CODEWITHSUNDEEP
linuxlinux-kernelbpfebpf
dippynark
dippynark

Reputation: 3003

How can I retrieve a task's sessionid in an eBPF program?

I want to retrieve the sessionid from a task struct in an eBPF program. I have the following code in my eBPF program:

struct task_struct *task;
u32 sessionid;    

task = (struct task_struct *)bpf_get_current_task();
sessionid = task->sessionid;

This runs, but the sessionid always ends up being -1. I read in this answer that I can use task_session to retrieve it, but I get an error about invalid memory access. I believe I need to use bpf_probe_read to move the task_struct that task points to onto the stack, but I can't get it to work. Is there anything I'm missing?

Upvotes: 2

Views: 1050

Answers (1)

dippynark
dippynark

Reputation: 3003

After a bit more digging through the task_struct struct I realised you could do this:

struct task_struct *task;
struct pid_link pid_link;
struct pid pid;
unsigned int sessionid;

task = (struct task_struct *)bpf_get_current_task();

bpf_probe_read(&pid_link, sizeof(pid_link), (void *)&task->group_leader->pids[PIDTYPE_SID]);    
bpf_probe_read(&pid, sizeof(pid), (void *)pid_link.pid);

sessionid = pid.numbers[0].nr;

Upvotes: 4

Related Questions