From bf533b84fd7200399c9b0e68fdf10c6aaf8b1a7a Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?=C3=81kos=20Uzonyi?= <uzonyi.akos@gmail.com>

Date: Mon, 8 Jun 2020 19:01:03 +0200

Subject: [PATCH 134/138] PID namespace translation support

* defs.h (pidns_translation): New variable.

(tcb): Add pid_ns field.

(RVAL_MASK): Change value from 013 to 017.

(RVAL_TID, RVAL_SID, RVAL_TGID, RVAL_PGID): New definitions.

(pid_type): New enum.

(pidns_init, translate_pid, get_proc_pid, printpid, printpid_tgid_pgid):

New function declarations.

* largefile_wrappers.h (fstat_fd): New macro.

* pidns.c: New file.

* trie.c: New file.

* trie.h: New file.

* Makefile.am (libstrace_a_SOURCES): Add trie.c, trie.h, pidns.c.

* strace.c (pidns_translation): New variable.

(init): Add --pidns-translation option.

* syscall.c (syscall_exiting_trace): Handle RVAL_* return values.

* NEWS: Mention this.

* strace.1.in: Add description for new option.

Co-Authored-by: Eugene Syromyatnikov <evgsyr@gmail.com>

Conflicts:

	NEWS

---

 Makefile.am          |   3 +

 defs.h               |  56 ++++-

 largefile_wrappers.h |   2 +

 pidns.c              | 608 +++++++++++++++++++++++++++++++++++++++++++++++++++

 strace.1.in          |   4 +

 strace.c             |   9 +

 syscall.c            |  15 ++

 trie.c               | 290 ++++++++++++++++++++++++

 trie.h               |  92 ++++++++

 9 files changed, 1078 insertions(+), 1 deletion(-)

 create mode 100644 pidns.c

 create mode 100644 trie.c

 create mode 100644 trie.h

Index: strace-5.7/Makefile.am

===================================================================

--- strace-5.7.orig/Makefile.am	2020-09-09 15:50:13.471900510 +0200

+++ strace-5.7/Makefile.am	2020-09-09 15:52:09.159983257 +0200

@@ -233,6 +233,7 @@

 	personality.c	\

 	pidfd_getfd.c	\

 	pidfd_open.c	\

+	pidns.c		\

 	pkeys.c		\

 	poll.c		\

 	prctl.c		\

@@ -344,6 +345,8 @@

 	time.c		\

 	times.c		\

 	trace_event.h	\

+	trie.c 		\

+	trie.h 		\

 	truncate.c	\

 	ubi.c		\

 	ucopy.c		\

Index: strace-5.7/defs.h

===================================================================

--- strace-5.7.orig/defs.h	2020-09-09 15:50:13.473900511 +0200

+++ strace-5.7/defs.h	2020-09-09 15:52:09.159983257 +0200

@@ -280,6 +280,13 @@

 	struct timespec etime;	/* Syscall entry time (CLOCK_MONOTONIC) */

 	struct timespec delay_expiration_time; /* When does the delay end */

+	/*

+	 * The ID of the PID namespace of this process

+	 * (inode number of /proc/<pid>/ns/pid)

+	 * (0: not initialized)

+	 */

+	unsigned int pid_ns;

+

 	struct mmap_cache_t *mmap_cache;

 	/*

@@ -413,7 +420,11 @@

 # define RVAL_HEX	001	/* hex format */

 # define RVAL_OCTAL	002	/* octal format */

 # define RVAL_FD		010	/* file descriptor */

-# define RVAL_MASK	013	/* mask for these values */

+# define RVAL_TID	011	/* task ID */

+# define RVAL_SID	012	/* session ID */

+# define RVAL_TGID	013	/* thread group ID */

+# define RVAL_PGID	014	/* process group ID */

+# define RVAL_MASK	017	/* mask for these values */

 # define RVAL_STR	020	/* Print `auxstr' field after return val */

 # define RVAL_NONE	040	/* Print nothing */

@@ -428,6 +439,16 @@

 # define indirect_ipccall(tcp) (tcp_sysent(tcp)->sys_flags & TRACE_INDIRECT_SUBCALL)

+enum pid_type {

+	PT_TID,

+	PT_TGID,

+	PT_PGID,

+	PT_SID,

+

+	PT_COUNT,

+	PT_NONE = -1

+};

+

 enum sock_proto {

 	SOCK_PROTO_UNKNOWN,

 	SOCK_PROTO_UNIX,

@@ -469,6 +490,7 @@

 extern int Tflag_width;

 extern bool iflag;

 extern bool count_wallclock;

+extern unsigned int pidns_translation;

 /* are we filtering traces based on paths? */

 extern struct path_set {

 	const char **paths_selected;

@@ -984,6 +1006,29 @@

 extern kernel_ulong_t *

 fetch_indirect_syscall_args(struct tcb *, kernel_ulong_t addr, unsigned int n_args);

+extern void pidns_init(void);

+

+/**

+ * Returns the pid of the tracee as present in /proc of the tracer (can be

+ * different from tcp->pid if /proc and the tracer process are in different PID

+ * namespaces).

+ */

+extern int get_proc_pid(struct tcb *);

+

+/**

+ * Translates a pid from tracee's namespace to our namepace.

+ *

+ * @param tcp             The tcb of the tracee

+ *                        (NULL: from_id is in strace's namespace. Useful for

+ *                         getting the proc PID of from_id)

+ * @param from_id         The id to be translated

+ * @param type            The PID type of from_id

+ * @param proc_pid_ptr    If not NULL, writes the proc PID to this location

+ * @return                The translated id, or 0 if translation fails.

+ */

+extern int translate_pid(struct tcb *, int dest_id, enum pid_type type,

+		    int *proc_pid_ptr);

+

 extern void

 dumpiov_in_msghdr(struct tcb *, kernel_ulong_t addr, kernel_ulong_t data_size);

@@ -1059,6 +1104,15 @@

  * of the tracee the descriptor tcp).  This is a stub.

  */

 extern void printfd_pid_tracee_ns(struct tcb *tcp, pid_t pid, int fd);

+

+/** Prints a PID specified in the tracee's PID namespace */

+extern void printpid(struct tcb *, int pid, enum pid_type type);

+

+/**

+ * Prints pid as a TGID if positive, and PGID if negative

+ * (like the first argument of kill).

+ */

+extern void printpid_tgid_pgid(struct tcb *, int pid);

 extern void print_sockaddr(struct tcb *, const void *sa, int len);

 extern bool

 print_inet_addr(int af, const void *addr, unsigned int len, const char *var_name);

Index: strace-5.7/largefile_wrappers.h

===================================================================

--- strace-5.7.orig/largefile_wrappers.h	2020-09-09 15:50:13.473900511 +0200

+++ strace-5.7/largefile_wrappers.h	2020-09-09 15:50:18.017903762 +0200

@@ -29,6 +29,7 @@

 #  else

 #   define fcntl_fd fcntl

 #  endif

+#  define fstat_fd fstat64

 #  define strace_stat_t struct stat64

 #  define stat_file stat64

 #  define struct_dirent struct dirent64

@@ -39,6 +40,7 @@

 #  define open_file open

 #  define fopen_stream fopen

 #  define fcntl_fd fcntl

+#  define fstat_fd fstat

 #  define strace_stat_t struct stat

 #  define stat_file stat

 #  define struct_dirent struct dirent

Index: strace-5.7/pidns.c

===================================================================

--- /dev/null	1970-01-01 00:00:00.000000000 +0000

+++ strace-5.7/pidns.c	2020-09-09 15:50:18.018903762 +0200

@@ -0,0 +1,608 @@

+/*

+ * Copyright (c) 2020 Ákos Uzonyi <uzonyi.akos@gmail.com>

+ * All rights reserved.

+ *

+ * SPDX-License-Identifier: LGPL-2.1-or-later

+ */

+

+#include "defs.h"

+

+

+#include <dirent.h>

+#include <fcntl.h>

+#include <stdint.h>

+#include <string.h>

+#include <unistd.h>

+

+#include <asm/unistd.h>

+

+#include <sys/ioctl.h>

+#include <sys/param.h>

+#include <sys/types.h>

+#include <sys/stat.h>

+

+#include "largefile_wrappers.h"

+#include "trie.h"

+#include "nsfs.h"

+#include "xmalloc.h"

+#include "xstring.h"

+

+/**

+ * Key:   PID NS ID

+ * Value: a btree:

+ *           Key:   a process PID in NS

+ *           Value: the process's PID as present in /proc

+ */

+static struct trie *ns_pid_to_proc_pid[PT_COUNT];

+

+/**

+ * Key:   Proc PID

+ * Value: struct proc_data

+ */

+static struct trie *proc_data_cache;

+

+static bool ns_get_parent_enotty = false;

+

+static const char tid_str[]  = "NSpid:\t";

+static const char tgid_str[] = "NStgid:\t";

+static const char pgid_str[] = "NSpgid:\t";

+static const char sid_str[]  = "NSsid:\t";

+

+static const struct {

+	const char *str;

+	size_t size;

+} id_strs[PT_COUNT] = {

+	[PT_TID] =  { tid_str,  sizeof(tid_str)  - 1 },

+	[PT_TGID] = { tgid_str, sizeof(tgid_str) - 1 },

+	[PT_PGID] = { pgid_str, sizeof(pgid_str) - 1 },

+	[PT_SID] =  { sid_str,  sizeof(sid_str)  - 1 },

+};

+

+

+/**

+ * Limit on PID NS hierarchy depth, imposed since Linux 3.7. NS traversal

+ * is not possible before Linux 4.9, so we consider this limit pretty universal.

+ */

+#define MAX_NS_DEPTH 32

+

+static const size_t ns_id_size = sizeof(unsigned int) * 8;

+static const uint8_t ptr_sz_lg = (sizeof(void *) == 8 ? 6 : 5);

+

+static int pid_max;

+static uint8_t pid_max_size, pid_max_size_lg;

+

+struct proc_data {

+	int proc_pid;

+	int ns_count;

+	unsigned int ns_hierarchy[MAX_NS_DEPTH];

+	int id_count[PT_COUNT];

+	int id_hierarchy[PT_COUNT][MAX_NS_DEPTH];

+};

+

+/**

+ * Helper function for creating a trie.

+ *

+ * For node_key_bits and data_block_key_bits 4 is used (so trie height is 32 / 4

+ * = 8, and node sizes are 8 byte * 2^4 = 128 bytes), which seems to be a good

+ * tradeoff between memory usage and lookup time. It should not be too large,

+ * since there can be large holes between PIDs, and it would be just a waste of

+ * memory having large nodes with lot of NULL pointers in them.

+ */

+static struct trie *

+create_trie_4(uint8_t key_size, uint8_t item_size_lg, uint64_t empty_value)

+{

+	struct trie *t = trie_create(key_size, item_size_lg, 4, 4, empty_value);

+	if (!t)

+		error_msg_and_die("creating trie failed");

+

+	return t;

+}

+

+void

+pidns_init(void)

+{

+	if (proc_data_cache)

+		return;

+

+	pid_max = INT_MAX;

+	if (read_int_from_file("/proc/sys/kernel/pid_max", &pid_max) < 0)

+		debug_func_perror_msg("reading /proc/sys/kernel/pid_max");

+	pid_max_size = ilog2_32(pid_max - 1) + 1;

+	pid_max_size_lg = ilog2_32(pid_max_size - 1) + 1;

+

+	for (int i = 0; i < PT_COUNT; i++)

+		ns_pid_to_proc_pid[i] = create_trie_4(ns_id_size, ptr_sz_lg, 0);

+

+	proc_data_cache = create_trie_4(pid_max_size, ptr_sz_lg, 0);

+}

+

+static void

+put_proc_pid(unsigned int ns, int ns_pid, enum pid_type type, int proc_pid)

+{

+	struct trie *b = (struct trie *) (uintptr_t) trie_get(ns_pid_to_proc_pid[type], ns);

+	if (!b) {

+		b = create_trie_4(pid_max_size, pid_max_size_lg, 0);

+		trie_set(ns_pid_to_proc_pid[type], ns, (uint64_t) (uintptr_t) b);

+	}

+	trie_set(b, ns_pid, proc_pid);

+}

+

+static int

+get_cached_proc_pid(unsigned int ns, int ns_pid, enum pid_type type)

+{

+	struct trie *b = (struct trie *) (uintptr_t)

+		trie_get(ns_pid_to_proc_pid[type], ns);

+	if (!b)

+		return 0;

+

+	return trie_get(b, ns_pid);

+}

+

+/**

+ * Helper function, converts pid to string, or to "self" for pid == 0.

+ * Uses static buffer for operation.

+ */

+static const char *

+pid_to_str(pid_t pid)

+{

+	if (!pid)

+		return "self";

+

+	static char buf[sizeof("-2147483648")];

+	xsprintf(buf, "%d", pid);

+	return buf;

+}

+

+/**

+ * Returns a list of PID NS IDs for the specified PID.

+ *

+ * @param proc_pid PID (as present in /proc) to get information for.

+ * @param ns_buf   Pointer to buffer that is able to contain at least

+ *                 ns_buf_size items.

+ * @return         Amount of NS in list. 0 indicates error.

+ */

+static size_t

+get_ns_hierarchy(int proc_pid, unsigned int *ns_buf, size_t ns_buf_size)

+{

+	char path[PATH_MAX + 1];

+	xsprintf(path, "/proc/%s/ns/pid", pid_to_str(proc_pid));

+

+	int fd = open_file(path, O_RDONLY);

+	if (fd < 0)

+		return 0;

+

+	size_t n = 0;

+	while (n < ns_buf_size) {

+		strace_stat_t st;

+		if (fstat_fd(fd, &st))

+			break;

+

+		ns_buf[n++] = st.st_ino;

+		if (n >= ns_buf_size)

+			break;

+

+		if (ns_get_parent_enotty)

+			break;

+

+		int parent_fd = ioctl(fd, NS_GET_PARENT);

+		if (parent_fd < 0) {

+			switch (errno) {

+			case EPERM:

+				break;

+

+			case ENOTTY:

+				ns_get_parent_enotty = true;

+				error_msg("NS_* ioctl commands are not "

+					  "supported by the kernel");

+				break;

+

+			default:

+				perror_func_msg("ioctl(NS_GET_PARENT)");

+				break;

+			}

+

+			break;

+		}

+

+		close(fd);

+		fd = parent_fd;

+	}

+

+	close(fd);

+

+	return n;

+}

+

+/**

+ * Get list of IDs present in NS* proc status record. IDs are placed as they are

+ * stored in /proc (from top to bottom of NS hierarchy).

+ *

+ * @param proc_pid    PID (as present in /proc) to get information for.

+ * @param id_buf      Pointer to buffer that is able to contain at least

+ *                    MAX_NS_DEPTH items. Can be NULL.

+ * @param type        Type of ID requested.

+ * @return            Number of items stored in id_list. 0 indicates error.

+ */

+static size_t

+get_id_list(int proc_pid, int *id_buf, enum pid_type type)

+{

+	const char *ns_str = id_strs[type].str;

+	size_t ns_str_size = id_strs[type].size;

+

+	size_t n = 0;

+

+	char status_path[PATH_MAX + 1];

+	xsprintf(status_path, "/proc/%s/status", pid_to_str(proc_pid));

+	FILE *f = fopen_stream(status_path, "r");

+	if (!f)

+		return 0;

+

+	char *line = NULL;

+	size_t linesize = 0;

+	char *p = NULL;

+

+	while (getline(&line, &linesize, f) > 0) {

+		if (strncmp(line, ns_str, ns_str_size) == 0) {

+			p = line + ns_str_size;

+			break;

+		}

+	}

+

+	while (p) {

+		errno = 0;

+		long id = strtol(p, NULL, 10);

+

+		if (id < 0 || id > INT_MAX || errno) {

+			perror_func_msg("converting pid (%ld) to int", id);

+			break;

+		}

+

+		if (id_buf)

+			id_buf[n] = (int) id;

+

+		n++;

+		strsep(&p, "\t");

+	}

+

+	free(line);

+	fclose(f);

+

+	return n;

+}

+

+/**

+ * Returns whether the /proc filesystem's PID namespace is the same as strace's.

+ */

+static bool

+is_proc_ours(void)

+{

+	static int cached_val = -1;

+

+	if (cached_val < 0)

+		cached_val = get_id_list(0, NULL, PT_TID) <= 1;

+

+	return cached_val;

+}

+

+/**

+ * Returns the PID namespace of the tracee

+ */

+static unsigned int

+get_ns(struct tcb *tcp)

+{

+	if (!tcp->pid_ns) {

+		int proc_pid = 0;

+		translate_pid(NULL, tcp->pid, PT_TID, &proc_pid);

+

+		if (proc_pid)

+			get_ns_hierarchy(proc_pid, &tcp->pid_ns, 1);

+	}

+

+	return tcp->pid_ns;

+}

+

+/**

+ * Returns the PID namespace of strace

+ */

+static unsigned int

+get_our_ns(void)

+{

+	static unsigned int our_ns = 0;

+	static bool our_ns_initialised = false;

+

+	if (!our_ns_initialised) {

+		get_ns_hierarchy(0, &our_ns, 1);

+		our_ns_initialised = true;

+	}

+

+	return our_ns;

+}

+

+/**

+ * Returns the cached proc_data struct associated with proc_pid.

+ * If none found, allocates a new proc_data.

+ */

+static struct proc_data *

+get_or_create_proc_data(int proc_pid)

+{

+	struct proc_data *pd = (struct proc_data *) (uintptr_t)

+		trie_get(proc_data_cache, proc_pid);

+

+	if (!pd) {

+		pd = calloc(1, sizeof(*pd));

+		if (!pd)

+			return NULL;

+

+		pd->proc_pid = proc_pid;

+		trie_set(proc_data_cache, proc_pid, (uint64_t) (uintptr_t) pd);

+	}

+

+	return pd;

+}

+

+/**

+ * Updates the proc_data from /proc

+ * If the process does not exists, returns false, and frees the proc_data

+ */

+static bool

+update_proc_data(struct proc_data *pd, enum pid_type type)

+{

+	pd->ns_count = get_ns_hierarchy(pd->proc_pid,

+		pd->ns_hierarchy, MAX_NS_DEPTH);

+	if (!pd->ns_count)

+		goto fail;

+

+	pd->id_count[type] = get_id_list(pd->proc_pid,

+		pd->id_hierarchy[type], type);

+	if (!pd->id_count[type])

+		goto fail;

+

+	return true;

+

+fail:

+	trie_set(proc_data_cache, pd->proc_pid, (uint64_t) (uintptr_t) NULL);

+	free(pd);

+	return false;

+}

+

+/**

+ * Paramters for id translation

+ */

+struct translate_id_params {

+	/* The result (output) */

+	int result_id;

+	/* The proc data of the process (output) */

+	struct proc_data *pd;

+

+	/* The namespace to be translated from */

+	unsigned int from_ns;

+	/* The id to be translated */

+	int from_id;

+	/* The type of the id */

+	enum pid_type type;

+};

+

+/**

+ * Translates an id to our namespace, given the proc_pid of the process,

+ * by reading files in /proc.

+ *

+ * @param tip      The parameters

+ * @param proc_pid The proc pid of the process.

+ *                 If 0, use the cached values in tip->pd.

+ */

+static void

+translate_id_proc_pid(struct translate_id_params *tip, int proc_pid)

+{

+	struct proc_data *pd = proc_pid ?

+		get_or_create_proc_data(proc_pid) :

+		tip->pd;

+

+	tip->result_id = 0;

+	tip->pd = NULL;

+

+	if (!pd)

+		return;

+

+	if (proc_pid && !update_proc_data(pd, tip->type))

+		return;

+

+	if (!pd->ns_count || pd->id_count[tip->type] < pd->ns_count)

+		return;

+

+	int *id_hierarchy = pd->id_hierarchy[tip->type];

+	int id_count = pd->id_count[tip->type];

+

+	for (int i = 0; i < pd->ns_count; i++) {

+		unsigned int ns = pd->ns_hierarchy[i];

+		int ns_id = id_hierarchy[id_count - i - 1];

+		int our_id = id_hierarchy[id_count - pd->ns_count];

+

+		if (ns != tip->from_ns)

+			continue;

+

+		if (ns_id != tip->from_id)

+			return;

+

+		tip->result_id = our_id;

+		tip->pd = pd;

+		return;

+	}

+}

+

+/**

+ * Translates an id to our namespace by reading all proc entries in a directory.

+ * The directory is either /proc or /proc/<pid>/task.

+ *

+ *

+ * @param tip            The parameters

+ * @param path           The path of the directory to be read.

+ * @param read_task_dir  Whether recurse to "task" subdirectory.

+ */

+static void

+translate_id_dir(struct translate_id_params *tip, const char *path,

+                 bool read_task_dir)

+{

+	DIR *dir = opendir(path);

+	if (!dir) {

+		debug_func_perror_msg("opening dir: %s", path);

+		return;

+	}

+

+	while (!tip->result_id) {

+		errno = 0;

+		struct_dirent *entry = read_dir(dir);

+		if (!entry) {

+			if (errno)

+				perror_func_msg("readdir");

+

+			break;

+		}

+

+		if (entry->d_type != DT_DIR)

+			continue;

+

+		errno = 0;

+		long proc_pid = strtol(entry->d_name, NULL, 10);

+		if (proc_pid < 1 || proc_pid > INT_MAX || errno)

+			continue;

+

+		if (read_task_dir) {

+			char task_dir_path[PATH_MAX + 1];

+			xsprintf(task_dir_path, "/proc/%ld/task", proc_pid);

+			translate_id_dir(tip, task_dir_path, false);

+		}

+

+		if (tip->result_id)

+			break;

+

+		translate_id_proc_pid(tip, proc_pid);

+	}

+

+	closedir(dir);

+}

+

+/**

+ * Iterator function of the proc_data_cache for id translation.

+ * If the cache contains the id we are looking for, reads the corresponding

+ * directory in /proc, and if cache is valid, saves the result.

+ */

+static void

+proc_data_cache_iterator_fn(void* fn_data, uint64_t key, uint64_t val)

+{

+	struct translate_id_params *tip = (struct translate_id_params *)fn_data;

+	struct proc_data *pd = (struct proc_data *) (uintptr_t) val;

+

+	if (!pd)

+		return;

+

+	/* Result already found in an earlier iteration */

+	if (tip->result_id)

+		return;

+

+	/* Translate from cache */

+	tip->pd = pd;

+	translate_id_proc_pid(tip, 0);

+	if (!tip->result_id)

+		return;

+

+	/* Now translate from actual data in /proc, to check cache validity */

+	translate_id_proc_pid(tip, pd->proc_pid);

+}

+

+int

+translate_pid(struct tcb *tcp, int from_id, enum pid_type type,

+              int *proc_pid_ptr)

+{

+	if (from_id <= 0 || type < 0 || type >= PT_COUNT)

+		return 0;

+

+	/* If translation is trivial */

+	if ((!tcp || get_ns(tcp) == get_our_ns()) &&

+	    (!proc_pid_ptr || is_proc_ours())) {

+		if (proc_pid_ptr)

+			*proc_pid_ptr = from_id;

+

+		return from_id;

+	}

+

+	struct translate_id_params tip = {

+		.result_id = 0,