lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 26 Aug 2020 12:04:24 -0400
From:   Carlos Neira <cneirabustos@...il.com>
To:     netdev@...r.kernel.org
Cc:     yhs@...com, ebiederm@...ssion.com, brouer@...hat.com,
        bpf@...r.kernel.org, andriin@...com, cneirabustos@...il.com
Subject: [PATCH v1 bpf-next] bpf: new helper bpf_get_current_pcomm

In multi-threaded applications bpf_get_current_comm is returning per-thread 
names, this helper will return comm from real_parent.
This makes a difference for some Java applications, where get_current_comm is 
returning per-thread names, but get_current_pcomm will return "java".

Signed-off-by: Carlos Neira <cneirabustos@...il.com>
---
 include/linux/bpf.h                           |  1 +
 include/uapi/linux/bpf.h                      | 15 ++++-
 kernel/bpf/core.c                             |  1 +
 kernel/bpf/helpers.c                          | 28 +++++++++
 kernel/trace/bpf_trace.c                      |  2 +
 tools/include/uapi/linux/bpf.h                | 15 ++++-
 .../selftests/bpf/prog_tests/current_pcomm.c  | 57 +++++++++++++++++++
 .../selftests/bpf/progs/test_current_pcomm.c  | 17 ++++++
 8 files changed, 134 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/current_pcomm.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_current_pcomm.c

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 81f38e2fda78..93b0c197fd75 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1754,6 +1754,7 @@ extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto;
 extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto;
 extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto;
 extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto;
+extern const struct bpf_func_proto bpf_get_current_pcomm_proto;
 
 const struct bpf_func_proto *bpf_tracing_func_proto(
 	enum bpf_func_id func_id, const struct bpf_prog *prog);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 544b89a64918..200a2309e5e1 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3509,6 +3509,18 @@ union bpf_attr {
  *
  *		**-EPERM** This helper cannot be used under the
  *			   current sock_ops->op.
+ *
+ * long bpf_get_current_pcomm(void *buf, u32 size_of_buf)
+ *	Description
+ *		Copy the **comm** attribute of the real_parent current task
+ *		into *buf* of *size_of_buf*. The **comm** attribute contains
+ *		the name of the executable (excluding the path) for real_parent
+ *		of current task.
+ *		The *size_of_buf* must be strictly positive. On success, the
+ *		helper makes sure that the *buf* is NUL-terminated. On failure,
+ *		it is filled with zeroes.
+ *	Return
+ *		0 on success, or a negative error in case of failure.
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3655,7 +3667,8 @@ union bpf_attr {
 	FN(get_task_stack),		\
 	FN(load_hdr_opt),		\
 	FN(store_hdr_opt),		\
-	FN(reserve_hdr_opt),
+	FN(reserve_hdr_opt),		\
+	FN(get_current_pcomm),		\
 	/* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index ed0b3578867c..fd346c2ff6f6 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -2208,6 +2208,7 @@ const struct bpf_func_proto bpf_get_current_cgroup_id_proto __weak;
 const struct bpf_func_proto bpf_get_current_ancestor_cgroup_id_proto __weak;
 const struct bpf_func_proto bpf_get_local_storage_proto __weak;
 const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto __weak;
+const struct bpf_func_proto bpf_get_current_pcomm_proto __weak;
 
 const struct bpf_func_proto * __weak bpf_get_trace_printk_proto(void)
 {
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index be43ab3e619f..9fb663945e0b 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -575,6 +575,34 @@ const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto = {
 	.arg4_type      = ARG_CONST_SIZE,
 };
 
+BPF_CALL_2(bpf_get_current_pcomm, char *, buf, u32, size)
+{
+	struct task_struct *task = current;
+
+	if (unlikely(!task))
+		goto err_clear;
+
+	strncpy(buf, task->real_parent->comm, size);
+
+	/* Verifier guarantees that size > 0. For task->comm exceeding
+	 * size, guarantee that buf is %NUL-terminated. Unconditionally
+	 * done here to save the size test.
+	 */
+	buf[size - 1] = 0;
+	return 0;
+err_clear:
+	memset(buf, 0, size);
+	return -EINVAL;
+}
+
+const struct bpf_func_proto bpf_get_current_pcomm_proto = {
+	.func		= bpf_get_current_pcomm,
+	.gpl_only	= false,
+	.ret_type	= RET_INTEGER,
+	.arg1_type	= ARG_PTR_TO_UNINIT_MEM,
+	.arg2_type	= ARG_CONST_SIZE,
+};
+
 static const struct bpf_func_proto bpf_get_raw_smp_processor_id_proto = {
 	.func		= bpf_get_raw_cpu_id,
 	.gpl_only	= false,
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index a8d4f253ed77..7cfeb58c729a 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1182,6 +1182,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return &bpf_jiffies64_proto;
 	case BPF_FUNC_get_task_stack:
 		return &bpf_get_task_stack_proto;
+	case BPF_FUNC_get_current_pcomm:
+		return &bpf_get_current_pcomm_proto;
 	default:
 		return NULL;
 	}
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 544b89a64918..200a2309e5e1 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3509,6 +3509,18 @@ union bpf_attr {
  *
  *		**-EPERM** This helper cannot be used under the
  *			   current sock_ops->op.
+ *
+ * long bpf_get_current_pcomm(void *buf, u32 size_of_buf)
+ *	Description
+ *		Copy the **comm** attribute of the real_parent current task
+ *		into *buf* of *size_of_buf*. The **comm** attribute contains
+ *		the name of the executable (excluding the path) for real_parent
+ *		of current task.
+ *		The *size_of_buf* must be strictly positive. On success, the
+ *		helper makes sure that the *buf* is NUL-terminated. On failure,
+ *		it is filled with zeroes.
+ *	Return
+ *		0 on success, or a negative error in case of failure.
  */
 #define __BPF_FUNC_MAPPER(FN)		\
 	FN(unspec),			\
@@ -3655,7 +3667,8 @@ union bpf_attr {
 	FN(get_task_stack),		\
 	FN(load_hdr_opt),		\
 	FN(store_hdr_opt),		\
-	FN(reserve_hdr_opt),
+	FN(reserve_hdr_opt),		\
+	FN(get_current_pcomm),		\
 	/* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
diff --git a/tools/testing/selftests/bpf/prog_tests/current_pcomm.c b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
new file mode 100644
index 000000000000..23b708e1c417
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
+
+#define _GNU_SOURCE
+#include <test_progs.h>
+#include "test_current_pcomm.skel.h"
+#include <sys/types.h>
+#include <unistd.h>
+#include <string.h>
+#include <pthread.h>
+
+void *current_pcomm(void *args)
+{
+	struct test_current_pcomm__bss  *bss;
+	struct test_current_pcomm *skel;
+	int err, duration = 0;
+
+	skel = test_current_pcomm__open_and_load();
+	if (CHECK(!skel, "skel_open_load", "failed to load skeleton"))
+		goto cleanup;
+
+	bss = skel->bss;
+
+	err = test_current_pcomm__attach(skel);
+	if (CHECK(err, "skel_attach", "skeleton attach failed %d", err))
+		goto cleanup;
+
+	/* trigger tracepoint */
+	usleep(10);
+	err = memcmp(bss->comm, "current_pcomm2", 14);
+	if (CHECK(!err, "pcomm ", "bss->comm: %s\n", bss->comm))
+		goto cleanup;
+cleanup:
+	test_current_pcomm__destroy(skel);
+	return NULL;
+}
+
+int test_current_pcomm(void)
+{
+	int err = 0, duration = 0;
+	pthread_t tid;
+
+	err = pthread_create(&tid, NULL, &current_pcomm, NULL);
+	if (CHECK(err, "thread", "thread creation failed %d", err))
+		return EXIT_FAILURE;
+	err = pthread_setname_np(tid, "current_pcomm2");
+	if (CHECK(err, "thread naming", "thread naming failed %d", err))
+		return EXIT_FAILURE;
+
+	usleep(5);
+
+	err = pthread_join(tid, NULL);
+	if (CHECK(err, "thread join", "thread join failed %d", err))
+		return EXIT_FAILURE;
+
+	return EXIT_SUCCESS;
+}
diff --git a/tools/testing/selftests/bpf/progs/test_current_pcomm.c b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
new file mode 100644
index 000000000000..27dab17ccdd4
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
+
+#include <linux/bpf.h>
+#include <stdint.h>
+#include <bpf/bpf_helpers.h>
+
+char comm[16] = {0};
+
+SEC("raw_tracepoint/sys_enter")
+int current_pcomm(const void *ctx)
+{
+	bpf_get_current_pcomm(comm, sizeof(comm));
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.20.1

Powered by blists - more mailing lists