| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 26 Aug 2020 10:41:02 -0700
From: Yonghong Song <yhs@...com>
To: Carlos Neira <cneirabustos@...il.com>, <netdev@...r.kernel.org>
CC: <ebiederm@...ssion.com>, <brouer@...hat.com>,
<bpf@...r.kernel.org>, <andriin@...com>
Subject: Re: [PATCH v1 bpf-next] bpf: new helper bpf_get_current_pcomm
On 8/26/20 9:04 AM, Carlos Neira wrote:
> In multi-threaded applications bpf_get_current_comm is returning per-thread
> names, this helper will return comm from real_parent.
> This makes a difference for some Java applications, where get_current_comm is
> returning per-thread names, but get_current_pcomm will return "java".
>
> Signed-off-by: Carlos Neira <cneirabustos@...il.com>
> ---
> include/linux/bpf.h | 1 +
> include/uapi/linux/bpf.h | 15 ++++-
> kernel/bpf/core.c | 1 +
> kernel/bpf/helpers.c | 28 +++++++++
> kernel/trace/bpf_trace.c | 2 +
> tools/include/uapi/linux/bpf.h | 15 ++++-
> .../selftests/bpf/prog_tests/current_pcomm.c | 57 +++++++++++++++++++
> .../selftests/bpf/progs/test_current_pcomm.c | 17 ++++++
> 8 files changed, 134 insertions(+), 2 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/prog_tests/current_pcomm.c
> create mode 100644 tools/testing/selftests/bpf/progs/test_current_pcomm.c
>
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 81f38e2fda78..93b0c197fd75 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -1754,6 +1754,7 @@ extern const struct bpf_func_proto bpf_skc_to_tcp_sock_proto;
> extern const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto;
> extern const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto;
> extern const struct bpf_func_proto bpf_skc_to_udp6_sock_proto;
> +extern const struct bpf_func_proto bpf_get_current_pcomm_proto;
>
> const struct bpf_func_proto *bpf_tracing_func_proto(
> enum bpf_func_id func_id, const struct bpf_prog *prog);
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 544b89a64918..200a2309e5e1 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -3509,6 +3509,18 @@ union bpf_attr {
> *
> * **-EPERM** This helper cannot be used under the
> * current sock_ops->op.
> + *
> + * long bpf_get_current_pcomm(void *buf, u32 size_of_buf)
> + * Description
> + * Copy the **comm** attribute of the real_parent current task
> + * into *buf* of *size_of_buf*. The **comm** attribute contains
> + * the name of the executable (excluding the path) for real_parent
> + * of current task.
> + * The *size_of_buf* must be strictly positive. On success, the
> + * helper makes sure that the *buf* is NUL-terminated. On failure,
> + * it is filled with zeroes.
> + * Return
> + * 0 on success, or a negative error in case of failure.
> */
> #define __BPF_FUNC_MAPPER(FN) \
[...]
>
> /* integer value in 'imm' field of BPF_CALL instruction selects which helper
> diff --git a/tools/testing/selftests/bpf/prog_tests/current_pcomm.c b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
> new file mode 100644
> index 000000000000..23b708e1c417
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/current_pcomm.c
> @@ -0,0 +1,57 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
> +
> +#define _GNU_SOURCE
> +#include <test_progs.h>
> +#include "test_current_pcomm.skel.h"
> +#include <sys/types.h>
> +#include <unistd.h>
> +#include <string.h>
> +#include <pthread.h>
> +
> +void *current_pcomm(void *args)
> +{
> + struct test_current_pcomm__bss *bss;
> + struct test_current_pcomm *skel;
> + int err, duration = 0;
> +
> + skel = test_current_pcomm__open_and_load();
> + if (CHECK(!skel, "skel_open_load", "failed to load skeleton"))
> + goto cleanup;
> +
> + bss = skel->bss;
> +
> + err = test_current_pcomm__attach(skel);
> + if (CHECK(err, "skel_attach", "skeleton attach failed %d", err))
> + goto cleanup;
> +
> + /* trigger tracepoint */
> + usleep(10);
> + err = memcmp(bss->comm, "current_pcomm2", 14);
> + if (CHECK(!err, "pcomm ", "bss->comm: %s\n", bss->comm))
> + goto cleanup;
> +cleanup:
> + test_current_pcomm__destroy(skel);
> + return NULL;
> +}
> +
> +int test_current_pcomm(void)
> +{
> + int err = 0, duration = 0;
> + pthread_t tid;
> +
> + err = pthread_create(&tid, NULL, ¤t_pcomm, NULL);
> + if (CHECK(err, "thread", "thread creation failed %d", err))
> + return EXIT_FAILURE;
> + err = pthread_setname_np(tid, "current_pcomm2");
> + if (CHECK(err, "thread naming", "thread naming failed %d", err))
> + return EXIT_FAILURE;
> +
> + usleep(5);
> +
> + err = pthread_join(tid, NULL);
> + if (CHECK(err, "thread join", "thread join failed %d", err))
> + return EXIT_FAILURE;
> +
> + return EXIT_SUCCESS;
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_current_pcomm.c b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
> new file mode 100644
> index 000000000000..27dab17ccdd4
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_current_pcomm.c
> @@ -0,0 +1,17 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Carlos Neira cneirabustos@...il.com */
> +
> +#include <linux/bpf.h>
> +#include <stdint.h>
> +#include <bpf/bpf_helpers.h>
> +
> +char comm[16] = {0};
> +
> +SEC("raw_tracepoint/sys_enter")
> +int current_pcomm(const void *ctx)
> +{
> + bpf_get_current_pcomm(comm, sizeof(comm));
I think you want to get the pcomm of the newly created pthread. But
the bpf program here could be triggered by other syscall as well.
You probably want to filter based on the "curr_pcomm" pthread tid.
> + return 0;
> +}
> +
> +char _license[] SEC("license") = "GPL";
>
Powered by blists - more mailing lists