lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 26 Aug 2020 10:41:02 -0700
From:   Yonghong Song <yhs@...com>
To:     Carlos Neira <cneirabustos@...il.com>, <netdev@...r.kernel.org>
CC:     <ebiederm@...ssion.com>, <brouer@...hat.com>,
        <bpf@...r.kernel.org>, <andriin@...com>
Subject: Re: [PATCH v1 bpf-next] bpf: new helper bpf_get_current_pcomm



On 8/26/20 9:04 AM, Carlos Neira wrote:
> In multi-threaded applications bpf_get_current_comm is returning per-thread
> names, this helper will return comm from real_parent.
> This makes a difference for some Java applications, where get_current_comm is
> returning per-thread names, but get_current_pcomm will return "java".
> 
> Signed-off-by: Carlos Neira <cneirabustos@...il.com>
> ---
>   include/linux/bpf.h                           |  1 +
>   include/uapi/linux/bpf.h                      | 15 ++++-
>   kernel/bpf/core.c                             |  1 +
>   kernel/bpf/helpers.c                          | 28 +++++++++
>   kernel/trace/bpf_trace.c                      |  2 +
>   tools/include/uapi/linux/bpf.h                | 15 ++++-
>   .../selftests/bpf/prog_tests/current_pcomm.c  | 57 +++++++++++++++++++
>   .../selftests/bpf/progs/test_current_pcomm.c  | 17 ++++++
>   8 files changed, 134 insertions(+), 2 deletions(-)
>   create mode 100644 tools/testing/selftests/bpf/prog_tests/current_pcomm.c
>   create mode 100644 tools/testing/selftests/bpf/progs/test_current_pcomm.c
> 
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 81f38e2fda78..93b0c197fd75 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1754,6 +1754,7 @@ extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto;
>   extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto;
>   extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto;
>   extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto;
> +extern const struct bpf_func_proto bpf_get_current_pcomm_proto;
>   
>   const struct bpf_func_proto *bpf_tracing_func_proto(
>   	enum bpf_func_id func_id, const struct bpf_prog *prog);
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 544b89a64918..200a2309e5e1 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -3509,6 +3509,18 @@ union bpf_attr {
>    *
>    *		**-EPERM** This helper cannot be used under the
>    *			   current sock_ops->op.
> + *
> + * long bpf_get_current_pcomm(void *buf, u32 size_of_buf)
> + *	Description
> + *		Copy the **comm** attribute of the real_parent current task
> + *		into *buf* of *size_of_buf*. The **comm** attribute contains
> + *		the name of the executable (excluding the path) for real_parent
> + *		of current task.
> + *		The *size_of_buf* must be strictly positive. On success, the
> + *		helper makes sure that the *buf* is NUL-terminated. On failure,
> + *		it is filled with zeroes.
> + *	Return
> + *		0 on success, or a negative error in case of failure.
>    */
>   #define __BPF_FUNC_MAPPER(FN)		\
[...]
>   
>   /* integer value in 'imm' field of BPF_CALL instruction selects which helper
> diff --git a/tools/testing/selftests/bpf/prog_tests/current_pcomm.c b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
> new file mode 100644
> index 000000000000..23b708e1c417
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
> @@ -0,0 +1,57 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
> +
> +#define _GNU_SOURCE
> +#include <test_progs.h>
> +#include "test_current_pcomm.skel.h"
> +#include <sys/types.h>
> +#include <unistd.h>
> +#include <string.h>
> +#include <pthread.h>
> +
> +void *current_pcomm(void *args)
> +{
> +	struct test_current_pcomm__bss  *bss;
> +	struct test_current_pcomm *skel;
> +	int err, duration = 0;
> +
> +	skel = test_current_pcomm__open_and_load();
> +	if (CHECK(!skel, "skel_open_load", "failed to load skeleton"))
> +		goto cleanup;
> +
> +	bss = skel->bss;
> +
> +	err = test_current_pcomm__attach(skel);
> +	if (CHECK(err, "skel_attach", "skeleton attach failed %d", err))
> +		goto cleanup;
> +
> +	/* trigger tracepoint */
> +	usleep(10);
> +	err = memcmp(bss->comm, "current_pcomm2", 14);
> +	if (CHECK(!err, "pcomm ", "bss->comm: %s\n", bss->comm))
> +		goto cleanup;
> +cleanup:
> +	test_current_pcomm__destroy(skel);
> +	return NULL;
> +}
> +
> +int test_current_pcomm(void)
> +{
> +	int err = 0, duration = 0;
> +	pthread_t tid;
> +
> +	err = pthread_create(&tid, NULL, &current_pcomm, NULL);
> +	if (CHECK(err, "thread", "thread creation failed %d", err))
> +		return EXIT_FAILURE;
> +	err = pthread_setname_np(tid, "current_pcomm2");
> +	if (CHECK(err, "thread naming", "thread naming failed %d", err))
> +		return EXIT_FAILURE;
> +
> +	usleep(5);
> +
> +	err = pthread_join(tid, NULL);
> +	if (CHECK(err, "thread join", "thread join failed %d", err))
> +		return EXIT_FAILURE;
> +
> +	return EXIT_SUCCESS;
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_current_pcomm.c b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
> new file mode 100644
> index 000000000000..27dab17ccdd4
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
> @@ -0,0 +1,17 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
> +
> +#include <linux/bpf.h>
> +#include <stdint.h>
> +#include <bpf/bpf_helpers.h>
> +
> +char comm[16] = {0};
> +
> +SEC("raw_tracepoint/sys_enter")
> +int current_pcomm(const void *ctx)
> +{
> +	bpf_get_current_pcomm(comm, sizeof(comm));

I think you want to get the pcomm of the newly created pthread. But
the bpf program here could be triggered by other syscall as well.
You probably want to filter based on the "curr_pcomm" pthread tid.

> +	return 0;
> +}
> +
> +char _license[] SEC("license") = "GPL";
> 

Powered by blists - more mailing lists