-
Notifications
You must be signed in to change notification settings - Fork 5
bpf: Add bpf_get_task_cmdline kfunc #6389
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bpf: Add bpf_get_task_cmdline kfunc #6389
Conversation
|
Upstream branch: 7dc211c |
c8a7e22 to
c919396
Compare
|
Upstream branch: ec12ab2 |
70150c4 to
b77923c
Compare
c919396 to
73c6b0b
Compare
|
Upstream branch: d6ec090 |
b77923c to
d5d15e5
Compare
73c6b0b to
0bdd2b9
Compare
|
Upstream branch: d6ec090 |
d5d15e5 to
7760bd6
Compare
0bdd2b9 to
729c7ba
Compare
|
Upstream branch: d088da9 |
7760bd6 to
ba2cb68
Compare
729c7ba to
623bab9
Compare
|
Upstream branch: e0940c6 |
ba2cb68 to
f6404fa
Compare
623bab9 to
fe03c14
Compare
|
Upstream branch: 792f258 |
f6404fa to
5a52737
Compare
fe03c14 to
65bfb85
Compare
|
Upstream branch: 878ee3c |
5a52737 to
b30307c
Compare
65bfb85 to
b1f8b58
Compare
|
Upstream branch: ae24fc8 |
b30307c to
19e9d94
Compare
b1f8b58 to
8f7081b
Compare
|
Upstream branch: b7f7d76 |
19e9d94 to
c721f10
Compare
8f7081b to
c347688
Compare
Add the bpf_get_task_cmdline kfunc. One use case is as follows: In production environments, there are often short-lived script tasks executed, and sometimes these tasks may cause stability issues. It is desirable to detect these script tasks via eBPF. The common approach is to check the process name, but it can be difficult to distinguish specific tasks in some cases. Take the shell as an example: some tasks are started via bash xxx.sh – their process name is bash, but the script name of the task can be obtained through the cmdline. Additionally, myabe this is helpful for security auditing purposes. Signed-off-by: Tao Chen <[email protected]>
Create a task, call bpf_get_task_cmdline to retrieve the cmdline, and check if it succeeds. Signed-off-by: Tao Chen <[email protected]>
|
Upstream branch: 4dd3a48 |
c721f10 to
b93f9e4
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1024855 expired. Closing PR. |
Pull request for series with
subject: bpf: Add bpf_get_task_cmdline kfunc
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1024855