[lttng-dev] LTTng Support for Mount Namespace

[Michael Jeanson]

On 2021-01-06 10 h 50, Mohammad Kavousi via lttng-dev wrote:
> Dear LTTng developers,
> 
> Our group at Northwestern has been using your amazing tool for the 
> purpose of provenance tracking on Linux-based systems and we are very 
> fond of the performance and accuracy it provides.
> 
> Our analysis shows that mnt_ns context is supported in the 2.12 version 
> of LTTng. However, though, adding the mnt_ns context using 
> the add-context command produces this error:
> 
> Error: mnt_ns: Context unavailable on this kernel
> 
> We have tried adding the context to the more recent version of the 
> kernel (5.8) on Ubuntu 20.04, as well as older kernel versions such as 
> the 4.4 version on Ubuntu 16.04. However, we always receive the above 
> error trying to add the mnt_ns context.
> 
> We could not find which kernel versions are supported for adding this 
> context, or whether they need to be built with special flags. I would 
> appreciate your guidance on resolving this issue.
> 
> 
> Thank you,
> Mohammad

Hi,

Unfortunately the definition of 'struct mnt_namespace' is in a private 
kernel header (fs/mount.h) unlike other namespaces.  Private headers are 
not included in the kernel headers package of distributions like Ubuntu, 
to build support for this namespace context in lttng-modules you need to 
use the full kernel source tree.

Or as a quick hack, you could copy 'fs/mount.h' from the original source 
tree to your kernel headers package build directory, which on Ubuntu is 
usually '/lib/modules/$(uname -r)/build'.

Hoe this helps,

Michael