Get sk PID from netfilter target

Sargun Dhillon sargun at sargun.me
Mon Mar 21 13:30:21 EDT 2016


I'm attempting to set the mark of a packet based on the PID it was
originated from in the kernel. I came up with the following code as I
was trying to work through things, and I had setup the rule on the
OUTPUT chain:

static unsigned int

static unsigned int

pidmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
  struct file *filp;
  if (skb->sk == NULL || skb->sk->sk_socket == NULL) {
    skb->mark = 0;
    printk("Socket not local, not setting mark?\n");
    return XT_CONTINUE;
  }
  filp = skb->sk->sk_socket->file;
  if (filp == NULL)
  {
    printk("Filp null. :|\n");
    return XT_CONTINUE;
  }
  read_lock(&filp->f_owner.lock);
  const struct cred *cred = filp->f_cred;
  printk("Uid: %d\n", from_kuid_munged(&init_user_ns, cred->fsuid));
  struct task_struct *task;
  printk("Pid: %d\n", pid_nr(filp->f_owner.pid));
  task = pid_task(filp->f_owner.pid, filp->f_owner.pid_type);
  printk("Task: %x\n", task);
  read_unlock(&filp->f_owner.lock);
  return XT_CONTINUE;
}

Unfortunately, looking at the log, pid always is set to 0, and
pid_task always return null. Is there any way I can fetch the pid that
created the skb from a netfilter target?



More information about the Kernelnewbies mailing list