tracer: support descendant PID namespaces

Author: simonepri

support/ebpf/integration_test.ebpf.c

@@ -6,7 +6,7 @@
 #include "tracemgmt.h"
 #include "types.h"
 
-static EBPF_INLINE void send_sample_traces(void *ctx, u64 pid)
+static EBPF_INLINE void send_sample_traces(void *ctx, u64 pid, u64 tid)
 {
   // Use the per CPU record for trace storage: it's too big for stack.
   PerCPURecord *record = get_pristine_per_cpu_record();
@@ -26,7 +26,7 @@ static EBPF_INLINE void send_sample_traces(void *ctx, u64 pid)
 
   trace->comm[3] = 1;
   trace->pid     = pid;
-  trace->tid     = pid;
+  trace->tid     = tid;
 
   u64 *data = push_frame(&record->state, trace, FRAME_MARKER_NATIVE, 0, 21, 1);
   if (data) {
@@ -60,7 +60,7 @@ int tracepoint_integration__sched_switch(void *ctx)
 
   printt("pid %d in integration test", pid);
 
-  send_sample_traces(ctx, pid);
+  send_sample_traces(ctx, pid, tid);
 
   return 0;
 }

support/ebpf/native_stack_trace.ebpf.c

@@ -54,6 +54,10 @@ BPF_RODATA_VAR(u32, stack_ptregs_offset, 0)
 // internal view (e.g., reporting PID 1 instead of the host PID).
 BPF_RODATA_VAR(bool, pid_ns_translation_enabled, false)
 
+// If enabled, tasks in descendant PID namespaces are translated by walking
+// their PID namespace hierarchy when the kernel helper cannot resolve them.
+BPF_RODATA_VAR(bool, translate_descendant_pids, false)
+
 // The inode number of the target PID namespace.
 // Obtained by calling stat() on /proc/self/ns/pid.
 BPF_RODATA_VAR(u64, target_pid_ns_inode, 0)
@@ -62,6 +66,17 @@ BPF_RODATA_VAR(u64, target_pid_ns_inode, 0)
 // Required by the bpf_get_ns_current_pid_tgid helper to uniquely
 // identify the namespace filesystem (nsfs) instance.
 BPF_RODATA_VAR(u64, target_pid_ns_dev, 0)
+
+// Kernel BTF-derived layout used to translate tasks in descendant PID
+// namespaces into target_pid_ns_inode. bpf_get_ns_current_pid_tgid only
+// handles tasks whose active PID namespace exactly matches the target.
+BPF_RODATA_VAR(u32, task_thread_pid_offset, 0)
+BPF_RODATA_VAR(u32, pid_level_offset, 0)
+BPF_RODATA_VAR(u32, pid_numbers_offset, 0)
+BPF_RODATA_VAR(u32, upid_size, 0)
+BPF_RODATA_VAR(u32, upid_nr_offset, 0)
+BPF_RODATA_VAR(u32, upid_ns_offset, 0)
+BPF_RODATA_VAR(u32, pid_namespace_inum_offset, 0)
 // origin_id_sampling is set during load time.
 BPF_RODATA_VAR(u16, origin_id_sampling, 0)
 

support/ebpf/tracemgmt.h

@@ -68,12 +68,22 @@ extern u16 origin_id_sampling;
 // pid_ns_translation_enabled is declared in native_stack_trace.ebpf.c
 extern bool pid_ns_translation_enabled;
 
+extern bool translate_descendant_pids;
+
 // target_pid_ns_inode is declared in native_stack_trace.ebpf.c
 extern u64 target_pid_ns_inode;
 
 // target_pid_ns_dev is declared in native_stack_trace.ebpf.c
 extern u64 target_pid_ns_dev;
 
+extern u32 task_thread_pid_offset;
+extern u32 pid_level_offset;
+extern u32 pid_numbers_offset;
+extern u32 upid_size;
+extern u32 upid_nr_offset;
+extern u32 upid_ns_offset;
+extern u32 pid_namespace_inum_offset;
+
 // Mirrors the kernel's struct bpf_pidns_info for use with bpf_get_ns_current_pid_tgid().
 // pid:  thread PID as seen within the target PID namespace.
 // tgid: thread group ID (= process PID in userspace) within the target PID namespace.
@@ -82,6 +92,67 @@ struct bpf_pidns_info {
   u32 tgid;
 };
 
+// Linux permits levels 0 through 32, including the root PID namespace.
+#define PID_NAMESPACE_MAX_LEVELS 33
+
+// Resolve the PID of task as visible in the configured target namespace.
+static inline EBPF_INLINE bool get_pid_in_target_namespace(u64 task, u32 *result)
+{
+  u64 pid_address = 0;
+  if (
+    bpf_probe_read_kernel(
+      &pid_address, sizeof(pid_address), (void *)(task + task_thread_pid_offset)) ||
+    pid_address == 0) {
+    return false;
+  }
+
+  u32 active_level = 0;
+  if (bpf_probe_read_kernel(
+        &active_level, sizeof(active_level), (void *)(pid_address + pid_level_offset))) {
+    return false;
+  }
+
+  for (u32 depth = 0; depth < PID_NAMESPACE_MAX_LEVELS; depth++) {
+    if (depth > active_level) {
+      break;
+    }
+
+    u32 level        = active_level - depth;
+    u64 upid_address = pid_address + pid_numbers_offset + ((u64)level * upid_size);
+
+    u64 namespace_address = 0;
+    if (
+      bpf_probe_read_kernel(
+        &namespace_address, sizeof(namespace_address), (void *)(upid_address + upid_ns_offset)) ||
+      namespace_address == 0) {
+      continue;
+    }
+
+    u32 namespace_inode = 0;
+    if (
+      bpf_probe_read_kernel(
+        &namespace_inode,
+        sizeof(namespace_inode),
+        (void *)(namespace_address + pid_namespace_inum_offset)) ||
+      namespace_inode != (u32)target_pid_ns_inode) {
+      continue;
+    }
+
+    u32 translated_pid = 0;
+    if (
+      bpf_probe_read_kernel(
+        &translated_pid, sizeof(translated_pid), (void *)(upid_address + upid_nr_offset)) ||
+      translated_pid == 0) {
+      return false;
+    }
+
+    *result = translated_pid;
+    return true;
+  }
+
+  return false;
+}
+
 // get_pid_tgid resolves the current task's PID and TGID, translating them into the
 // configured target PID namespace if pid_ns_translation_enabled is set. Returns false if
 // the task could not be resolved (e.g. it is not part of the target namespace), in which
@@ -92,16 +163,33 @@ static inline EBPF_INLINE bool get_pid_tgid(u32 *pid, u32 *tid)
     struct bpf_pidns_info ns_info = {0};
     long ret                      = bpf_get_ns_current_pid_tgid(
       target_pid_ns_dev, target_pid_ns_inode, &ns_info, sizeof(ns_info));
-    if (ret < 0) {
-      // Task is not in the target namespace, signal caller to skip it.
+    if (ret == 0) {
+      // ns_info.tgid is the thread group ID (= process PID in userspace) in the namespace.
+      // ns_info.pid is the thread PID in the namespace.
+      // Match the convention of the non-namespace path where pid holds the TGID.
+      *pid = ns_info.tgid;
+      *tid = ns_info.pid;
+      return true;
+    }
+
+    if (!translate_descendant_pids) {
       return false;
     }
-    // ns_info.tgid is the thread group ID (= process PID in userspace) in the namespace.
-    // ns_info.pid is the thread PID in the namespace.
-    // Match the convention of the non-namespace path where pid holds the TGID.
-    *pid = ns_info.tgid;
-    *tid = ns_info.pid;
-    return true;
+
+    u64 task         = bpf_get_current_task();
+    u64 group_leader = 0;
+    if (
+      task == 0 ||
+      bpf_probe_read_kernel(
+        &group_leader, sizeof(group_leader), (void *)(task + task_group_leader_offset)) ||
+      group_leader == 0) {
+      return false;
+    }
+
+    // A helper miss can mean either a descendant namespace or an unrelated
+    // namespace. Both translations validate the target namespace inode, so
+    // untranslated host PIDs are never returned from this path.
+    return get_pid_in_target_namespace(group_leader, pid) && get_pid_in_target_namespace(task, tid);
   }
 
   // bpf_get_current_pid_tgid returns (tgid << 32 | pid).

support/ebpf/tracer.ebpf.amd64

@@ -7,11 +7,14 @@ package tracer_test
 
 import (
 	"context"
+	"fmt"
 	"math"
 	"os"
+	"os/exec"
 	"runtime"
 	"slices"
 	"sync"
+	"syscall"
 	"testing"
 	"time"
 
@@ -288,3 +291,100 @@ func TestAllTracers(t *testing.T) {
 		})
 	}
 }
+
+func TestPIDNamespaceTranslationFromDescendant(t *testing.T) {
+	if os.Getenv("OTEL_EBPF_PROFILER_PIDNS_CHILD") == "1" {
+		require.Equal(t, 1, os.Getpid())
+		runtime.GOMAXPROCS(2)
+		deadline := time.Now().Add(3 * time.Second)
+		ready := make(chan struct{})
+		done := make(chan struct{})
+		go func() {
+			runtime.LockOSThread()
+			close(ready)
+			for time.Now().Before(deadline) {
+				runtime.Gosched()
+			}
+			close(done)
+		}()
+		<-ready
+		runtime.LockOSThread()
+		for time.Now().Before(deadline) {
+			runtime.Gosched()
+		}
+		<-done
+		return
+	}
+
+	_, btfErr := os.Stat("/sys/kernel/btf/vmlinux")
+	tr, err := tracer.NewTracer(t.Context(), &tracer.Config{
+		Intervals:               &mockIntervals{},
+		InterpretersConfig:      interpreterconfig.AllInterpreters(),
+		SamplesPerSecond:        20,
+		ProbabilisticInterval:   100,
+		ProbabilisticThreshold:  100,
+		PIDNamespaceTranslation: true,
+		TranslateDescendantPIDs: true,
+	})
+	if os.IsNotExist(btfErr) {
+		require.ErrorContains(t, err, "PID translation from descendant namespaces requires readable kernel BTF")
+		return
+	}
+	require.NoError(t, btfErr)
+	require.NoError(t, err)
+	defer tr.Close()
+
+	traceChan := make(chan *libpf.EbpfTrace, 1024)
+	require.NoError(t, tr.StartMapMonitors(t.Context(), traceChan))
+
+	coll, err := support.LoadCollectionSpec()
+	require.NoError(t, err)
+	require.NoError(t, tracer.RewriteMaps(coll, tr.GetEbpfMaps()))
+
+	restoreRlimit, err := rlimit.MaximizeMemlock()
+	require.NoError(t, err)
+	defer restoreRlimit()
+
+	prog, err := cebpf.NewProgram(coll.Programs["tracepoint_integration__sched_switch"])
+	require.NoError(t, err)
+	defer prog.Close()
+
+	event, err := link.Tracepoint("sched", "sched_switch", prog, nil)
+	require.NoError(t, err)
+	defer event.Close()
+
+	cmd := exec.Command(os.Args[0], "-test.run=^TestPIDNamespaceTranslationFromDescendant$")
+	cmd.Env = append(os.Environ(), "OTEL_EBPF_PROFILER_PIDNS_CHILD=1")
+	cmd.SysProcAttr = &syscall.SysProcAttr{Cloneflags: syscall.CLONE_NEWPID}
+	require.NoError(t, cmd.Start())
+	t.Cleanup(func() {
+		if cmd.ProcessState == nil {
+			_ = cmd.Process.Kill()
+			_ = cmd.Wait()
+		}
+	})
+
+	targetPID := libpf.PID(cmd.Process.Pid)
+	timer := time.NewTimer(5 * time.Second)
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-timer.C:
+			t.Fatalf("no trace received for descendant namespace PID %d", targetPID)
+		case <-tr.Done():
+			t.Fatal("tracer encountered an unrecoverable error")
+		case trace := <-traceChan:
+			comm := trace.Comm.String()
+			if len(comm) < 3 || comm[:3] != "\xAA\xBB\xCC" ||
+				trace.PID != targetPID || trace.TID == targetPID {
+				continue
+			}
+			_, err := os.Stat(fmt.Sprintf("/proc/%d/task/%d", trace.PID, trace.TID))
+			require.NoError(t, err, "translated TID does not belong to the target process")
+			require.NoError(t, event.Close())
+			require.NoError(t, cmd.Wait())
+			return
+		}
+	}
+}

support/ebpf/tracer.ebpf.arm64

@@ -109,7 +109,7 @@ type sysVar struct {
 // both the include list in CollectionSpecWith and the apply pass in applySystemVars.
 func (c *ProbeContext) sysVarSetters() []sysVar {
 	sv := c.sysVars
-	return []sysVar{
+	vars := []sysVar{
 		{"inverse_pac_mask", sv.inverse_pac_mask},
 		{"tpbase_offset", sv.tpbase_offset},
 		{"task_stack_offset", sv.task_stack_offset},
@@ -120,6 +120,7 @@ func (c *ProbeContext) sysVarSetters() []sysVar {
 		{"task_group_leader_offset", sv.task_group_leader_offset},
 		{"task_start_time_offset", sv.task_start_time_offset},
 	}
+	return append(vars, sv.pidNamespaceVars()...)
 }
 
 // applySystemVars writes the system configuration values determined at tracer startup into