inspektor-gadget

1
// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
2

3
/* Copyright (c) 2021 The Inspektor Gadget authors */
4

5
/* Inspired by the BPF iterator in the Linux tree:
6
 * https://github.com/torvalds/linux/blob/v5.12/tools/testing/selftests/bpf/progs/bpf_iter_task.c
7
 */
8

9
/* This BPF program uses the GPL-restricted function bpf_seq_printf().
10
 */
11

12
#include <vmlinux.h>
13
#include <bpf/bpf_helpers.h>
14

15
#include <gadget/mntns_filter.h>
16

17
const volatile bool show_threads = false;
18

19
struct process_entry {
20
	__u32 tgid;
21
	__u32 pid;
22
	__u32 parent_pid;
23
	__u32 uid;
24
	__u32 gid;
25
	__u64 mntns_id;
26
	__u8 comm[TASK_COMM_LEN];
27
};
28

29
// we need this to make sure the compiler doesn't remove our struct
30
const struct process_entry *unused __attribute__((unused));
31

32
SEC("iter/task")
33
int ig_snap_proc(struct bpf_iter__task *ctx)
34
{
35
	struct seq_file *seq = ctx->meta->seq;
36
	__u32 seq_num = ctx->meta->seq_num;
37
	__u64 session_id = ctx->meta->session_id;
38
	struct task_struct *task = ctx->task;
39
	struct task_struct *parent;
40
	pid_t parent_pid;
41

42
	struct process_entry process = {};
43

44
	if (task == NULL)
45
		return 0;
46

47
	if (!show_threads && task->tgid != task->pid)
48
		return 0;
49

50
	__u64 mntns_id = task->nsproxy->mnt_ns->ns.inum;
51

52
	if (gadget_should_discard_mntns_id(mntns_id))
53
		return 0;
54

55
	parent = task->real_parent;
56
	if (!parent)
57
		parent_pid = -1;
58
	else
59
		parent_pid = parent->pid;
60

61
	__u32 uid = task->cred->uid.val;
62
	__u32 gid = task->cred->gid.val;
63

64
	process.tgid = task->tgid;
65
	process.pid = task->pid;
66
	process.parent_pid = parent_pid;
67
	process.mntns_id = mntns_id;
68
	process.uid = uid;
69
	process.gid = gid;
70
	__builtin_memcpy(process.comm, task->comm, TASK_COMM_LEN);
71

72
	bpf_seq_write(seq, &process, sizeof(process));
73
	return 0;
74
}
75

76
char _license[] SEC("license") = "GPL";
77