Help getting child process id

[K V V <krishnavivek.vitta@xxxxxxxxx>]

Hi experts,


I am looking for help in fetching the child process id created through
command: “unshare -p -f -m /bin/bash”. This command creates a new
process in the new pid and mount namespace. The newly created process
owns both the namespaces

I am able to fetch the newly created pid namespace id and mount
namespace id using the below calls.

BPF_CORE_READ(current_task_struct, nsproxy, pid_ns_for_children,
ns.inum) and BPF_CORE_READ(current_task_struct, nsproxy, mnt_ns,
ns.inum);

Can you help me to retrieve the pid of the newly created process from
the running process. Have used the below program to get the child pid.


                struct list_head *child_list;

                struct task_struct *child_process;

                pid_t child_pid = 0;

                child_list = BPF_CORE_READ(current_task_struct, children.next);

                if (child_list != NULL)

                {

                    child_pid = 121;

                }



                // Check if the list is empty

                if (child_list == &(current_task_struct->children))

                {

                    child_pid = 122;

                }

                else

                {

                    // Use BPF_CORE_READ to get the task_struct of the
last child

                    child_process = BPF_CORE_READ(child_list, sibling);

                    child_pid = BPF_CORE_READ(child_process, pid);

                    //child_pid = 123;

                }



I always get the child_pid as 122, though the child has been created
successfully using the above command.

Any pointers to fix/retrieve the first child of the process.




Thank you,

--Krishna Vivek