Re: [PATCH bpf-next 1/5] bpf: Allow helper bpf_get_ns_current_pid_tgid() in cgroup and sk_msg programs

[Yonghong Song <yonghong.song@linux.dev>]

On 3/8/24 5:06 PM, Andrii Nakryiko wrote:
> On Thu, Mar 7, 2024 at 3:27 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>> Currently bpf_get_current_pid_tgid() is allowed in tracing, cgroup
>> and sk_msg progs while bpf_get_ns_current_pid_tgid() is only allowed
>> in tracing progs.
>>
>> We have an internal use case where for an application running
>> in a container (with pid namespace), user wants to get
>> the pid associated with the pid namespace in a cgroup bpf
>> program. Currently, cgroup bpf progs already allow
>> bpf_get_current_pid_tgid(). Let us allow bpf_get_ns_current_pid_tgid()
>> as well.
>>
>> With auditing the code, bpf_get_current_pid_tgid() is also used
>> by sk_msg prog. So I added bpf_get_ns_current_pid_tgid()
>> support for sk_msg prog, so now for all places where
>> bpf_get_current_pid_tgid() can be used, bpf_get_ns_current_pid_tgid()
>> can be used as well.
>>
> If tracing can call both bpf_get_current_pid_tgid() and
> bpf_get_ns_current_pid_tgid(), can't we just add both into
> bpf_base_func_proto() and have them available for all types of BPF
> programs? If it's safe for tracing, it's safe for any program type, so
> why not?

Do we need any capability to control bpf_get_[ns_]current_pid_tgid()?
nothing or CAP_BPF or CAP_PERFMON? In my opinion, pid/tgid
is available to user space and there is no leaking kernel private
data here, so bpf prog should be able to use it in all prog types.
I will wait for a few days. If no people object, I will incorporate
this in v2.

>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
>>   kernel/bpf/cgroup.c | 2 ++
>>   net/core/filter.c   | 2 ++
>>   2 files changed, 4 insertions(+)
>>
>> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
>> index 5a568bbbeaeb..375b92204881 100644
>> --- a/kernel/bpf/cgroup.c
>> +++ b/kernel/bpf/cgroup.c
>> @@ -2577,6 +2577,8 @@ cgroup_current_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>>                  return &bpf_get_current_uid_gid_proto;
>>          case BPF_FUNC_get_current_pid_tgid:
>>                  return &bpf_get_current_pid_tgid_proto;
>> +       case BPF_FUNC_get_ns_current_pid_tgid:
>> +               return &bpf_get_ns_current_pid_tgid_proto;
>>          case BPF_FUNC_get_current_comm:
>>                  return &bpf_get_current_comm_proto;
>>   #ifdef CONFIG_CGROUP_NET_CLASSID
>> diff --git a/net/core/filter.c b/net/core/filter.c
>> index 8adf95765cdd..d4e43303a66b 100644
>> --- a/net/core/filter.c
>> +++ b/net/core/filter.c
>> @@ -8344,6 +8344,8 @@ sk_msg_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
>>                  return &bpf_get_current_uid_gid_proto;
>>          case BPF_FUNC_get_current_pid_tgid:
>>                  return &bpf_get_current_pid_tgid_proto;
>> +       case BPF_FUNC_get_ns_current_pid_tgid:
>> +               return &bpf_get_ns_current_pid_tgid_proto;
>>          case BPF_FUNC_sk_storage_get:
>>                  return &bpf_sk_storage_get_proto;
>>          case BPF_FUNC_sk_storage_delete:
>> --
>> 2.43.0
>>