feat: agent - eBPF Add mntnsID prefix to distinguish cross-namespace

Author: yinjiping

agent/src/ebpf/user/mount.c

@@ -640,12 +640,20 @@ static int replace_suffix_prefix(const char *str1, const char *str2,
 }
 
 u32 copy_file_metrics(int pid, void *dst, void *src, int len,
-		      const char *mount_point, const char *mount_source,
-		      fs_type_t file_type)
+		      u32 mntns_id, const char *mount_point,
+		      const char *mount_source, fs_type_t file_type)
 {
+#define MNTNS_ID_BUF_SZ 12
 	if (len <= 0)
 		return 0;
 
+	char mntns_str[MNTNS_ID_BUF_SZ] = { 0 };
+	if (mntns_id > 0) {
+		int len;
+		len = u32_to_str_safe(mntns_id, mntns_str, sizeof(mntns_str));
+		mntns_str[len] = ':';
+	}
+	
 	struct user_io_event_buffer *u_event;
 	struct __io_event_buffer *event = (struct __io_event_buffer *)src;
 	char *buffer = event->filename;
@@ -708,6 +716,8 @@ u32 copy_file_metrics(int pid, void *dst, void *src, int len,
 				       sizeof(u_event->file_dir));
 	}
 
+	prepend_prefix_safe(buffer, sizeof(u_event->file_dir), mntns_str);
+
 	u_event->bytes_count = event->bytes_count;
 	u_event->operation = event->operation;
 	u_event->latency = event->latency;
@@ -717,8 +727,8 @@ u32 copy_file_metrics(int pid, void *dst, void *src, int len,
 	u_event->mntns_id = event->mntns_id;
 	strcpy_s_inline(u_event->mount_source, sizeof(u_event->mount_source),
 			mount_source, strlen(mount_source));
-	strcpy_s_inline(u_event->mount_point, sizeof(u_event->mount_point),
-			mount_point, strlen(mount_point));
+	fast_strncat_trunc(mntns_str, mount_point, u_event->mount_point,
+			   sizeof(u_event->mount_point));
 	strcpy_s_inline(u_event->filename, sizeof(u_event->filename),
 			event->filename, strlen(event->filename));
 	return sizeof(*u_event);

agent/src/ebpf/user/mount.h

@@ -175,13 +175,14 @@ void get_mount_info(pid_t pid, int mnt_id, u32 mntns_id,
  * @param[out] dst           Destination buffer
  * @param[in]  src           Source buffer (raw eBPF event)
  * @param[in]  len           Length of destination buffer
+ * @param[in]  mntns_id      The mount namespace ID of the file
  * @param[in]  mount_point   Mount point path
  * @param[in]  mount_source  Mount source path
  * @param[in]  file_type     File type (FS_TYPE_REGULAR, FS_TYPE_VIRTUAL, FS_TYPE_NETWORK)
  * @return Number of bytes written to dst
  */
 uint32_t copy_file_metrics(int pid, void *dst, void *src, int len,
-			   const char *mount_point,
+			   u32 mntns_id, const char *mount_point,
 			   const char *mount_source, fs_type_t file_type);
 /**
  * @brief Check for changes in the host root mount namespace's mount information.

agent/src/ebpf/user/proc.c

@@ -287,15 +287,17 @@ static int del_proc_info_from_cache(struct symbolizer_cache_kvp *kv)
 
 int get_proc_info_from_cache(pid_t pid, uint8_t * cid, int cid_size,
 			     uint8_t * name, int name_size, int mnt_id,
-			     uint32_t mntns_id, kern_dev_t s_dev,
-			     char *mount_point, char *mount_source,
-			     int mount_size, fs_type_t *file_type)
+			     uint32_t mntns_id, uint32_t *self_mntns_id,
+			     kern_dev_t s_dev, char *mount_point,
+			     char *mount_source, int mount_size,
+			     fs_type_t *file_type)
 {
 	int ret = -1;
 	symbol_caches_hash_t *h = &syms_cache_hash;
 	struct symbolizer_cache_kvp kv;
 	kv.k.pid = (u64) pid;
 	kv.v.proc_info_p = 0;
+	*self_mntns_id = 0;
 	memset(cid, 0, cid_size);
 	memset(name, 0, name_size);
 	memset(mount_point, 0, mount_size);
@@ -314,6 +316,7 @@ int get_proc_info_from_cache(pid_t pid, uint8_t * cid, int cid_size,
 			memcpy_s_inline((void *)name, name_size, p->comm,
 					sizeof(p->comm));
 		}
+		*self_mntns_id = p->mntns_id;
 		AO_DEC(&p->use);
 		ret = 0;
 	}
@@ -1015,10 +1018,12 @@ void check_and_update_proc_info(bool output_log)
 
 int get_proc_info_from_cache(pid_t pid, uint8_t * cid, int cid_size,
 			     uint8_t * name, int name_size, int mnt_id,
-			     uint32_t mntns_id, kern_dev_t s_dev,
-			     char *mount_point, char *mount_source,
-			     int mount_size, fs_type_t *file_type)
+			     uint32_t mntns_id, uint32_t *self_mntns_id,
+			     kern_dev_t s_dev, char *mount_point,
+			     char *mount_source, int mount_size,
+			     fs_type_t *file_type)
 {
+	*self_mntns_id = 0;
 	memset(cid, 0, cid_size);
 	memset(name, 0, name_size);
 	memset(mount_point, 0, mount_size);

agent/src/ebpf/user/proc.h

@@ -201,18 +201,19 @@ int create_and_init_proc_info_caches(void);
  * If the process is not found in the cache, all output buffers (`cid`, `name`, `mount_point`)
  * will be zeroed.
  *
- * @param pid          The process ID to look up.
- * @param cid          Output buffer to store the container ID.
- * @param cid_size     Size of the `cid` buffer in bytes.
- * @param name         Output buffer to store the process name (comm).
- * @param name_size    Size of the `name` buffer in bytes.
- * @param mnt_id       Mount ID
- * @param mntns_id     Mount namespace ID
- * @param s_dev        Device number to be resolved into a mount point path.
- * @param mount_point  Output buffer to store the mount point path matching `s_dev`.
- * @param mount_source Output buffer to store the mount source path.
- * @param mount_size   Size of the `mount_point` buffer in bytes.
- * @param file_type    File type
+ * @param pid           The process ID to look up.
+ * @param cid           Output buffer to store the container ID.
+ * @param cid_size      Size of the `cid` buffer in bytes.
+ * @param name          Output buffer to store the process name (comm).
+ * @param name_size     Size of the `name` buffer in bytes.
+ * @param mnt_id        Mount ID
+ * @param mntns_id      Mount namespace ID
+ * @param self_mntns_id The mount namespace ID of the process.
+ * @param s_dev         Device number to be resolved into a mount point path.
+ * @param mount_point   Output buffer to store the mount point path matching `s_dev`.
+ * @param mount_source  Output buffer to store the mount source path.
+ * @param mount_size    Size of the `mount_point` buffer in bytes.
+ * @param file_type     File type
  *
  * @return
  *    0 : Successfully found process info in cache and retrieved data.
@@ -225,9 +226,10 @@ int create_and_init_proc_info_caches(void);
  */
 int get_proc_info_from_cache(pid_t pid, uint8_t *cid, int cid_size,
 			     uint8_t *name, int name_size, int mnt_id,
-			     uint32_t mntns_id, kern_dev_t s_dev,
-			     char *mount_point, char *mount_source,
-			     int mount_size, fs_type_t *file_type);
+			     uint32_t mntns_id, uint32_t *self_mntns_id,
+			     kern_dev_t s_dev, char *mount_point,
+			     char *mount_source, int mount_size,
+			     fs_type_t *file_type);
 void update_proc_info_cache(pid_t pid, enum proc_act_type type);
 
 // Lower version kernels do not support hooking so files in containers

agent/src/ebpf/user/socket.c

@@ -1193,6 +1193,9 @@ static void reader_raw_cb(void *cookie, void *raw, int raw_size)
 		submit_data->syscall_len = sd->syscall_len;
 		submit_data->l7_protocal_hint = sd->data_type;
 		submit_data->batch_last_data = false;
+
+		u32 mntns_id = 0;
+		u32 self_mntns_id = 0;
 		if (sd->source != DATA_SOURCE_DPDK) {
 			submit_data->socket_id = sd->socket_id;
 			submit_data->tuple = sd->tuple;
@@ -1226,7 +1229,6 @@ static void reader_raw_cb(void *cookie, void *raw, int raw_size)
 			int ret = 0;
 			kern_dev_t s_dev = DEV_INVALID;
 			int mnt_id = 0;
-			u32 mntns_id = 0;
 			if (sd->source == DATA_SOURCE_IO_EVENT) {
 				struct __io_event_buffer *event =
 					(struct __io_event_buffer *)sd->data;
@@ -1238,8 +1240,9 @@ static void reader_raw_cb(void *cookie, void *raw, int raw_size)
 						       sizeof(submit_data->container_id),
 						       submit_data->process_kname,
 						       sizeof(submit_data->process_kname),
-						       mnt_id, mntns_id, s_dev, mount_point,
-						       mount_source, sizeof(mount_point), &file_type);
+						       mnt_id, mntns_id, &self_mntns_id,
+						       s_dev, mount_point, mount_source,
+						       sizeof(mount_point), &file_type);
 
 			// Not found in the process cache, attempting to retrieve from procfs.
 			if (ret) {
@@ -1294,10 +1297,13 @@ static void reader_raw_cb(void *cookie, void *raw, int raw_size)
 				offset = sd->extra_data_count;
 			}
 			if (sd->source == DATA_SOURCE_IO_EVENT) {
+				u32 display_mntns_id = 0;
+				if (self_mntns_id > 0 && mntns_id != self_mntns_id)
+					display_mntns_id = mntns_id;
 				len =
 				    copy_file_metrics(sd->tgid, submit_data->cap_data
-						      + offset, sd->data,
-						      len, mount_point,
+						      + offset, sd->data, len,
+						      display_mntns_id, mount_point,
 						      mount_source, file_type);
 			} else {
 				memcpy_fast(submit_data->cap_data + offset,

agent/src/ebpf/user/utils.c

@@ -1771,3 +1771,64 @@ uint32_t murmurhash(const void *key, size_t len, uint32_t seed)
 
 	return h1;
 }
+
+size_t u32_to_str_safe(uint32_t value, char *buf, size_t bufsize)
+{
+	char temp[10]; // Maximum digits for uint32_t: 4294967295 -> 10 digits
+	int i = 0;
+
+	if (bufsize == 0) return 0; // Buffer size must be at least 1
+
+	// Handle zero explicitly
+	if (value == 0) {
+		if (bufsize < 2) return 0; // Need space for '0' + '\0'
+		buf[0] = '0';
+		buf[1] = '\0';
+		return 1;
+	}
+
+	// Convert number to string in reverse order
+	while (value > 0) {
+		temp[i++] = '0' + (value % 10);
+		value /= 10;
+	}
+
+	// Check if buffer is large enough
+	if (bufsize <= (size_t)i) return 0;
+
+	// Reverse copy to output buffer
+	for (int j = 0; j < i; j++) {
+		buf[j] = temp[i - j - 1];
+	}
+
+	buf[i] = '\0';
+	return i;
+}
+
+int prepend_prefix_safe(char *buffer, size_t bufsize, const char *prefix)
+{
+	if (!buffer || !prefix || bufsize == 0) {
+		return -1; // invalid input
+	}
+
+	size_t len_prefix = strlen(prefix);
+	if (len_prefix == 0)
+		return 0; // empty prefix, nothing to do
+
+	size_t len_buffer = strlen(buffer);
+
+	// Check if buffer has enough space
+	if (len_prefix + len_buffer + 1 > bufsize) {
+		return -1; // not enough space
+	}
+
+	if (len_prefix > 0) {
+		// Move existing string to make room for prefix
+		memmove(buffer + len_prefix, buffer, len_buffer + 1); // +1 to move '\0'
+
+		// Copy prefix to the start
+		memcpy(buffer, prefix, len_prefix);
+	}
+
+	return 0;
+}

agent/src/ebpf/user/utils.h

@@ -342,6 +342,32 @@ void format_port_ranges(uint16_t *ports, size_t size, char *ret_str, int str_sz)
  * @return 32-bit hash value computed over the input data.
  */
 uint32_t murmurhash(const void *key, size_t len, uint32_t seed);
+
+/*
+ * Convert uint32_t to decimal string safely
+ *
+ * @param value    The input number to convert
+ * @param buf      Output buffer to store the string
+ * @param bufsize  Size of the output buffer
+ * @return Number of characters written (excluding '\0'), or 0 on failure (e.g., buffer too small)
+ */
+size_t u32_to_str_safe(uint32_t value, char *buf, size_t bufsize);
+
+/*
+ * Safely prepend a prefix to a string buffer
+ *
+ * @param buffer   The string buffer to modify
+ * @param bufsize  Total size of the buffer (including space for '\0')
+ * @param prefix   The prefix to prepend
+ * @return 0 on success, -1 if buffer is too small
+ *
+ * Features:
+ * - Fully safe: checks buffer size
+ * - Uses memmove to handle overlapping memory
+ * - Supports empty prefix or empty buffer
+ * - Always null-terminates on success
+ */
+int prepend_prefix_safe(char *buffer, size_t bufsize, const char *prefix);
 #if !defined(AARCH64_MUSL) && !defined(JAVA_AGENT_ATTACH_TOOL)
 int create_work_thread(const char *name, pthread_t *t, void *fn, void *arg);
 #endif /* !defined(AARCH64_MUSL) && !defined(JAVA_AGENT_ATTACH_TOOL) */