-
Notifications
You must be signed in to change notification settings - Fork 93
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
runc: add eBPF exit snoop for sandbox recovery
- Loading branch information
Showing
6 changed files
with
156 additions
and
10 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,36 @@ | ||
#include<linux/sched.h> | ||
|
||
struct process_exit_data_t { | ||
u64 start_time; | ||
u64 exit_time; | ||
u32 pid; | ||
u32 tid; | ||
u32 ppid; | ||
int exit_code; | ||
u32 sig_info; | ||
char task[TASK_COMM_LEN]; | ||
}; | ||
|
||
BPF_PERF_OUTPUT(events); | ||
|
||
//TRACEPOINT_PROBE(sched, sched_process_exit) | ||
int sched_process_exit_handler(struct tracepoint__sched__sched_process_exit *args) | ||
{ | ||
struct task_struct *task = (typeof(task)) bpf_get_current_task(); | ||
struct process_exit_data_t data = {}; | ||
//data.start_time = PROCESS_START_TIME_NS, | ||
if (task->pid != task->tgid) { | ||
return 0; | ||
} | ||
data.start_time = task->start_time; | ||
data.exit_time = bpf_ktime_get_ns(); | ||
data.pid = task-> tgid; | ||
data.tid = task->pid; | ||
data.ppid = task -> real_parent->tgid; | ||
data.exit_code = task->exit_code >> 8; | ||
data.sig_info = task->exit_code & 0xFF; | ||
bpf_get_current_comm(&data.task, sizeof(data.task)); | ||
|
||
events.perf_submit(args, &data, sizeof(data)); | ||
return 0; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
use bcc::{BPF, Tracepoint}; | ||
use bcc::perf_event::PerfMapBuilder; | ||
use containerd_shim::monitor::monitor_notify_by_pid; | ||
use log::error; | ||
use containerd_sandbox::error::Result; | ||
use std::sync::{Arc, Mutex}; | ||
|
||
#[repr(C)] | ||
struct process_exit_data_t { | ||
start_time: u64, | ||
exit_time: u64, | ||
pid: u32, | ||
tid: u32, | ||
ppid: u32, | ||
exit_code: i32, | ||
sig_info: u32, | ||
task: [u8; 16], | ||
} | ||
|
||
pub fn monit_process_exit(monitor_pid_list: Vec<u32>) -> Result<()> { | ||
if monitor_pid_list.is_empty() { | ||
return Ok(()); | ||
} | ||
let pids = Arc::new(Mutex::new(monitor_pid_list)); | ||
std::thread::spawn(move || { | ||
let code = include_str!("exitsnoop.c"); | ||
let mut module = BPF::new(code).unwrap(); | ||
Tracepoint::new().handler("sched_process_exit_handler").subsystem("sched").tracepoint("sched_process_exit").attach(&mut module).unwrap(); | ||
let table = module.table("events").unwrap(); | ||
let mut perf_map = PerfMapBuilder::new(table, || { data_callback(pids.clone()) }).build().unwrap(); | ||
|
||
while !pids.lock().unwrap().is_empty() { | ||
perf_map.poll(200); | ||
} | ||
}); | ||
Ok(()) | ||
} | ||
|
||
fn data_callback(monitor_pids: Arc<Mutex<Vec<u32>>>) -> Box<dyn FnMut(&[u8]) + Send> { | ||
Box::new(move |x| { | ||
let data = parse_struct(x); | ||
let exit_code = if data.sig_info == 0 { | ||
data.exit_code | ||
} else { | ||
(data.sig_info & 0x7F) as i32 + 128 | ||
}; | ||
monitor_pids.lock().unwrap().retain(|&pid| { | ||
if data.pid == pid { | ||
crate::RT.spawn(async move { | ||
monitor_notify_by_pid(pid as i32, exit_code) | ||
.await | ||
.unwrap_or_else(|e| error!("failed to send exit event {}", e)); | ||
}); | ||
false | ||
} else { | ||
true | ||
} | ||
}); | ||
}) | ||
} | ||
|
||
fn parse_struct(x: &[u8]) -> process_exit_data_t { | ||
unsafe { std::ptr::read_unaligned(x.as_ptr() as *const process_exit_data_t) } | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters