ProgramInfo provides CreatedByUid

[zachcheu]

The CreatedByUid provides some helpful context for the source of the BPF program. Making it public in ProgramInfo

[lmb]

Which kernel version introduced this field? If it's after 4.9 this needs to be unexported and accessed via a getter instead, similar to Program.ID(). The reason is that users need to be able to tell if the information is present or not. For example, does CreatedByUid == 0 mean that root created it, or that the kernel didn't provide that information?

[zachcheu]

Looks like it was introduced in 4.15. I don't see how a getter would help determine whether the CreateByUid == 0 is because the root was created or because the kernel didn't populate this field. Is there a way to enforce that this function is called on kernel 4.15+?

[lmb]

Luckily it was introduced in the same commit as nr_map_ids, which we already have (feature probe) support for:

ebpf/info.go

Lines 129 to 139 in f591f6f

	if info.NrMapIds > 0 {
	pi.maps = make([]MapID, info.NrMapIds)
	info2.NrMapIds = info.NrMapIds
	info2.MapIds = sys.NewPointer(unsafe.Pointer(&pi.maps[0]))
	} else if haveProgramInfoMapIDs() == nil {
	// This program really has no associated maps.
	pi.maps = make([]MapID, 0)
	} else {
	// The kernel doesn't report associated maps.
	pi.maps = nil
	}

I suggest the following:

• Add MapInfo.createdByUID uint32 and MapInfo.haveCreatedByUID bool.
• Populate that from the place I linked above. I think it needs to happen from both the if and the else if branch.
• Add MapInfo.CreatedByUID() (uint32, bool) { return mi.createyByUID, mi.haveCreatedByUID }

Plus some tests would be great!

[zachcheu]

I'm confused about why CreatedByUID fields and functions should be added under MapInfo since CreatedByUID is Program Info specific.

If fields MapInfo.createdByUID and MapInfo.haveCreatedByUID are created then how should they be populated at

ebpf/info.go

Lines 45 to 53 in f591f6f

	return &MapInfo{
	MapType(info.Type),
	MapID(info.Id),
	info.KeySize,
	info.ValueSize,
	info.MaxEntries,
	uint32(info.MapFlags),
	unix.ByteSliceToString(info.Name[:]),
	}, nil

[lmb]

Sorry, I meant ProgramInfo. My bad!

[lmb]

Fixed up the tests to work on old kernels. Thanks for the PR!