How can I retrieve the mount namespace of the curr

2019-08-11 22:02发布

问题:

I am trying to retrieve the mount namespace of the current task in a BPF program as follows:

task = (struct task_struct *)bpf_get_current_task();
bpf_probe_read(&nsproxy, sizeof(nsproxy), (void *)&task->nsproxy);
bpf_probe_read(&mnt_ns, sizeof(mnt_ns), (void *)&nsproxy->mnt_ns);
bpf_probe_read(&ns, sizeof(ns), (void *)&mnt_ns->ns);
mnt_ns_inum = ns.inum;

This works fine using an Ubuntu kernel (uname -r: 4.15.0-13-generic) and mnt_ns_inum gets a value of 4026531840 for tasks in the host's mount namespace but running the same code using GCP's kernel (uname -r: 4.15.0-1019-gcp) always sets mnt_ns_inum to 0.

I am at a loss as to what Google could have changed to cause this behaviour (I am testing this on a local VM so the only difference between the two cases is the kernel I have booted the VM with and the kernel headers used for compilation).

Additionally, this same code worked for a GCP 4.13 kernel (uname -r: 4.13.0-1008-gcp) so it seems that this is a recent change.

EDIT:

For the 4.15 GCP kernel, the return values for the calls to bpf_probe_read are as follows:

  • 0
  • 18446744073709551602
  • 18446744073709551602

As mentioned in the comments below, the non-zero return values correspond to -EFAULT.