-
Notifications
You must be signed in to change notification settings - Fork 131
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: check cap privileges instead of
Geteuid during starting the a…
…gent (#242) * feat: Introduce github.com/containerd/containerd/pkg/cap to check whether process has CAP_BPF privilege Signed-off-by: spencercjh <[email protected]> * fix: better logs * fix: adapt to e2e test env * style: go mod tidy * fix: make tests pass * fix: DO NOT use containerd cap package * test: introduce tests to verify agent/common/permission.go * fix: correct implementation refer to https://man7.org/linux/man-pages/man2/capset.2.html * test: test test_add_cap_bpf first * test: cap-add difference capability for different kernal * test: load btf file to container and run kyanos with --btf flag * test: add missing capability CAP_SYS_RESOURCE * test: try to use --privileged instead of cap-add --------- Signed-off-by: spencercjh <[email protected]>
- Loading branch information
1 parent
ca70f6d
commit 6d0b142
Showing
8 changed files
with
137 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| package common | ||
|
|
||
| import ( | ||
| "golang.org/x/sys/unix" | ||
| ) | ||
|
|
||
| const ( | ||
| // capBpf 0000 0000 0000 0000 0000 0000 1000 0000 | ||
| capBpf = 1 << (unix.CAP_BPF - 32) | ||
| // capSysAdmin 0000 0000 0010 0000 0000 0000 0000 0000 | ||
| capSysAdmin = 1 << unix.CAP_SYS_ADMIN | ||
| ) | ||
|
|
||
| // HasPermission reference: https://man7.org/linux/man-pages/man2/capset.2.html | ||
| func HasPermission() (bool, error) { | ||
| hdr := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3} | ||
| var data [2]unix.CapUserData | ||
| if err := unix.Capget(&hdr, &data[0]); err != nil { | ||
| return false, err | ||
| } | ||
| // Note that the CAP_* values are bit indexes and need to be bit-shifted before ORing into the bit fields. | ||
| // Note that 64-bit capabilities use datap[0] and datap[1], whereas 32-bit capabilities use only datap[0]. | ||
| return data[1].Permitted&capBpf != 0 || data[0].Permitted&capSysAdmin != 0, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| #!/usr/bin/env bash | ||
| set -ex | ||
|
|
||
| DOCKER_REGISTRY="$1" | ||
| if [ -n "$DOCKER_REGISTRY" ]; then | ||
| # 检查是否以 / 结尾 | ||
| if [[ "$DOCKER_REGISTRY" != */ ]]; then | ||
| DOCKER_REGISTRY="${DOCKER_REGISTRY}/" | ||
| fi | ||
| else | ||
| echo "DOCKER_REGISTRY is missing." | ||
| fi | ||
|
|
||
| # CAP_SYS_RESOURCE reference: https://docs.ebpf.io/linux/concepts/resource-limit/ | ||
| sudo docker run -d --ulimit memlock=100000000000:100000000000 --cap-add=CAP_SYS_RESOURCE --name alpine $DOCKER_REGISTRY'alpine' sh -c 'sleep 120' || true | ||
| sudo docker cp /host/kyanos/kyanos alpine:/ | ||
| sudo docker cp ./testdata/test_not_add_cap_bpf.sh alpine:/ | ||
| sudo docker cp /var/lib/kyanos/btf/current.btf alpine:/ | ||
| sudo docker exec alpine sh -c 'sh /test_not_add_cap_bpf.sh "/kyanos --btf /current.btf"' | ||
| sudo docker stop alpine && sudo docker rm alpine | ||
|
|
||
| # mount sys reference: https://stackoverflow.com/questions/75808955/error-mounting-sys-kernel-debug-tracing-to-rootfs | ||
| sudo docker run -d -v /sys/:/sys/ --privileged --name alpine $DOCKER_REGISTRY'alpine' sh -c 'sleep 120' || true | ||
| sudo docker cp /host/kyanos/kyanos alpine:/ | ||
| sudo docker cp ./testdata/test_add_cap_bpf.sh alpine:/ | ||
| sudo docker cp /var/lib/kyanos/btf/current.btf alpine:/ | ||
| sudo docker exec alpine sh -c 'sh /test_add_cap_bpf.sh "/kyanos --btf /current.btf"' | ||
| sudo docker stop alpine && sudo docker rm alpine |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| #!/usr/bin/env sh | ||
| set -x | ||
|
|
||
| CMD="$1" | ||
| FILE_PREFIX="/tmp/kyanos" | ||
| LNAME="${FILE_PREFIX}_test_add_cap_bpf_before.log" | ||
|
|
||
| timeout 30 ${CMD} watch http --debug-output 2>&1 | tee "${LNAME}" & | ||
| wait | ||
|
|
||
| cat "${LNAME}" | ||
| cat "${LNAME}" | grep -v "requires CAP_BPF" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| #!/usr/bin/env sh | ||
| set -x | ||
|
|
||
| CMD="$1" | ||
| FILE_PREFIX="/tmp/kyanos" | ||
| LNAME="${FILE_PREFIX}_test_not_add_cap_bpf_before.log" | ||
|
|
||
| timeout 30 ${CMD} watch http --debug-output 2>&1 | tee "${LNAME}" & | ||
| wait | ||
|
|
||
| cat "${LNAME}" | ||
| cat "${LNAME}" | grep "requires CAP_BPF" |