1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2023 Bytedance */
3 
4 #include <vmlinux.h>
5 #include <bpf/bpf_tracing.h>
6 #include <bpf/bpf_helpers.h>
7 
8 #include "bpf_misc.h"
9 
10 struct cgroup *bpf_cgroup_from_id(u64 cgid) __ksym;
11 long bpf_task_under_cgroup(struct task_struct *task, struct cgroup *ancestor) __ksym;
12 void bpf_cgroup_release(struct cgroup *p) __ksym;
13 struct task_struct *bpf_task_acquire(struct task_struct *p) __ksym;
14 void bpf_task_release(struct task_struct *p) __ksym;
15 
16 const volatile int local_pid;
17 const volatile __u64 cgid;
18 int remote_pid;
19 
20 SEC("tp_btf/task_newtask")
BPF_PROG(handle__task_newtask,struct task_struct * task,u64 clone_flags)21 int BPF_PROG(handle__task_newtask, struct task_struct *task, u64 clone_flags)
22 {
23 	struct cgroup *cgrp = NULL;
24 	struct task_struct *acquired;
25 
26 	if (local_pid != (bpf_get_current_pid_tgid() >> 32))
27 		return 0;
28 
29 	acquired = bpf_task_acquire(task);
30 	if (!acquired)
31 		return 0;
32 
33 	if (local_pid == acquired->tgid)
34 		goto out;
35 
36 	cgrp = bpf_cgroup_from_id(cgid);
37 	if (!cgrp)
38 		goto out;
39 
40 	if (bpf_task_under_cgroup(acquired, cgrp))
41 		remote_pid = acquired->tgid;
42 
43 out:
44 	if (cgrp)
45 		bpf_cgroup_release(cgrp);
46 	bpf_task_release(acquired);
47 
48 	return 0;
49 }
50 
51 char _license[] SEC("license") = "GPL";
52