BPF programs installed by libcontainer are not distinguished

[bobrik]

Description

A user might find a bpf program like this:

$ sudo bpftool prog show id 80908
80908: cgroup_device  tag 531db05b114e9af3 run_time_ns 840 run_cnt 1
    loaded_at 2024-01-24T23:51:47+0000  uid 0
    xlated 512B  jited 472B  memlock 4096B

And there is now easy way to tell why it's there. It's possible to check with cgroup tree:

$ sudo bpftool cgroup tree
CgroupPath
ID       AttachType      AttachFlags     Name
/sys/fs/cgroup/nomad.slice/7b910f31-96c0-f837-7703-d4aff621d807.image-router.scope
    81000    cgroup_device   multi

But that's expensive and not great overall as you need more guessing and iterating cgroups isn't exactly free.

It would be nice if the program was named.

Steps to reproduce the issue

1. Use libcontainer
2. Run bpftool prog show
3. Be bamboozled

Describe the results you received and expected

When I run bpftool prog show, I want it to be obvious what the program does.

One way to do this is to attach names to the programs. Unfortunately, without BTF the name is limited to 15 chars. Having libcontainer prefix already takes up 12, so there's not a whole lot of freedom if you keep it.

There are two programs:

• Replace check (short lived)
• Cgroup device filter (long lived)

My best suggestion is libcontainer_rc and libcontainer_df, respectively. These aren't great names, but they do point to libcontainer as the thing that spawned them.

With BTF one can have longer names in bpftool prog show output, but BTF requires newer kernels.

I'm happy to open a PR to add these names or to hear any other suggestions.

What version of runc are you using?

Doesn't matter.

Host OS information

Linux.

Host kernel information

No response