Re: [PATCH net-next 1/3] bpf: introduce current->pid, tgid, uid, gid, comm accessors

On Fri, Jun 12, 2015 at 4:23 PM, Alexei Starovoitov [off-list ref] wrote:

On 6/12/15 3:54 PM, Andy Lutomirski wrote:

quoted

On Fri, Jun 12, 2015 at 3:44 PM, Alexei Starovoitov [off-list ref]
wrote:

quoted

On 6/12/15 3:08 PM, Andy Lutomirski wrote:

quoted

On Fri, Jun 12, 2015 at 2:40 PM, Alexei Starovoitov [off-list ref]
wrote:

quoted

eBPF programs attached to kprobes need to filter based on
current->pid, uid and other fields, so introduce helper functions:

u64 bpf_get_current_pid_tgid(void)
Return: current->tgid << 32 | current->pid

u64 bpf_get_current_uid_gid(void)
Return: current_gid << 32 | current_uid

How does this work wrt namespaces,

from_kuid(current_user_ns(), uid)

Is current_user_ns() well defined in the context of an eBPF program?

What do you mean 'well defined'?
Semantically same as 'current'. Depending on where particular
kprobe is placed, 'current' is either meaningful or not. Program
author needs to know what he's doing. It's a tool.

It's a dangerous tool.  Also, shouldn't the returned uid match the
namespace of the task that installed the probe, not the task that's
being probed?

--Andy