Commit ffeedafb authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

bpf: introduce current->pid, tgid, uid, gid, comm accessors 



eBPF programs attached to kprobes need to filter based on
current->pid, uid and other fields, so introduce helper functions:

u64 bpf_get_current_pid_tgid(void)
Return: current->tgid << 32 | current->pid

u64 bpf_get_current_uid_gid(void)
Return: current_gid << 32 | current_uid

bpf_get_current_comm(char *buf, int size_of_buf)
stores current->comm into buf

They can be used from the programs attached to TC as well to classify packets
based on current task fields.

Update tracex2 example to print histogram of write syscalls for each process
instead of aggregated for all.

Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ada6c1de

include/linux/bpf.h

+3 −0
Original line number Diff line number Diff line
@@ -188,5 +188,8 @@ extern const struct bpf_func_proto bpf_get_prandom_u32_proto; 
extern const struct bpf_func_proto bpf_get_smp_processor_id_proto;

extern const struct bpf_func_proto bpf_tail_call_proto;

extern const struct bpf_func_proto bpf_ktime_get_ns_proto;

extern const struct bpf_func_proto bpf_get_current_pid_tgid_proto;

extern const struct bpf_func_proto bpf_get_current_uid_gid_proto;

extern const struct bpf_func_proto bpf_get_current_comm_proto;



#endif /* _LINUX_BPF_H */

include/uapi/linux/bpf.h

+19 −0
Original line number Diff line number Diff line
@@ -230,6 +230,25 @@ enum bpf_func_id { 
	 * Return: 0 on success

	 */

	BPF_FUNC_clone_redirect,



	/**

	 * u64 bpf_get_current_pid_tgid(void)

	 * Return: current->tgid << 32 | current->pid

	 */

	BPF_FUNC_get_current_pid_tgid,



	/**

	 * u64 bpf_get_current_uid_gid(void)

	 * Return: current_gid << 32 | current_uid

	 */

	BPF_FUNC_get_current_uid_gid,



	/**

	 * bpf_get_current_comm(char *buf, int size_of_buf)

	 * stores current->comm into buf

	 * Return: 0 on success

	 */

	BPF_FUNC_get_current_comm,

	__BPF_FUNC_MAX_ID,

};

kernel/bpf/core.c

+3 −0
Original line number Diff line number Diff line
@@ -730,6 +730,9 @@ const struct bpf_func_proto bpf_map_delete_elem_proto __weak; 
const struct bpf_func_proto bpf_get_prandom_u32_proto __weak;

const struct bpf_func_proto bpf_get_smp_processor_id_proto __weak;

const struct bpf_func_proto bpf_ktime_get_ns_proto __weak;

const struct bpf_func_proto bpf_get_current_pid_tgid_proto __weak;

const struct bpf_func_proto bpf_get_current_uid_gid_proto __weak;

const struct bpf_func_proto bpf_get_current_comm_proto __weak;



/* Always built-in helper functions. */

const struct bpf_func_proto bpf_tail_call_proto = {

kernel/bpf/helpers.c

+58 −0
Original line number Diff line number Diff line
@@ -14,6 +14,8 @@ 
#include <linux/random.h>

#include <linux/smp.h>

#include <linux/ktime.h>

#include <linux/sched.h>

#include <linux/uidgid.h>



/* If kernel subsystem is allowing eBPF programs to call this function,

 * inside its own verifier_ops->get_func_proto() callback it should return
@@ -124,3 +126,59 @@ const struct bpf_func_proto bpf_ktime_get_ns_proto = { 
	.gpl_only	= true,

	.ret_type	= RET_INTEGER,

};



static u64 bpf_get_current_pid_tgid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)

{

	struct task_struct *task = current;



	if (!task)

		return -EINVAL;



	return (u64) task->tgid << 32 | task->pid;

}



const struct bpf_func_proto bpf_get_current_pid_tgid_proto = {

	.func		= bpf_get_current_pid_tgid,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

};



static u64 bpf_get_current_uid_gid(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)

{

	struct task_struct *task = current;

	kuid_t uid;

	kgid_t gid;



	if (!task)

		return -EINVAL;



	current_uid_gid(&uid, &gid);

	return (u64) from_kgid(&init_user_ns, gid) << 32 |

		from_kuid(&init_user_ns, uid);

}



const struct bpf_func_proto bpf_get_current_uid_gid_proto = {

	.func		= bpf_get_current_uid_gid,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

};



static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5)

{

	struct task_struct *task = current;

	char *buf = (char *) (long) r1;



	if (!task)

		return -EINVAL;



	memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm)));

	return 0;

}



const struct bpf_func_proto bpf_get_current_comm_proto = {

	.func		= bpf_get_current_comm,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_STACK,

	.arg2_type	= ARG_CONST_STACK_SIZE,

};

kernel/trace/bpf_trace.c

+6 −0
Original line number Diff line number Diff line
@@ -162,6 +162,12 @@ static const struct bpf_func_proto *kprobe_prog_func_proto(enum bpf_func_id func 
		return &bpf_ktime_get_ns_proto;

	case BPF_FUNC_tail_call:

		return &bpf_tail_call_proto;

	case BPF_FUNC_get_current_pid_tgid:

		return &bpf_get_current_pid_tgid_proto;

	case BPF_FUNC_get_current_uid_gid:

		return &bpf_get_current_uid_gid_proto;

	case BPF_FUNC_get_current_comm:

		return &bpf_get_current_comm_proto;



	case BPF_FUNC_trace_printk:

		/*

CRA Git | Maintained and supported by SUSTech CRA and CCSE