| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
In the listener, I change the order coroutines are started to avoid
'send on a closed channel'. Besides, the method to get syscall names
and numbers are not so universial, so let's go back to check unistd.h.
In the filter, the output is set to be written to ./log dir. Pid tree
are shown in logs/tree.log, and detail info in pids.log, while file info
in the logs/files.log. tree.log shows a tree just like `tree` command,
the other two files are written in json.
What's more, the flags while opening files are also checked ans showed
in files.log.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
**1. about root fs**
The setns is used by a process(for example, process 12345), to enter
a namespace of another process(also, process 12000). Process 12345
opens visual file /proc/12000/ns/xxx, gets a fd, then setns(fd, nstype).
Here xxx represents for special type of namespace such as mnt/ipc.
Param nstype can be found out in manual.
In short, switching namespace uses not fileName but file descriptor,
which makes it too hard to listen to setns, because the fd info may
have been lost on the road, or it's still on road, not in db. This
would make significant error!
So, in this commit, I check /proc/pid/cgroup. Although it has nothing
to do with root filesystem, it contains docker id. Record it, and
deal with it in the filter: For each process that has pivot_root, it
records its docker id, we remember the map from docker id to rootfs;
then check all processes on the tree, if it has docker id, add the
corresponding rootfs.
**2. Exit time of pids to be zero**
Besides, I fix the exit time of pid in this commit. After merging
the same processes, sort them in ascending order, so that in each
tgid node, the main pid is always the first thread. Then, check
other pids' exit time, if is zero, assumpt that exit time is the
same as main pid, which means the process exit while the thread is
running.
**3. Wrong parent**
I fix the ppid of threads. For example, process 10 has a child
process 20, 20 has threads 20 and 23. When pid 20 is recvd, the ppid
and parentTgid in message must be 10. But then, 10 exits, and the parent
process of 20 comes to be 1, then 20 makes thread 23. When pid 23 is
recvd, the ppid and parentTgid is 1, that's totally wrong!
Also, using the sorted process array, we can easily find the main
thread, so get the real parent, and check the ppid of other threads.
**4. Clean file name**
The original file name in database may be complex(such as
"/1/2/./../3"). Clean it with go pkg "path"
**5. Next step**
TODO: Fix the netlink connector, may it usable immediately after
powering on. Then the view.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This commit I make some changes:
- The filter got mainly finished.
- Build a big node by the same tgid, and use the tgid node to
build th tree we need by bfs.
- Filt relative files, and for the files not closed, add close
time stamp according to the exit time of their pids.
- Put all the results into database.
Besides, I enlarge the buffer size of netlink connector and channels
in lintener.
TODO:
- the pivot_root syscall is used only by the initial shell(`docker
start` makes a shell), other processes of shell change their root
by changing namespace(mnt ns?), using setns syscall. So fix it.
- It's time to fix the netlink connector socket.
|
|
|
First of all, fix sth in listener to fit the function of filter. Ori-
ginally, listener mark the /usr/bin/containerd process id with star,
but the children in db is updated by ppid, which is pid of parent but
not tgid, so the stared pid has no children. To Fix this, we add all
the pid of /usr/bin/containerd into the db, and set their ptgid/tgid,
so that they're just normal process as others. Maybe we should finish
the info of these processes? haha.
Then, the filter of pid. There're some designed steps to do, and their
methods are as follows:
- Initially, because of the multithreading execution of listener,
there may be several entries for the same process, and we should
merge them. Extract data from database into a slice, and use a map
to record process info. Iterate the slice, if the pid is in the
map, then merge them, else insert into the map.
- Then, we should build process tree, but what we have is pid. So
use another data structure, iterate merged process map, and build
a map from tgid to a slice of processes. Find out the star. Build
a map from pid to its tgid.
- BFS. Design a simple queue, and build the tree from the root(stared
tgid), record all the visited tgid in another map. That's just the
tree.
As usual, let's talk about the remaining issues:
- Some pids did not recieve exit message. Check the exit time of
its tgid, or even its ppid.
- Optimize the data structure, record the tree by itself. Now the
tree is recorded by not only the last helloTree map from tgid to
slice but the map from pid to tgid. It's hard to store in the
database. Design a better ds, so the viewer can build the tree
quickly from the data in db.
- For future file filter, the close time, the same file for the same
pid, and the pathName of a file, should be paid mych attention.
Fighting!
|
We-unite