ACK: [PATCH 0/5][f linux-azure] Azure: Focal 5.4 kernel eBPF opensnoop does not display PATH

[Cengiz Can]

On Fri, 2022-09-16 at 13:56 -0600, Tim Gardner wrote:
> BugLink: https://bugs.launchpad.net/bugs/1990009
> 
> SRU Justification
> 
> [Impact]
> 
> The actual kernel used on AKS arm64 (i.e. 5.4.1089) suffers from a known problem [1].
> As a consequence, opensnoop does not display PATH:
> # Run the following from Canonical:UbuntuServer:18_04-daily-lts-arm64:18.04.202208290
> $ uname -a
> Linux francis-vm-arm64-ubuntu18vm 5.4.0-1089-azure #94~18.04.1-Ubuntu SMP Fri Aug 5 12:36:48 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux
> $ lsb_release -rd
> Description: Ubuntu 18.04.6 LTS
> Release: 18.04
> $ git clone --recurse-submodules https://github.com/iovisor/bcc
> Linux francis-vm-arm64-ubuntu18vm 5.4.0-1089-azure #94~18.04.1-Ubuntu SMP Fri Aug 5 12:36:48 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux
> $ sudo sh -c 'apt update && apt install -qy clang-10 llvm-10 make gcc pkg-config libelf-dev libz-dev'
> ...
> $ cd bcc/libbpf-tools
> $ CLANG=clang-10 LLVM_STRIP=llvm-strip-10 make -j opensnoop
> ...
> BINARY opensnoop
> $ sudo ./opensnoop
> PID COMM FD ERR PATH
> 1672 python3 3 0
> 9746 opensnoop 20 0
> 1672 python3 3 0
> 1672 python3 3 0
> 1672 python3 -1 2
> 1672 python3 3 0
> 1 systemd 18 0
> 1672 python3 6 0
> 1672 python3 3 0
> 1672 python3 3 0
> 1672 python3 3 0
> 1672 python3 3 0
> 1672 python3 3 0
> ^C
> As you can see, nothing is printed for the PATH while normal behavior prints the
> path of the opened file:
> $ uname -a
> Linux pwmachine 5.15.0-46-generic #49~20.04.1-Ubuntu SMP Thu Aug 4 19:15:44 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
> $ sudo ./opensnoop
> PID COMM FD ERR PATH
> 2704 systemd 23 0 virtual
> 2704 systemd 22 0 misc
> 2704 systemd 23 0 fuse
> 2704 systemd 22 0 /sys/devices/virtual/misc/fuse/uevent
> 2704 systemd 22 0 /run/udev/data/c10:229
> 2704 systemd 22 0 /proc/2704/status
> 2704 systemd 22 0 /proc/2704/status
> 2704 systemd 22 0 /proc/2704/status
> ^C
> 
> This bug was fixed in upstream patch [2]
> Sadly, this patch was not back ported, so it is not present in stable kernels.
> 
> [Test plan]
> 
> Follow the above instructions.
> 
> The kernel built using 'git://git.launchpad.net/~timg-tpi/ubuntu/+source/linux/+git/focal focal-azure-opensnoop'
> worked correctly.
> 
> [Where things could go wrong]
> 
> Unknown
> 
> [Other Info]
> 
> Original RFC at https://lists.ubuntu.com/archives/kernel-team/2022-September/133038.html

Acked-by: Cengiz Can <cengiz.can at canonical.com>

> 
> 
>