-
Notifications
You must be signed in to change notification settings - Fork 392
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
tetragon: Add debug interface to track cgroups to namespace mappings
Debugging BPF and some kernel functions I want to understand cgroup to namespace/workload/kind mappings at event side. This patch maintains a stable mapping between cgroups and human readable namespaces. The end goal is to filter out noisy namespaces from execs which will be follow up series. This is minimally useful as is. To support this just extend the use of namespace filters from kprobe and tracepoints into a more general space where we can hook selectors. Next steps we can push namespace filters into other sensor types e.g. loader. Signed-off-by: John Fastabend <john.fastabend@gmail.com>
- Loading branch information
Showing
9 changed files
with
207 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // Copyright Authors of Tetragon | ||
|
|
||
| package policyfilter | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "path" | ||
| "path/filepath" | ||
|
|
||
| "github.com/cilium/ebpf" | ||
| "github.com/cilium/tetragon/pkg/bpf" | ||
| "github.com/cilium/tetragon/pkg/option" | ||
| "github.com/cilium/tetragon/pkg/sensors/exec/config" | ||
| lru "github.com/hashicorp/golang-lru/v2" | ||
| ) | ||
|
|
||
| const ( | ||
| CgrpNsMapName = "tg_cgroup_namespace_map" | ||
| namespaceCacheSize = 1024 | ||
| ) | ||
|
|
||
| type NSID struct { | ||
| Namespace string | ||
| Workload string | ||
| Kind string | ||
| } | ||
|
|
||
| // NamespaceMap is a simple wrapper for ebpf.Map so that we can write methods for it | ||
| type NamespaceMap struct { | ||
| cgroupIdMap *ebpf.Map | ||
| nsIdMap *lru.Cache[StateID, NSID] | ||
| nsNameMap *lru.Cache[NSID, StateID] | ||
| id StateID | ||
| } | ||
|
|
||
| // newNamespaceMap returns a new namespace mapping. The namespace map consists of | ||
| // two pieces. First a cgroup to ID map. The ID is useful for BPF so we can avoid | ||
| // strings in BPF side. Then a stable ID to namespace mapping. | ||
| func newNamespaceMap() (*NamespaceMap, error) { | ||
| idCache, err := lru.New[StateID, NSID](namespaceCacheSize) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("create namespace ID cache failed") | ||
| } | ||
| nameCache, err := lru.New[NSID, StateID](namespaceCacheSize) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("create namespace name cache failed") | ||
| } | ||
|
|
||
| objName := config.ExecObj() | ||
| objPath := path.Join(option.Config.HubbleLib, objName) | ||
| spec, err := ebpf.LoadCollectionSpec(objPath) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("loading spec for %s failed: %w", objPath, err) | ||
| } | ||
| nsMapSpec, ok := spec.Maps[CgrpNsMapName] | ||
| if !ok { | ||
| return nil, fmt.Errorf("%s not found in %s", CgrpNsMapName, objPath) | ||
| } | ||
|
|
||
| ret, err := ebpf.NewMap(nsMapSpec) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| mapDir := bpf.MapPrefixPath() | ||
| pinPath := filepath.Join(mapDir, CgrpNsMapName) | ||
| os.Remove(pinPath) | ||
| os.Mkdir(mapDir, os.ModeDir) | ||
| err = ret.Pin(pinPath) | ||
| if err != nil { | ||
| ret.Close() | ||
| return nil, fmt.Errorf("failed to pin Namespace map in %s: %w", pinPath, err) | ||
| } | ||
|
|
||
| return &NamespaceMap{ | ||
| cgroupIdMap: ret, | ||
| nsIdMap: idCache, | ||
| nsNameMap: nameCache, | ||
| id: 1, | ||
| }, err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.