1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
/*
** ATOP - System & Process Monitor
**
** The program 'atop' offers the possibility to view the activity of
** the system on system-level as well as process-level.
**
** This source-file contains functions to retrieve the hostname of a
** containerized process by associating to its UTS namespace.
** ==========================================================================
** Author: Gerlof Langeveld
** E-mail: gerlof.langeveld@atoptool.nl
** Date: August 2023 (initial)
** --------------------------------------------------------------------------
** Copyright (C) 2023 Gerlof Langeveld
**
** This program is free software; you can redistribute it and/or modify it
** under the terms of the GNU General Public License as published by the
** Free Software Foundation; either version 2, or (at your option) any
** later version.
**
** This program is distributed in the hope that it will be useful, but
** WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
** See the GNU General Public License for more details.
**
** You should have received a copy of the GNU General Public License
** along with this program; if not, write to the Free Software
** Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
** --------------------------------------------------------------------------
*/
#define _GNU_SOURCE
#include <sys/types.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <sched.h>
#include <atop.h>
#include <photoproc.h>
#define BASEPATH "/proc/1/ns/uts"
#define UTSPATH "/proc/%d/ns/uts"
static int mypidfd, foreignuts;
// Function that fills the host name (container/pod name) of
// a specific process.
// When the process has a different UTS namespace then systemd,
// the process' UTS namespace will be temporarily associated with atop
// itself to retrieve the host name (i.e. container/pod name) of that process.
// To avoid too many namespace switches, atop only reassociates with its own
// UTS namespace when the resetutsname() function is called.
//
// Return value:
// 0 - no container/pod detected
// 1 - container/pod detected
//
int
getutsname(struct tstat *curtask)
{
static char firstcall = 1, basepath[64], basehost[32];
int pidfd, offset;
ssize_t destlen;
char srcpath[64], destpath[64], tmphost[70];
// regain root privs in case of setuid root executable
//
regainrootprivs();
// function initialization
//
if (firstcall)
{
firstcall = 0;
// determine the UTS namespace of systemd and the hostname
// related to systemd
//
if ( (destlen = readlink(BASEPATH, basepath, sizeof basepath)) == -1)
goto drop_and_return;
basepath[destlen] = '\0'; // guarantee delimeter
if ( (pidfd = open(BASEPATH, O_RDONLY)) == -1)
goto drop_and_return;
if (setns(pidfd, CLONE_NEWUTS) == -1)
{
close(pidfd);
goto drop_and_return;
}
foreignuts = 1;
close(pidfd);
gethostname(basehost, sizeof basehost);
// determine the UTS namespace of atop itself
// and open that namespace for reassociation via
// function resetutsname()
//
snprintf(srcpath, sizeof srcpath, UTSPATH, getpid());
if ( (mypidfd = open(srcpath, O_RDONLY)) == -1)
basepath[0] = '\0';
resetutsname();
}
// no root privileges?
//
if (!basepath[0])
goto drop_and_return;
// check if this pid is related to myself (atop)
//
if (curtask->gen.pid == getpid())
goto drop_and_return;
// base path is known
// verify if this process is native, i.e. does it share the
// UTS namespace of systemd
//
snprintf(srcpath, sizeof srcpath, UTSPATH, curtask->gen.pid);
destlen = readlink(srcpath, destpath, sizeof destpath);
destpath[destlen] = '\0';
if (strcmp(basepath, destpath) == 0) // equal?
goto drop_and_return;
// UTS namespace deviates from base UTS namespace
//
// get hostname related to this UTS namespace by associating
// atop to that namespace
//
if ( (pidfd = open(srcpath, O_RDONLY)) == -1)
goto drop_and_return;
if (setns(pidfd, CLONE_NEWUTS) == -1)
{
close(pidfd);
goto drop_and_return;
}
foreignuts = 1; // set boolean
close(pidfd);
gethostname(tmphost, sizeof tmphost);
// check if the hostname is the same as the hostname of
// systemd (PID 1), because some systemd-related processes have
// their own UTS namespace with the same hostname
// also the hostname 'localhost' might be used by various daemons
// and will be skipped as well
//
if ( strcmp(tmphost, basehost) == 0 || strcmp(tmphost, "localhost") == 0)
goto drop_and_return;
// this process really seems to be container/pod related
//
if ( (offset = strlen(tmphost) - UTSLEN) < 0)
offset = 0;
strcpy(curtask->gen.utsname, tmphost+offset); // copy last part when overflow
if (! droprootprivs())
mcleanstop(42, "failed to drop root privs\n");
return 1;
drop_and_return:
if (! droprootprivs())
mcleanstop(42, "failed to drop root privs\n");
return 0;
}
// Reassociate atop with its own UTS namespace
//
void
resetutsname(void)
{
// switch back to my own original UTS namespace
//
if (foreignuts)
{
foreignuts = 0;
regainrootprivs();
if (setns(mypidfd, CLONE_NEWUTS) == -1)
;
if (! droprootprivs())
mcleanstop(42, "failed to drop root privs\n");
}
}
|