[PATCH] connector: add parent pid and tgid to coredump and exit events

[PATCH] connector: add parent pid and tgid to coredump and exit events

[Stefan Strogin]

The intention is to get notified of process failures as soon
as possible, before a possible core dumping (which could be very long)
(e.g. in some process-manager). Coredump and exit process events
are perfect for such use cases (see 2b5faa4c553f "connector: Added
coredumping event to the process connector").

The problem is that for now the process-manager cannot know the parent
of a dying process using connectors. This could be useful if the
process-manager should monitor for failures only children of certain
parents, so we could filter the coredump and exit events by parent
process and/or thread ID.

Add parent pid and tgid to coredump and exit process connectors event
data.

Signed-off-by: Stefan Strogin <sstrogin@cisco.com>
---
 drivers/connector/cn_proc.c  | 4 ++++
 include/uapi/linux/cn_proc.h | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index a782ce87715c..ed5e42461094 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -262,6 +262,8 @@ void proc_coredump_connector(struct task_struct *task)
 	ev->what = PROC_EVENT_COREDUMP;
 	ev->event_data.coredump.process_pid = task->pid;
 	ev->event_data.coredump.process_tgid = task->tgid;
+	ev->event_data.coredump.parent_pid = task->real_parent->pid;
+	ev->event_data.coredump.parent_tgid = task->real_parent->tgid;
 
 	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
 	msg->ack = 0; /* not used */
@@ -288,6 +290,8 @@ void proc_exit_connector(struct task_struct *task)
 	ev->event_data.exit.process_tgid = task->tgid;
 	ev->event_data.exit.exit_code = task->exit_code;
 	ev->event_data.exit.exit_signal = task->exit_signal;
+	ev->event_data.exit.parent_pid = task->real_parent->pid;
+	ev->event_data.exit.parent_tgid = task->real_parent->tgid;
 
 	memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
 	msg->ack = 0; /* not used */
diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
index 68ff25414700..db210625cee8 100644
--- a/include/uapi/linux/cn_proc.h
+++ b/include/uapi/linux/cn_proc.h
@@ -116,12 +116,16 @@ struct proc_event {
 		struct coredump_proc_event {
 			__kernel_pid_t process_pid;
 			__kernel_pid_t process_tgid;
+			__kernel_pid_t parent_pid;
+			__kernel_pid_t parent_tgid;
 		} coredump;
 
 		struct exit_proc_event {
 			__kernel_pid_t process_pid;
 			__kernel_pid_t process_tgid;
 			__u32 exit_code, exit_signal;
+			__kernel_pid_t parent_pid;
+			__kernel_pid_t parent_tgid;
 		} exit;
 
 	} event_data;
-- 
2.11.0

Re: [PATCH] connector: add parent pid and tgid to coredump and exit events

[David Miller]

From: Stefan Strogin <sstrogin@cisco.com>
Date: Thu, 29 Mar 2018 17:12:47 +0300

> diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
> index 68ff25414700..db210625cee8 100644
> --- a/include/uapi/linux/cn_proc.h
> +++ b/include/uapi/linux/cn_proc.h
> @@ -116,12 +116,16 @@ struct proc_event {
>  		struct coredump_proc_event {
>  			__kernel_pid_t process_pid;
>  			__kernel_pid_t process_tgid;
> +			__kernel_pid_t parent_pid;
> +			__kernel_pid_t parent_tgid;
>  		} coredump;
>  
>  		struct exit_proc_event {
>  			__kernel_pid_t process_pid;
>  			__kernel_pid_t process_tgid;
>  			__u32 exit_code, exit_signal;
> +			__kernel_pid_t parent_pid;
> +			__kernel_pid_t parent_tgid;
>  		} exit;
>  
>  	} event_data;

I don't think you can add these members without breaking UAPI.

Re: [PATCH] connector: add parent pid and tgid to coredump and exit events

[Stefan Strogin]

Hi David,

I don't see how it breaks UAPI. The point is that structures
coredump_proc_event and exit_proc_event are members of *union*
event_data, thus position of the existing data in the structure is
unchanged. Furthermore, this change won't increase size of struct
proc_event, because comm_proc_event (also a member of event_data) is
of bigger size than the changed structures.

If I'm wrong, could you please explain what exactly will the change
break in UAPI?


On 30/03/18 19:59, David Miller wrote:
> From: Stefan Strogin <sstrogin@cisco.com>
> Date: Thu, 29 Mar 2018 17:12:47 +0300
> 
>> diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
>> index 68ff25414700..db210625cee8 100644
>> --- a/include/uapi/linux/cn_proc.h
>> +++ b/include/uapi/linux/cn_proc.h
>> @@ -116,12 +116,16 @@ struct proc_event {
>>  		struct coredump_proc_event {
>>  			__kernel_pid_t process_pid;
>>  			__kernel_pid_t process_tgid;
>> +			__kernel_pid_t parent_pid;
>> +			__kernel_pid_t parent_tgid;
>>  		} coredump;
>>  
>>  		struct exit_proc_event {
>>  			__kernel_pid_t process_pid;
>>  			__kernel_pid_t process_tgid;
>>  			__u32 exit_code, exit_signal;
>> +			__kernel_pid_t parent_pid;
>> +			__kernel_pid_t parent_tgid;
>>  		} exit;
>>  
>>  	} event_data;
> 
> I don't think you can add these members without breaking UAPI.
> 

Re: [PATCH] connector: add parent pid and tgid to coredump and exit events

[Stefan Strogin]

Hi David, Evgeniy,

Sorry to bother you, but could you please comment about the UAPI change and the patch?

Thanks, Jesper.

--
Stefan

On 05/04/18 12:07, Jesper Derehag wrote:
> Unless David comes back with something I have (also) missed regarding uapi breakage, this looks good to me.
> 
> /Jesper
> 
> ________________________________________
> Från: Stefan Strogin <sstrogin@cisco.com>
> Skickat: den 2 april 2018 17:18
> Till: David Miller
> Kopia: zbr@ioremap.net; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; xe-linux-external@cisco.com; jderehag@hotmail.com; matt.helsley@gmail.com; minipli@googlemail.com
> Ämne: Re: [PATCH] connector: add parent pid and tgid to coredump and exit events
> 
> Hi David,
> 
> I don't see how it breaks UAPI. The point is that structures
> coredump_proc_event and exit_proc_event are members of *union*
> event_data, thus position of the existing data in the structure is
> unchanged. Furthermore, this change won't increase size of struct
> proc_event, because comm_proc_event (also a member of event_data) is
> of bigger size than the changed structures.
> 
> If I'm wrong, could you please explain what exactly will the change
> break in UAPI?
> 
> 
> On 30/03/18 19:59, David Miller wrote:
>> From: Stefan Strogin <sstrogin@cisco.com>
>> Date: Thu, 29 Mar 2018 17:12:47 +0300
>>
>>> diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
>>> index 68ff25414700..db210625cee8 100644
>>> --- a/include/uapi/linux/cn_proc.h
>>> +++ b/include/uapi/linux/cn_proc.h
>>> @@ -116,12 +116,16 @@ struct proc_event {
>>>              struct coredump_proc_event {
>>>                      __kernel_pid_t process_pid;
>>>                      __kernel_pid_t process_tgid;
>>> +                    __kernel_pid_t parent_pid;
>>> +                    __kernel_pid_t parent_tgid;
>>>              } coredump;
>>>
>>>              struct exit_proc_event {
>>>                      __kernel_pid_t process_pid;
>>>                      __kernel_pid_t process_tgid;
>>>                      __u32 exit_code, exit_signal;
>>> +                    __kernel_pid_t parent_pid;
>>> +                    __kernel_pid_t parent_tgid;
>>>              } exit;
>>>
>>>      } event_data;
>>
>> I don't think you can add these members without breaking UAPI.
>>
> 

Re: [PATCH] connector: add parent pid and tgid to coredump and exit events

[Evgeniy Polyakov]

Stefan, hi

Sorry for delay.

26.04.2018, 15:04, "Stefan Strogin" <stefan.strogin@gmail.com>:
> Hi David, Evgeniy,
>
> Sorry to bother you, but could you please comment about the UAPI change and the patch?

With 4-bytes pid_t everything looks fine, and I do not know arch where pid is larger currently, so it looks safe.

David, please pull it into your tree, or should it go via different path?

Acked-by: Evgeniy Polyakov <zbr@ioremap.net>


>>  I don't see how it breaks UAPI. The point is that structures
>>  coredump_proc_event and exit_proc_event are members of *union*
>>  event_data, thus position of the existing data in the structure is
>>  unchanged. Furthermore, this change won't increase size of struct
>>  proc_event, because comm_proc_event (also a member of event_data) is
>>  of bigger size than the changed structures.
>>
>>  If I'm wrong, could you please explain what exactly will the change
>>  break in UAPI?
>>
>>  On 30/03/18 19:59, David Miller wrote:
>>>  From: Stefan Strogin <sstrogin@cisco.com>
>>>  Date: Thu, 29 Mar 2018 17:12:47 +0300
>>>
>>>>  diff --git a/include/uapi/linux/cn_proc.h b/include/uapi/linux/cn_proc.h
>>>>  index 68ff25414700..db210625cee8 100644
>>>>  --- a/include/uapi/linux/cn_proc.h
>>>>  +++ b/include/uapi/linux/cn_proc.h
>>>>  @@ -116,12 +116,16 @@ struct proc_event {
>>>>               struct coredump_proc_event {
>>>>                       __kernel_pid_t process_pid;
>>>>                       __kernel_pid_t process_tgid;
>>>>  + __kernel_pid_t parent_pid;
>>>>  + __kernel_pid_t parent_tgid;
>>>>               } coredump;
>>>>
>>>>               struct exit_proc_event {
>>>>                       __kernel_pid_t process_pid;
>>>>                       __kernel_pid_t process_tgid;
>>>>                       __u32 exit_code, exit_signal;
>>>>  + __kernel_pid_t parent_pid;
>>>>  + __kernel_pid_t parent_tgid;
>>>>               } exit;
>>>>
>>>>       } event_data;
>>>
>>>  I don't think you can add these members without breaking UAPI.

Re: [PATCH] connector: add parent pid and tgid to coredump and exit events

[David Miller]

From: Evgeniy Polyakov <zbr@ioremap.net>
Date: Mon, 30 Apr 2018 18:01:30 +0300

> Stefan, hi
> 
> Sorry for delay.
> 
> 26.04.2018, 15:04, "Stefan Strogin" <stefan.strogin@gmail.com>:
>> Hi David, Evgeniy,
>>
>> Sorry to bother you, but could you please comment about the UAPI change and the patch?
> 
> With 4-bytes pid_t everything looks fine, and I do not know arch where pid is larger currently, so it looks safe.
> 
> David, please pull it into your tree, or should it go via different path?
> 
> Acked-by: Evgeniy Polyakov <zbr@ioremap.net>

After this much time it needs to be resubmitted.