简体   繁体   中英

How can I retrieve a task's sessionid in an eBPF program?

I want to retrieve the sessionid from a task struct in an eBPF program. I have the following code in my eBPF program:

struct task_struct *task;
u32 sessionid;    

task = (struct task_struct *)bpf_get_current_task();
sessionid = task->sessionid;

This runs, but the sessionid always ends up being -1. I read in this answer that I can use task_session to retrieve it, but I get an error about invalid memory access. I believe I need to use bpf_probe_read to move the task_struct that task points to onto the stack, but I can't get it to work. Is there anything I'm missing?

After a bit more digging through the task_struct struct I realised you could do this:

struct task_struct *task;
struct pid_link pid_link;
struct pid pid;
unsigned int sessionid;

task = (struct task_struct *)bpf_get_current_task();

bpf_probe_read(&pid_link, sizeof(pid_link), (void *)&task->group_leader->pids[PIDTYPE_SID]);    
bpf_probe_read(&pid, sizeof(pid), (void *)pid_link.pid);

sessionid = pid.numbers[0].nr;

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM