Skip to content

Commit 296aeda

Browse files
ekoopspoiana
authored andcommitted
fix(driver): export euid, egid and loginuid from init user ns
The kernel module currently exports euids, egids and loginuids as seen from the task's user namespace: this is inconsistent with the (expected) behaviour implemented by the modern eBPF probe, that exports the ones seen from the init user namespace. Make the kernel module consistent by fixing its code to export the ones seen from the init user namespace. Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
1 parent 1456352 commit 296aeda

2 files changed

Lines changed: 11 additions & 11 deletions

File tree

driver/SCHEMA_VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
4.5.0
1+
4.5.1

driver/ppm_fillers.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1043,8 +1043,8 @@ int f_proc_startupdate(struct event_filler_arguments *args) {
10431043
/*
10441044
* clone-only parameters
10451045
*/
1046-
uint32_t euid = from_kuid_munged(current_user_ns(), current_euid());
1047-
uint32_t egid = from_kgid_munged(current_user_ns(), current_egid());
1046+
uint32_t euid = from_kuid(&init_user_ns, current_euid());
1047+
uint32_t egid = from_kgid(&init_user_ns, current_egid());
10481048
int64_t in_pidns = 0;
10491049
struct pid_namespace *pidns = task_active_pid_ns(current);
10501050

@@ -1213,7 +1213,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) {
12131213
CHECK_RES(res);
12141214

12151215
/* Parameter 19: loginuid (type: PT_UID) */
1216-
loginuid = from_kuid(current_user_ns(), audit_get_loginuid(current));
1216+
loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));
12171217
res = val_to_ring(args, loginuid, 0, false, 0);
12181218
CHECK_RES(res);
12191219

@@ -1356,7 +1356,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) {
13561356
CHECK_RES(res);
13571357

13581358
/* Parameter 27: euid (type: PT_UID) */
1359-
euid = from_kuid_munged(current_user_ns(), current_euid());
1359+
euid = from_kuid(&init_user_ns, current_euid());
13601360
res = val_to_ring(args, euid, 0, false, 0);
13611361
CHECK_RES(res);
13621362

@@ -1369,7 +1369,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) {
13691369
CHECK_RES(res);
13701370

13711371
/* Parameter 30: egid (type: PT_GID) */
1372-
egid = from_kgid_munged(current_user_ns(), current_egid());
1372+
egid = from_kgid(&init_user_ns, current_egid());
13731373
res = val_to_ring(args, egid, 0, false, 0);
13741374
CHECK_RES(res);
13751375

@@ -7756,7 +7756,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) {
77567756
CHECK_RES(res);
77577757

77587758
/* Parameter 19: loginuid (type: PT_UID) */
7759-
loginuid = from_kuid(current_user_ns(), audit_get_loginuid(current));
7759+
loginuid = from_kuid(&init_user_ns, audit_get_loginuid(current));
77607760
res = val_to_ring(args, loginuid, 0, false, 0);
77617761
CHECK_RES(res);
77627762

@@ -7895,7 +7895,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) {
78957895
CHECK_RES(res);
78967896

78977897
/* Parameter 27: euid (type: PT_UID) */
7898-
euid = from_kuid_munged(current_user_ns(), current_euid());
7898+
euid = from_kuid(&init_user_ns, current_euid());
78997899
res = val_to_ring(args, euid, 0, false, 0);
79007900
CHECK_RES(res);
79017901

@@ -7908,7 +7908,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) {
79087908
CHECK_RES(res);
79097909

79107910
/* Parameter 30: egid (type: PT_GID) */
7911-
egid = from_kgid_munged(current_user_ns(), current_egid());
7911+
egid = from_kgid(&init_user_ns, current_egid());
79127912
res = val_to_ring(args, egid, 0, false, 0);
79137913
CHECK_RES(res);
79147914

@@ -7941,8 +7941,8 @@ int f_sched_prog_fork(struct event_filler_arguments *args) {
79417941
long swap = 0;
79427942
int available = STR_STORAGE_SIZE;
79437943
uint32_t flags = 0;
7944-
uint32_t euid = task_euid(child).val;
7945-
uint32_t egid = child->cred->egid.val;
7944+
uint32_t euid = from_kuid(&init_user_ns, task_euid(child));
7945+
uint32_t egid = from_kgid(&init_user_ns, child->cred->egid);
79467946
struct pid_namespace *pidns = task_active_pid_ns(child);
79477947
uint64_t pidns_init_start_time = 0;
79487948

0 commit comments

Comments
 (0)