespace + * gid inside namespace + * Return: 0 on success or negative error + * */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -591,7 +600,9 @@ FN(get_socket_uid), \ FN(set_hash), \ FN(setsockopt), \ - FN(skb_adjust_room), + FN(skb_adjust_room), \ + FN(get_current_ns_info), + /* integer value in 'imm' field of BPF_CALL instruction selects which helper * function eBPF program intends to call On Sat, Sep 9, 2017 at 2:55 PM, carlos antonio neira bustos <cneirabustos@...> wrote:
|