1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2023 Bytedance */ 3 4 #include <vmlinux.h> 5 #include <bpf/bpf_tracing.h> 6 #include <bpf/bpf_helpers.h> 7 8 #include "bpf_misc.h" 9 10 struct cgroup *bpf_cgroup_from_id(u64 cgid) __ksym; 11 long bpf_task_under_cgroup(struct task_struct *task, struct cgroup *ancestor) __ksym; 12 void bpf_cgroup_release(struct cgroup *p) __ksym; 13 struct task_struct *bpf_task_acquire(struct task_struct *p) __ksym; 14 void bpf_task_release(struct task_struct *p) __ksym; 15 16 const volatile int local_pid; 17 const volatile __u64 cgid; 18 int remote_pid; 19 20 SEC("tp_btf/task_newtask") 21 int BPF_PROG(handle__task_newtask, struct task_struct *task, u64 clone_flags) 22 { 23 struct cgroup *cgrp = NULL; 24 struct task_struct *acquired; 25 26 if (local_pid != (bpf_get_current_pid_tgid() >> 32)) 27 return 0; 28 29 acquired = bpf_task_acquire(task); 30 if (!acquired) 31 return 0; 32 33 if (local_pid == acquired->tgid) 34 goto out; 35 36 cgrp = bpf_cgroup_from_id(cgid); 37 if (!cgrp) 38 goto out; 39 40 if (bpf_task_under_cgroup(acquired, cgrp)) 41 remote_pid = acquired->tgid; 42 43 out: 44 if (cgrp) 45 bpf_cgroup_release(cgrp); 46 bpf_task_release(acquired); 47 48 return 0; 49 } 50 51 char _license[] SEC("license") = "GPL"; 52