Search code examples
linuxlinux-kernelbpfebpf

How can I retrieve a task's sessionid in an eBPF program?


I want to retrieve the sessionid from a task struct in an eBPF program. I have the following code in my eBPF program:

struct task_struct *task;
u32 sessionid;    

task = (struct task_struct *)bpf_get_current_task();
sessionid = task->sessionid;

This runs, but the sessionid always ends up being -1. I read in this answer that I can use task_session to retrieve it, but I get an error about invalid memory access. I believe I need to use bpf_probe_read to move the task_struct that task points to onto the stack, but I can't get it to work. Is there anything I'm missing?


Solution

  • After a bit more digging through the task_struct struct I realised you could do this:

    struct task_struct *task;
    struct pid_link pid_link;
    struct pid pid;
    unsigned int sessionid;
    
    task = (struct task_struct *)bpf_get_current_task();
    
    bpf_probe_read(&pid_link, sizeof(pid_link), (void *)&task->group_leader->pids[PIDTYPE_SID]);    
    bpf_probe_read(&pid, sizeof(pid), (void *)pid_link.pid);
    
    sessionid = pid.numbers[0].nr;