a idea about probe proc path like /proc/pid/root/xxx

a idea about probe proc path like /proc/pid/root/xxx

[Cong Wu]

hi all. currently, I'm use stap to probe user process like `probe process("/proc/xx/root/xxx").function("a")`, what I really want is to probe a process running in docker, I make a small patch.
here is what i did. https://github.com/woodgear/systemtap-wg/commit/0872dc3f5594be520afd83fc5075fff8c6bec955.
basically if solib_pathname start with /proc/$(task->tgid)/root then i just compare the rest part of it.
```
--- a/runtime/linux/uprobes-inode.c
+++ b/runtime/linux/uprobes-inode.c
@@ -813,6 +813,8 @@ stapiu_mmap_found(struct stap_task_finder_target *tf_target,
   struct stapiu_process* p;
   int known_mapping_p;
   unsigned long flags;
+  char proc_path_buff[100];
+  char *proc_path="/proc/";

   dbug_uprobes("wg: in mmap_found pid %d inode %ld\n",task->tgid,dentry->d_inode->i_ino);

@@ -876,18 +878,33 @@ stapiu_mmap_found(struct stap_task_finder_target *tf_target,

   if (! known_mapping_p) {

     /* The file path or build-id must match. The build-id address
      * is calculated using start address of this vma, the file
      * offset of the vma start address and the file offset of
      * the build-id. */
-    if (c->solib_pathname && path && strcmp (path, c->solib_pathname))
-      return 0;
+    if (c->solib_pathname && path) {
+        if (strncmp(proc_path, c->solib_pathname, strlen(proc_path)) == 0) {
+            sprintf(proc_path_buff,"/proc/%d/root%s",task->tgid,path);
+            if (strcmp (proc_path_buff, c->solib_pathname)) {
+                return 0;
+            }
+        }else {
+            // not proc path just compare
+            if (strcmp (path, c->solib_pathname)) {
+                return 0;
+            }
+        }
+    }
     if (c->solib_build_id_len > 0 && !__verify_build_id(task,
                                                        addr - offset + c->solib_build_id_vaddr,
                                                        c->solib_build_id,
-                                                       c->solib_build_id_len))
+                                                       c->solib_build_id_len)) {
+
       return 0;
+    }
   }

   // If we made it this far, we have an interesting solib.
@@ -923,7 +940,7 @@ stapiu_mmap_found(struct stap_task_finder_target *tf_target,
       spin_lock_irqsave (&c->process_list_lock, flags);
       list_add(&p->process_list, &c->process_list_head);
       spin_unlock_irqrestore (&c->process_list_lock, flags);
     } else
       _stp_warn("out of memory tracking solib %s in process %ld\n",
                 path, (long) task->tgid);
```
this is just a draft code to show what I want to change.
is this way work?
A further idea is that we can add an option like --use-proc-path to find the uprobe file path at a given pid.

Re: a idea about probe proc path like /proc/pid/root/xxx

[Frank Ch. Eigler]

Cong Wu <congwu@alauda.io> writes:

> hi all. currently, I'm use stap to probe user process like `probe
> process("/proc/xx/root/xxx").function("a")`, what I really want is to
> probe a process running in docker, I make a small patch.

Interesting idea.

> [...]
> basically if solib_pathname start with /proc/$(task->tgid)/root then i
> just compare the rest part of it.

That's an interesting solution.  Does it work fully?  Have you tried the
buildid-based probing facility, which is independent of run-time paths
such as containers/namespace?  We're also working on another extension
that is related: https://sourceware.org/bugzilla/show_bug.cgi?id=27410

- FChE