src/python: fix filtering by containers when kfunc are supported
authorMauricio Vásquez <mauricio@kinvolk.io>
Wed, 8 Sep 2021 20:15:08 +0000 (15:15 -0500)
committeryonghong-song <ys114321@gmail.com>
Tue, 14 Sep 2021 02:03:07 +0000 (19:03 -0700)
commit4fa2ed7d052921dec3a0d8624f06215feee928c7
tree984df4d6b370b58aaa804a06daef6422a7d1dd45
parent291ec6e99a103953806aa9bf09f18461e3a9e83b
src/python: fix filtering by containers when kfunc are supported

The filtering by mount namespace logic has to access
current_task->nsproxy->mnt_ns->ns.inum to get the mount namespace id. Before
this commit, that line was written in C natural syntax and we're relying on the
BCC rewriter to transform that to valid eBPF code by emitting some
bpf_probe_read calls.

This support was not working when using opensnoop in systems supporting kfuncs
because in this case the BCC rewriter doesn't transform that line and the
verifier claims about an invalid memory access:

7: (85) call bpf_get_current_task#35; return
current_task->nsproxy->mnt_ns->ns.inum; 8: (79) r1 = *(u64 *)(r0 +2896) R0
invalid mem access 'inv'

This commit fixes that by explicitly using bpf_probe_kernel_read() instead of
the C natural syntax.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>
src/python/bcc/containers.py