feat(disk-failure): cgroupv2 filter and relative-path disruption

Adds two capabilities to the eBPF disk-failure injector:

1. Cgroupv2-based process filtering
   Expose CgroupV2Path() on cgroup.Manager (returns the absolute
   cgroupv2 unified hierarchy path on v2, empty string on v1).
   The injector passes this path as -cgroup-path to bpf-disk-failure,
   which populates a BPF_MAP_TYPE_CGROUP_ARRAY and uses
   bpf_current_task_under_cgroup() to match the target container and
   all its sub-cgroups (e.g. kubectl exec creates containerd
   exec-<id> sub-cgroups that the old PID filter missed).
   Gate disk-failure on HaveCgroupArrayMapType so load failures on
   kernels that lack it surface as a clear error.

2. Relative-path disruption (cd /dir && cat file)
   Previously only absolute openat paths were matched. Now the
   injector stats the filter path inside the container via
   /proc/<pid>/root and passes two inode/device pairs to the BPF
   program:
   - filter_dir_inode/filter_dir_dev: inode of the parent directory
     for basename-prefix matching ("cwd=/parent && rtk read dir/file")
   - filter_dir_inode2/filter_dir_dev2: inode of the path itself
     when it is a directory, for exact-CWD matching
     ("cwd=/dir && rtk read file")
   The BPF check_relative_path helper runs both checks and only fires
   when dirfd == AT_FDCWD, avoiding false matches on non-CWD dirfds.
   Device IDs are passed in kernel MKDEV encoding (major<<20|minor)
   rather than the glibc encode_dev format to match super_block.s_dev.
   ProcRoot is injected via config so tests point at a nonexistent
   path and remain deterministic across macOS and Linux CI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: aymericDD

cgroup/manager.go

@@ -30,6 +30,10 @@ type Manager interface {
 	IsCgroupV2() bool
 	// RelativePath returns the controller relative path
 	RelativePath(controller string) string
+	// CgroupV2Path returns the absolute cgroupv2 unified hierarchy path for the cgroup,
+	// or empty string on cgroupv1. Used to populate BPF_MAP_TYPE_CGROUP_ARRAY for
+	// bpf_current_task_under_cgroup() ancestor checking (covers kubectl exec sub-cgroups).
+	CgroupV2Path() string
 }
 
 type instCGroupManager interface {
@@ -131,3 +135,12 @@ func (m manager) IsCgroupV2() bool {
 func (m manager) RelativePath(controller string) string {
 	return strings.TrimPrefix(m.cgroups.Path(controller), m.mountPath)
 }
+
+// CgroupV2Path returns the absolute cgroupv2 unified hierarchy path, or "" on cgroupv1.
+func (m manager) CgroupV2Path() string {
+	if !m.isV2 {
+		return ""
+	}
+
+	return m.cgroups.Path("")
+}

cgroup/manager_mock.go

@@ -8,4 +8,7 @@
 
 package ebpf
 
-const SysOpenat = "__arm64_sys_openat"
+// do_sys_openat2 is used instead of __arm64_sys_openat because only do_sys_openat2
+// is tagged ALLOW_ERROR_INJECTION in the kernel (fs/open.c), which is required for
+// bpf_override_return to actually override the syscall return value.
+const SysOpenat = "do_sys_openat2"

ebpf/const-arm.go

@@ -8,4 +8,7 @@
 
 package ebpf
 
-const SysOpenat = "__x64_sys_openat"
+// do_sys_openat2 is used instead of __x64_sys_openat because only do_sys_openat2
+// is tagged ALLOW_ERROR_INJECTION in the kernel (fs/open.c), which is required for
+// bpf_override_return to actually override the syscall return value.
+const SysOpenat = "do_sys_openat2"

ebpf/const-x64.go

@@ -8,7 +8,33 @@
 
 const volatile pid_t target_pid = 0;
 const volatile pid_t exclude_pid;
+const volatile int use_cgroup_filter = 0;
 const volatile char filter_path[61];
+// Inode of filter_path's parent directory. When non-zero, enables filtering of
+// relative openat calls by comparing the process CWD inode against this value.
+// Works correctly inside containers because Kubernetes volumes are bind-mounted:
+// the host inode and the in-container inode are identical.
+const volatile u64 filter_dir_inode = 0;
+// Device ID paired with filter_dir_inode. Inodes are only unique within a device,
+// so checking both prevents false matches on bind-mounted or multi-filesystem targets.
+const volatile u32 filter_dir_dev = 0;
+// Second inode/device pair: set when filter_path is itself a directory. When the
+// CWD matches this inode/device, any relative open (except ".." escapes) is
+// in-scope. This handles "cd /mnt/data && cat file" alongside the parent+basename
+// case covered by filter_dir_inode (i.e. "cwd=/mnt && cat data/file").
+const volatile u64 filter_dir_inode2 = 0;
+const volatile u32 filter_dir_dev2 = 0;
+
+// Populated from userspace with the container's cgroupv2 directory fd.
+// bpf_current_task_under_cgroup() matches the process itself AND any sub-cgroup
+// (e.g. containerd exec-<id> sub-cgroups created by kubectl exec).
+struct {
+    __uint(type, BPF_MAP_TYPE_CGROUP_ARRAY);
+    __uint(max_entries, 1);
+    __type(key, u32);
+    __type(value, u32);
+} target_cgroup SEC(".maps");
+
 const volatile pid_t exit_code = ENOENT;
 const volatile int probability = 100;
 
@@ -18,7 +44,7 @@ unsigned int disruptedHits = 0;
 struct data_t {
     u32 ppid;
     u32 pid;
-    u32 tid; 
+    u32 tid;
     u32 id;
     char comm[100];
 };
@@ -30,12 +56,111 @@ struct {
     __type(value, u32);
 } events SEC(".maps");
 
-SEC("kprobe/sys_openat")
+// AT_FDCWD sentinel value; openat resolves relative paths against the CWD only
+// when this value is passed as dirfd.
+#ifndef AT_FDCWD
+#define AT_FDCWD -100
+#endif
+
+// check_basename_prefix returns 1 if rel_buf starts with the basename suffix of
+// filter_path (the part after the last '/').
+static __always_inline int check_basename_prefix(const char *rel_buf)
+{
+    int last_slash = 0;
+    for (int i = 0; i < 60; i++) {
+        if (filter_path[i] == '\0') break;
+        if (filter_path[i] == '/') last_slash = i;
+    }
+    for (int i = 0; i < 60; i++) {
+        int fi = last_slash + 1 + i;
+        if (fi >= 61) break;
+        if (filter_path[fi & 0x3f] == '\0') break;
+        if (rel_buf[i] != filter_path[fi & 0x3f]) return 0;
+    }
+    return 1;
+}
+
+// check_relative_path returns 1 if a relative openat call should be disrupted.
+// Two checks are attempted in order:
+//   1. CWD inode == filter_dir_inode (parent of filter_path) AND rel_path starts
+//      with the basename — handles "cwd=/parent && openat(AT_FDCWD, "dir/file")".
+//   2. CWD inode == filter_dir_inode2 (filter_path itself, set when it is a dir)
+//      AND rel_path does not start with ".." — handles "cwd=/dir && openat(AT_FDCWD, "file")".
+// Only called when dirfd == AT_FDCWD; other dirfds are not supported.
+// Using the CWD inode rather than walking the dentry chain works inside containers
+// because Kubernetes volumes are bind-mounted: host inode == in-container inode.
+static int check_relative_path(int dirfd, const char *rel_path)
+{
+    if (dirfd != AT_FDCWD) return 0;
+    if (filter_dir_inode == 0 && filter_dir_inode2 == 0) return 0;
+
+    // Read CWD inode and device via task->fs->pwd.dentry->d_inode.
+    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+    struct fs_struct *fs_ptr;
+    bpf_probe_read_kernel(&fs_ptr, sizeof(fs_ptr), &task->fs);
+    struct path pwd;
+    bpf_probe_read_kernel(&pwd, sizeof(pwd), &fs_ptr->pwd);
+    struct inode *inode_ptr;
+    bpf_probe_read_kernel(&inode_ptr, sizeof(inode_ptr), &pwd.dentry->d_inode);
+    u64 ino = 0;
+    bpf_probe_read_kernel(&ino, sizeof(ino), &inode_ptr->i_ino);
+    struct super_block *sb_ptr = NULL;
+    bpf_probe_read_kernel(&sb_ptr, sizeof(sb_ptr), &inode_ptr->i_sb);
+    u32 dev = 0;
+    bpf_probe_read_kernel(&dev, sizeof(dev), &sb_ptr->s_dev);
+
+    char rel_buf[62] = {};
+    bpf_probe_read(rel_buf, sizeof(rel_buf) - 1, rel_path);
+
+    // Check 1: parent inode + basename prefix.
+    if (filter_dir_inode != 0 && ino == filter_dir_inode &&
+        (filter_dir_dev == 0 || dev == filter_dir_dev) &&
+        check_basename_prefix(rel_buf)) return 1;
+
+    // Check 2: exact directory inode — match any file that does not escape via "..".
+    if (filter_dir_inode2 != 0 && ino == filter_dir_inode2 &&
+        (filter_dir_dev2 == 0 || dev == filter_dir_dev2) &&
+        !(rel_buf[0] == '.' && rel_buf[1] == '.')) return 1;
+
+    return 0;
+}
+
+// do_filter_by_process returns 1 if the current process should be excluded (filtered out),
+// 0 if it should be disrupted.
+static __always_inline int do_filter_by_process(u32 pid, u32 ppid)
+{
+    if (use_cgroup_filter) {
+        return bpf_current_task_under_cgroup(&target_cgroup, 0) != 1 ? 1 : 0;
+    } else if (target_pid != 0) {
+        return (ppid != target_pid && pid != target_pid) ? 1 : 0;
+    }
+    return 0;
+}
+
+// do_probability_check returns 1 if the event should be skipped due to probability sampling.
+static __always_inline int do_probability_check()
+{
+    if (probability == 100) return 0;
+    if (hits != 0) {
+        unsigned long long scaled = disruptedHits * 100;
+        if ((scaled / hits) > probability) {
+            hits++;
+            return 1;
+        }
+    }
+    hits++;
+    disruptedHits++;
+    return 0;
+}
+
+// Kprobe on do_sys_openat2 (not the arch-specific sys_openat wrapper) because
+// only do_sys_openat2 is tagged ALLOW_ERROR_INJECTION in fs/open.c, which is
+// required for bpf_override_return to actually modify the return value.
+SEC("kprobe/do_sys_openat2")
 int injection_disk_failure(struct pt_regs *ctx)
 {
     struct data_t data = {};
 
-    // Get data of the current process
     u32 ppid = 0;
     u32 pid = bpf_get_current_pid_tgid();
     if (pid == exclude_pid) {
@@ -45,62 +170,44 @@ int injection_disk_failure(struct pt_regs *ctx)
     u32 gid = bpf_get_current_uid_gid();
 
     if (pid != 1) {
-        // Get parent pid
+        // Get parent pid (needed for cgroupv1 PID filter and exclude_pid check below)
         struct task_struct *task;
         struct task_struct *real_parent;
         task = (struct task_struct *)bpf_get_current_task();
         bpf_probe_read(&real_parent, sizeof(real_parent), &task->real_parent);
         bpf_probe_read(&ppid, sizeof(ppid), &real_parent->tgid);
-
-        // Allow only children and parent process.
-        if (target_pid != 0 && ppid != target_pid && pid != target_pid) {
-          return 0;
-        }
     }
 
+    if (do_filter_by_process(pid, ppid)) return 0;
+
     if (ppid == exclude_pid || tid == exclude_pid) {
         return 0;
     }
 
-// Exclude this part of code if the following variables are not defined.
-// It allows the go program to compile without error.
-#if defined(__TARGET_ARCH_arm64) || defined(__TARGET_ARCH_x86)
-    // Allow only file with the desired prefix.
-    struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx);
-    char *path = (char *)PT_REGS_PARM2_CORE(real_regs);
+    // do_sys_openat2(int dfd, const char __user *filename, struct open_how *how)
+    int dirfd = (int)PT_REGS_PARM1_CORE(ctx);
+    char *path = (char *)PT_REGS_PARM2_CORE(ctx);
     char cmp_path_name[62];
     bpf_probe_read(&cmp_path_name, sizeof(cmp_path_name), path);
-    char cmp_expected_path[62];
-    bpf_probe_read(cmp_expected_path, sizeof(cmp_expected_path),  (const void *)filter_path);
-    int filter_len = (int) (sizeof(filter_path) / sizeof(filter_path[0])) - 1;
-   
-    if (filter_len > 62) {
-        return 0;
-    }
-
-    for (int i = 0; i < filter_len; ++i) {
-      if (cmp_expected_path[i] == NULL)
-        break;
-      if (cmp_path_name[i] != cmp_expected_path[i])
-        return 0;
-    }
-#endif
 
-    if (probability != 100) {
-        if (hits != 0) {
-            unsigned long long scaled_disruptedHits = disruptedHits * 100;
-            unsigned long long scaled_hits = hits;
-
-            if ((scaled_disruptedHits / scaled_hits) > probability) {
-                hits++;
-                return 0;
-            }
+    if (cmp_path_name[0] == '/') {
+        // Absolute path: compare raw path argument against filter prefix directly.
+        char cmp_expected_path[62];
+        bpf_probe_read(cmp_expected_path, sizeof(cmp_expected_path), (const void *)filter_path);
+        int filter_len = (int)(sizeof(filter_path) / sizeof(filter_path[0])) - 1;
+        if (filter_len > 62) return 0;
+        for (int i = 0; i < filter_len; ++i) {
+            if (cmp_expected_path[i] == NULL) break;
+            if (cmp_path_name[i] != cmp_expected_path[i]) return 0;
         }
-
-        hits++;
-        disruptedHits++;
+    } else {
+        // Relative path: compare CWD inode against the filter. dirfd is passed so
+        // that opens with a non-AT_FDCWD dirfd are skipped (CWD is irrelevant there).
+        if (!check_relative_path(dirfd, path)) return 0;
     }
 
+    if (do_probability_check()) return 0;
+
     data.ppid = ppid;
     data.pid = pid;
     data.tid = tid;
@@ -117,4 +224,3 @@ int injection_disk_failure(struct pt_regs *ctx)
 
     return 0;
 }
-