tracer: support descendant PID namespaces

Author: simonepri

support/ebpf/native_stack_trace.ebpf.c

@@ -62,6 +62,17 @@ BPF_RODATA_VAR(u64, target_pid_ns_inode, 0)
 // Required by the bpf_get_ns_current_pid_tgid helper to uniquely
 // identify the namespace filesystem (nsfs) instance.
 BPF_RODATA_VAR(u64, target_pid_ns_dev, 0)
+
+// Kernel BTF-derived layout used to translate tasks in descendant PID
+// namespaces into target_pid_ns_inode. bpf_get_ns_current_pid_tgid only
+// handles tasks whose active PID namespace exactly matches the target.
+BPF_RODATA_VAR(u32, task_thread_pid_offset, 0)
+BPF_RODATA_VAR(u32, pid_level_offset, 0)
+BPF_RODATA_VAR(u32, pid_numbers_offset, 0)
+BPF_RODATA_VAR(u32, upid_size, 0)
+BPF_RODATA_VAR(u32, upid_nr_offset, 0)
+BPF_RODATA_VAR(u32, upid_ns_offset, 0)
+BPF_RODATA_VAR(u32, pid_namespace_inum_offset, 0)
 // origin_id_sampling is set during load time.
 BPF_RODATA_VAR(u16, origin_id_sampling, 0)
 

support/ebpf/tracemgmt.h

@@ -74,6 +74,14 @@ extern u64 target_pid_ns_inode;
 // target_pid_ns_dev is declared in native_stack_trace.ebpf.c
 extern u64 target_pid_ns_dev;
 
+extern u32 task_thread_pid_offset;
+extern u32 pid_level_offset;
+extern u32 pid_numbers_offset;
+extern u32 upid_size;
+extern u32 upid_nr_offset;
+extern u32 upid_ns_offset;
+extern u32 pid_namespace_inum_offset;
+
 // Mirrors the kernel's struct bpf_pidns_info for use with bpf_get_ns_current_pid_tgid().
 // pid:  thread PID as seen within the target PID namespace.
 // tgid: thread group ID (= process PID in userspace) within the target PID namespace.
@@ -82,6 +90,67 @@ struct bpf_pidns_info {
   u32 tgid;
 };
 
+#define PID_NAMESPACE_MAX_DEPTH 4
+
+// Resolve the PID of task as visible in the configured target namespace.
+static inline EBPF_INLINE bool get_pid_in_target_namespace(u64 task, u32 *result)
+{
+  u64 pid_address = 0;
+  if (
+    bpf_probe_read_kernel(
+      &pid_address, sizeof(pid_address), (void *)(task + task_thread_pid_offset)) ||
+    pid_address == 0) {
+    return false;
+  }
+
+  u32 active_level = 0;
+  if (bpf_probe_read_kernel(
+        &active_level, sizeof(active_level), (void *)(pid_address + pid_level_offset))) {
+    return false;
+  }
+
+#pragma unroll
+  for (u32 depth = 0; depth < PID_NAMESPACE_MAX_DEPTH; depth++) {
+    if (depth > active_level) {
+      break;
+    }
+
+    u32 level        = active_level - depth;
+    u64 upid_address = pid_address + pid_numbers_offset + ((u64)level * upid_size);
+
+    u64 namespace_address = 0;
+    if (
+      bpf_probe_read_kernel(
+        &namespace_address, sizeof(namespace_address), (void *)(upid_address + upid_ns_offset)) ||
+      namespace_address == 0) {
+      continue;
+    }
+
+    u32 namespace_inode = 0;
+    if (
+      bpf_probe_read_kernel(
+        &namespace_inode,
+        sizeof(namespace_inode),
+        (void *)(namespace_address + pid_namespace_inum_offset)) ||
+      namespace_inode != (u32)target_pid_ns_inode) {
+      continue;
+    }
+
+    u32 translated_pid = 0;
+    if (
+      bpf_probe_read_kernel(
+        &translated_pid, sizeof(translated_pid), (void *)(upid_address + upid_nr_offset)) ||
+      translated_pid == 0) {
+      return false;
+    }
+
+    *result = translated_pid;
+    return true;
+  }
+
+  return false;
+}
+
 // get_pid_tgid resolves the current task's PID and TGID, translating them into the
 // configured target PID namespace if pid_ns_translation_enabled is set. Returns false if
 // the task could not be resolved (e.g. it is not part of the target namespace), in which
@@ -92,16 +161,29 @@ static inline EBPF_INLINE bool get_pid_tgid(u32 *pid, u32 *tid)
     struct bpf_pidns_info ns_info = {0};
     long ret                      = bpf_get_ns_current_pid_tgid(
       target_pid_ns_dev, target_pid_ns_inode, &ns_info, sizeof(ns_info));
-    if (ret < 0) {
-      // Task is not in the target namespace, signal caller to skip it.
+    if (ret == 0) {
+      // ns_info.tgid is the thread group ID (= process PID in userspace) in the namespace.
+      // ns_info.pid is the thread PID in the namespace.
+      // Match the convention of the non-namespace path where pid holds the TGID.
+      *pid = ns_info.tgid;
+      *tid = ns_info.pid;
+      return true;
+    }
+
+    u64 task         = bpf_get_current_task();
+    u64 group_leader = 0;
+    if (
+      task == 0 ||
+      bpf_probe_read_kernel(
+        &group_leader, sizeof(group_leader), (void *)(task + task_group_leader_offset)) ||
+      group_leader == 0) {
       return false;
     }
-    // ns_info.tgid is the thread group ID (= process PID in userspace) in the namespace.
-    // ns_info.pid is the thread PID in the namespace.
-    // Match the convention of the non-namespace path where pid holds the TGID.
-    *pid = ns_info.tgid;
-    *tid = ns_info.pid;
-    return true;
+
+    // A helper miss can mean either a descendant namespace or an unrelated
+    // namespace. Both translations validate the target namespace inode, so
+    // untranslated host PIDs are never returned from this path.
+    return get_pid_in_target_namespace(group_leader, pid) && get_pid_in_target_namespace(task, tid);
   }
 
   // bpf_get_current_pid_tgid returns (tgid << 32 | pid).

tracer/ebpf_integration_test.go

@@ -9,9 +9,11 @@ import (
 	"context"
 	"math"
 	"os"
+	"os/exec"
 	"runtime"
 	"slices"
 	"sync"
+	"syscall"
 	"testing"
 	"time"
 
@@ -288,3 +290,77 @@ func TestAllTracers(t *testing.T) {
 		})
 	}
 }
+
+func TestPIDNamespaceTranslationFromDescendant(t *testing.T) {
+	if os.Getenv("OTEL_EBPF_PROFILER_PIDNS_CHILD") == "1" {
+		require.Equal(t, 1, os.Getpid())
+		deadline := time.Now().Add(2 * time.Second)
+		for time.Now().Before(deadline) {
+			runtime.Gosched()
+		}
+		return
+	}
+
+	tr, err := tracer.NewTracer(t.Context(), &tracer.Config{
+		Intervals:               &mockIntervals{},
+		InterpretersConfig:      interpreterconfig.AllInterpreters(),
+		SamplesPerSecond:        20,
+		ProbabilisticInterval:   100,
+		ProbabilisticThreshold:  100,
+		PIDNamespaceTranslation: true,
+	})
+	require.NoError(t, err)
+	defer tr.Close()
+
+	traceChan := make(chan *libpf.EbpfTrace, 1024)
+	require.NoError(t, tr.StartMapMonitors(t.Context(), traceChan))
+
+	coll, err := support.LoadCollectionSpec()
+	require.NoError(t, err)
+	require.NoError(t, tracer.RewriteMaps(coll, tr.GetEbpfMaps()))
+
+	restoreRlimit, err := rlimit.MaximizeMemlock()
+	require.NoError(t, err)
+	defer restoreRlimit()
+
+	prog, err := cebpf.NewProgram(coll.Programs["tracepoint_integration__sched_switch"])
+	require.NoError(t, err)
+	defer prog.Close()
+
+	event, err := link.Tracepoint("sched", "sched_switch", prog, nil)
+	require.NoError(t, err)
+	defer event.Close()
+
+	cmd := exec.Command(os.Args[0], "-test.run=^TestPIDNamespaceTranslationFromDescendant$")
+	cmd.Env = append(os.Environ(), "OTEL_EBPF_PROFILER_PIDNS_CHILD=1")
+	cmd.SysProcAttr = &syscall.SysProcAttr{Cloneflags: syscall.CLONE_NEWPID}
+	require.NoError(t, cmd.Start())
+	t.Cleanup(func() {
+		if cmd.ProcessState == nil {
+			_ = cmd.Process.Kill()
+			_ = cmd.Wait()
+		}
+	})
+
+	targetPID := libpf.PID(cmd.Process.Pid)
+	timer := time.NewTimer(5 * time.Second)
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-timer.C:
+			t.Fatalf("no trace received for descendant namespace PID %d", targetPID)
+		case <-tr.Done():
+			t.Fatal("tracer encountered an unrecoverable error")
+		case trace := <-traceChan:
+			comm := trace.Comm.String()
+			if len(comm) < 3 || comm[:3] != "\xAA\xBB\xCC" || trace.PID != targetPID {
+				continue
+			}
+			require.Equal(t, targetPID, trace.TID)
+			require.NoError(t, event.Close())
+			require.NoError(t, cmd.Wait())
+			return
+		}
+	}
+}

tracer/systemconfig.go

@@ -41,6 +41,7 @@ type SysConfigVars struct {
 	vma_vm_flags_offset      uint32
 	task_group_leader_offset uint32
 	task_start_time_offset   uint32
+	pidNamespaceOffsets      map[string]uint32
 }
 
 var (
@@ -139,8 +140,52 @@ func parseVMAOffsets(spec *btf.Spec, vars *SysConfigVars) {
 	vars.vma_vm_flags_offset = uint32(flagsOffset)
 }
 
+func parsePIDNamespaceOffsets(spec *btf.Spec, vars *SysConfigVars) error {
+	fields := []struct {
+		typeName string
+		field    string
+		variable string
+	}{
+		{typeName: "task_struct", field: "thread_pid", variable: "task_thread_pid_offset"},
+		{typeName: "pid", field: "level", variable: "pid_level_offset"},
+		{typeName: "pid", field: "numbers", variable: "pid_numbers_offset"},
+		{typeName: "upid", field: "nr", variable: "upid_nr_offset"},
+		{typeName: "upid", field: "ns", variable: "upid_ns_offset"},
+		{typeName: "pid_namespace", field: "ns.inum", variable: "pid_namespace_inum_offset"},
+	}
+
+	vars.pidNamespaceOffsets = make(map[string]uint32, len(fields)+1)
+	for _, field := range fields {
+		typ, err := spec.AnyTypeByName(field.typeName)
+		if err != nil {
+			return err
+		}
+		offset, err := calculateFieldOffset(typ, field.field)
+		if err != nil {
+			return err
+		}
+		vars.pidNamespaceOffsets[field.variable] = uint32(offset)
+	}
+
+	upid, err := spec.AnyTypeByName("upid")
+	if err != nil {
+		return err
+	}
+	upidSize, err := btf.Sizeof(upid)
+	if err != nil {
+		return err
+	}
+	if upidSize <= 0 {
+		return fmt.Errorf("invalid kernel BTF upid size %d", upidSize)
+	}
+	vars.pidNamespaceOffsets["upid_size"] = uint32(upidSize)
+	return nil
+}
+
 // parseBTF resolves the SystemConfig data from kernel BTF
-func parseBTF(vars *SysConfigVars, needTPBase, needProcessStartTime bool) error {
+func parseBTF(vars *SysConfigVars, needTPBase, needProcessStartTime,
+	needPIDNamespaceTranslation bool,
+) error {
 	fh, err := os.Open("/sys/kernel/btf/vmlinux")
 	if err != nil {
 		return err
@@ -171,19 +216,27 @@ func parseBTF(vars *SysConfigVars, needTPBase, needProcessStartTime bool) error
 		}
 	}
 
-	if needProcessStartTime {
+	if needProcessStartTime || needPIDNamespaceTranslation {
 		groupLeaderOffset, err := calculateFieldOffset(taskStruct, "group_leader")
 		if err != nil {
 			return err
 		}
 		vars.task_group_leader_offset = uint32(groupLeaderOffset)
+	}
 
+	if needProcessStartTime {
 		startTimeOffset, err := calculateFieldOffset(taskStruct, "start_time")
 		if err != nil {
 			return err
 		}
 		vars.task_start_time_offset = uint32(startTimeOffset)
 	}
+
+	if needPIDNamespaceTranslation {
+		if err := parsePIDNamespaceOffsets(spec, vars); err != nil {
+			return err
+		}
+	}
 	parseVMAOffsets(spec, vars)
 
 	return nil
@@ -380,13 +433,16 @@ func getCurrentNS(filename string) (dev, ino uint64, err error) {
 
 func determineSysConfig(coll *cebpf.CollectionSpec, maps map[string]*cebpf.Map,
 	kmod *kallsyms.Module, interpretersConfig interpreterconfig.Config, needProcessStartTime bool,
-	vars *SysConfigVars,
+	pidNamespaceTranslation bool, vars *SysConfigVars,
 ) error {
 	needTPBase := !interpretersConfig.Perl.IsDisabled() ||
 		!interpretersConfig.Python.IsDisabled() ||
 		!interpretersConfig.Ruby.IsDisabled() ||
 		!interpretersConfig.Go.IsLabelsDisabled()
-	if err := parseBTF(vars, needTPBase, needProcessStartTime); err != nil {
+	if err := parseBTF(vars, needTPBase, needProcessStartTime, pidNamespaceTranslation); err != nil {
+		if pidNamespaceTranslation {
+			return fmt.Errorf("PID namespace translation requires readable kernel BTF with task and PID namespace layout: %w", err)
+		}
 		if needProcessStartTime {
 			return fmt.Errorf("process age filter requires kernel BTF to resolve task_struct offsets: %w", err)
 		}
@@ -573,6 +629,9 @@ func loadRodataVars(coll *cebpf.CollectionSpec, kmod *kallsyms.Module, cfg *Conf
 		if err != nil {
 			return fmt.Errorf("failed to read PID namespace info: %v", err)
 		}
+		if dev == 0 || ino == 0 {
+			return fmt.Errorf("invalid PID namespace identity: device=%d, inode=%d", dev, ino)
+		}
 		if err := coll.Variables["pid_ns_translation_enabled"].Set(uint8(1)); err != nil {
 			return fmt.Errorf("failed to set pid_ns_translation_enabled: %v", err)
 		}
@@ -582,7 +641,7 @@ func loadRodataVars(coll *cebpf.CollectionSpec, kmod *kallsyms.Module, cfg *Conf
 		if err := coll.Variables["target_pid_ns_inode"].Set(ino); err != nil {
 			return fmt.Errorf("failed to set target_pid_ns_inode: %v", err)
 		}
-		log.Infof("PID namespace translation enabled (dev=%d, ino=%d), only processes traces within the profiler namespace will be collected", dev, ino)
+		log.Infof("PID namespace translation enabled (dev=%d, ino=%d), only process traces visible in the profiler namespace will be collected", dev, ino)
 	}
 
 	// The Python/native hybrid unwinder's per program loop count defaults to 10
@@ -644,10 +703,17 @@ func loadRodataVars(coll *cebpf.CollectionSpec, kmod *kallsyms.Module, cfg *Conf
 
 	if err := determineSysConfig(
 		systemAnalysisColl, maps, kmod, cfg.InterpretersConfig, cfg.FilterMinProcessAge > 0,
-		&rodataVars,
+		cfg.PIDNamespaceTranslation, &rodataVars,
 	); err != nil {
 		return fmt.Errorf("failed to determine system configs: %v", err)
 	}
+	if cfg.PIDNamespaceTranslation {
+		for name, offset := range rodataVars.pidNamespaceOffsets {
+			if err := coll.Variables[name].Set(offset); err != nil {
+				return fmt.Errorf("failed to set %s: %v", name, err)
+			}
+		}
+	}
 	if err := coll.Variables["tpbase_offset"].Set(rodataVars.tpbase_offset); err != nil {
 		return fmt.Errorf("failed to set tpbase_offset: %v", err)
 	}

tracer/tracer.go

@@ -220,8 +220,8 @@ type Config struct {
 	// process discovery time. Multiple enrichers are called in order.
 	ProcessMetaEnrichers []process.MetaEnricher
 	// PIDNamespaceTranslation toggles translation of host-level PIDs/TGIDs into
-	// their container-namespace equivalents. Useful for sidecar deployments where
-	// the profiler and the target application share a PID namespace but not host PIDs.
+	// the profiler's PID namespace. Tasks in descendant PID namespaces are translated
+	// into the IDs visible to the profiler.
 	PIDNamespaceTranslation bool
 }