On 9/26/19 9:16 AM, John Fastabend wrote:
> Eric W. Biederman wrote:
>> Carlos Neira writes:
>>
>>> Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
>>> scripts but this helper returns the pid as seen by the root namespace which
>>> is
>>> fine when a bcc script is not
Eric W. Biederman wrote:
> Carlos Neira writes:
>
> > Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> > scripts but this helper returns the pid as seen by the root namespace which
> > is
> > fine when a bcc script is not executed inside a container.
> > When the proc
On 9/25/19 5:59 PM, Eric W. Biederman wrote:
> Carlos Neira writes:
>
>> Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
>> scripts but this helper returns the pid as seen by the root namespace which
>> is
>> fine when a bcc script is not executed inside a container.
Carlos Neira writes:
> Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> scripts but this helper returns the pid as seen by the root namespace which is
> fine when a bcc script is not executed inside a container.
> When the process of interest is inside a container, pid
On Tue, Sep 24, 2019 at 08:01:17PM +0200, Daniel Borkmann wrote:
> On Tue, Sep 24, 2019 at 12:20:01PM -0300, Carlos Neira wrote:
> > Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> > scripts but this helper returns the pid as seen by the root namespace which
> > is
> >
On Tue, Sep 24, 2019 at 12:20:01PM -0300, Carlos Neira wrote:
> Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
> scripts but this helper returns the pid as seen by the root namespace which is
> fine when a bcc script is not executed inside a container.
> When the process
Currently bpf_get_current_pid_tgid(), is used to do pid filtering in bcc's
scripts but this helper returns the pid as seen by the root namespace which is
fine when a bcc script is not executed inside a container.
When the process of interest is inside a container, pid filtering will not work
if bpf
