Hunt PIDTYPE_PGID and PIDTYPE_SID in BTF. Fixes RHEL8. #210
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nicholasberlin
approved these changes
Oct 31, 2024
haesbaert
force-pushed
the
pgid_sid_fix
branch
from
3a41f0d
to
dd6a67b
Compare
Found in quark-test when running on RHEL8: Linux rocky8 4.18.0-553.22.1.el8_10.x86_64 #1 SMP Wed Sep 25 09:20:43 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux Related commit in quark: elastic/quark@89e606b New kernels have a PIDTYPE_TGID after PIDTYPE_PID, which bumpes PIDTYPE_PGID and PIDTYPE_SID: https://elixir.bootlin.com/linux/v6.11/source/include/linux/pid_types.h#L8 4.18 (RHEL8) which we can actually run on since redhat backported ebpf ringbuffers still has the old definition: https://elixir.bootlin.com/linux/v4.18/source/include/linux/pid.h With this diff `quark-test` passes on asserting pgid and sid correspond to the return of getpgid(2) and getsid(2) on 4.18.0-553.22.1.el8_10.x86_64: https://github.com/elastic/quark/blob/main/quark-test.c#L273-L274
haesbaert
force-pushed
the
pgid_sid_fix
branch
from
dd6a67b
to
6f19328
Compare
fearful-symmetry
approved these changes
Oct 31, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Found in quark-test when running on RHEL8:
Linux rocky8 4.18.0-553.22.1.el8_10.x86_64 #1 SMP Wed Sep 25 09:20:43 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
Related commit in quark: elastic/quark@89e606b
New kernels have a PIDTYPE_TGID after PIDTYPE_PID, which bumpes PIDTYPE_PGID and PIDTYPE_SID: https://elixir.bootlin.com/linux/v6.11/source/include/linux/pid_types.h#L8
4.18 (RHEL8) which we can actually run on since redhat backported ebpf ringbuffers still has the old definition:
https://elixir.bootlin.com/linux/v4.18/source/include/linux/pid.h
With this diff
quark-testpasses on asserting pgid and sid correspond to the return of getpgid(2) and getsid(2) on 4.18.0-553.22.1.el8_10.x86_64:https://github.com/elastic/quark/blob/main/quark-test.c#L273-L274
(edit fixed link)