How can I retrieve the mount namespace of the current task in a BPF program using GCP's 4.15 kernel?

问题

I am trying to retrieve the mount namespace of the current task in a BPF program as follows:

task = (struct task_struct *)bpf_get_current_task();
bpf_probe_read(&nsproxy, sizeof(nsproxy), (void *)&task->nsproxy);
bpf_probe_read(&mnt_ns, sizeof(mnt_ns), (void *)&nsproxy->mnt_ns);
bpf_probe_read(&ns, sizeof(ns), (void *)&mnt_ns->ns);
mnt_ns_inum = ns.inum;

This works fine using an Ubuntu kernel (uname -r: 4.15.0-13-generic) and mnt_ns_inum gets a value of 4026531840 for tasks in the host's mount namespace but running the same code using GCP's kernel (uname -r: 4.15.0-1019-gcp) always sets mnt_ns_inum to 0.

I am at a loss as to what Google could have changed to cause this behaviour (I am testing this on a local VM so the only difference between the two cases is the kernel I have booted the VM with and the kernel headers used for compilation).

Additionally, this same code worked for a GCP 4.13 kernel (uname -r: 4.13.0-1008-gcp) so it seems that this is a recent change.

EDIT:

For the 4.15 GCP kernel, the return values for the calls to bpf_probe_read are as follows:

• 0
• 18446744073709551602
• 18446744073709551602

As mentioned in the comments below, the non-zero return values correspond to -EFAULT.

来源：https://stackoverflow.com/questions/52568585/how-can-i-retrieve-the-mount-namespace-of-the-current-task-in-a-bpf-program-usin