Support the capturing of environment variables

cli_flags.go

@@ -26,6 +26,7 @@ const (
 	defaultProbabilisticInterval  = 1 * time.Minute
 	defaultArgSendErrorFrames     = false
 	defaultOffCPUThreshold        = 0
+	defaultEnvVarsValue           = ""
 
 	// This is the X in 2^(n + x) where n is the default hardcoded map size value
 	defaultArgMapScaleFactor = 0
@@ -67,6 +68,7 @@ var (
 		"Valid values are in the range [1..%d], and 0 to disable off-cpu profiling."+
 		"Default is %d.",
 		support.OffCPUThresholdMax, defaultOffCPUThreshold)
+	envVarsHelp = "Defines a comma seperated list of env vars that should be reported with the captured profiling samples"
 )
 
 // Package-scope variable, so that conditionally compiled other components can refer
@@ -123,6 +125,8 @@ func parseArgs() (*controller.Config, error) {
 	fs.UintVar(&args.OffCPUThreshold, "off-cpu-threshold",
 		defaultOffCPUThreshold, offCPUThresholdHelp)
 
+	fs.StringVar(&args.IncludeEnvVars, "env-vars", defaultEnvVarsValue, envVarsHelp)
+
 	fs.Usage = func() {
 		fs.PrintDefaults()
 	}

host/host.go

@@ -60,4 +60,5 @@ type Trace struct {
 	APMTraceID       libpf.APMTraceID
 	APMTransactionID libpf.APMTransactionID
 	CPU              int
+	EnvVars          map[string]string
 }

internal/controller/config.go

@@ -41,6 +41,8 @@ type Config struct {
 	Reporter reporter.Reporter
 
 	Fs *flag.FlagSet
+
+	IncludeEnvVars string
 }
 
 const (

internal/controller/controller.go

@@ -3,12 +3,14 @@ package controller // import "go.opentelemetry.io/ebpf-profiler/internal/control
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/tklauser/numcpus"
 
 	"go.opentelemetry.io/ebpf-profiler/host"
+	"go.opentelemetry.io/ebpf-profiler/libpf"
 	"go.opentelemetry.io/ebpf-profiler/metrics"
 	"go.opentelemetry.io/ebpf-profiler/reporter"
 	"go.opentelemetry.io/ebpf-profiler/times"
@@ -71,6 +73,14 @@ func (c *Controller) Start(ctx context.Context) error {
 		return fmt.Errorf("failed to start reporter: %w", err)
 	}
 
+	envVars := libpf.Set[string]{}
+	splittedEnvVars := strings.Split(c.config.IncludeEnvVars, ",")
+	for _, envVar := range splittedEnvVars {
+		if envVar != "" {
+			envVars[envVar] = libpf.Void{}
+		}
+	}
+
 	metrics.SetReporter(c.reporter)
 
 	// Load the eBPF code and map definitions
@@ -87,6 +97,7 @@ func (c *Controller) Start(ctx context.Context) error {
 		ProbabilisticInterval:  c.config.ProbabilisticInterval,
 		ProbabilisticThreshold: c.config.ProbabilisticThreshold,
 		OffCPUThreshold:        uint32(c.config.OffCPUThreshold),
+		IncludeEnvVars:         envVars,
 	})
 	if err != nil {
 		return fmt.Errorf("failed to load eBPF tracer: %w", err)

processmanager/manager.go

@@ -66,7 +66,7 @@ var (
 // implementation.
 func New(ctx context.Context, includeTracers types.IncludedTracers, monitorInterval time.Duration,
 	ebpf pmebpf.EbpfHandler, fileIDMapper FileIDMapper, symbolReporter reporter.SymbolReporter,
-	sdp nativeunwind.StackDeltaProvider, filterErrorFrames bool) (*ProcessManager, error) {
+	sdp nativeunwind.StackDeltaProvider, filterErrorFrames bool, includeEnvVars libpf.Set[string]) (*ProcessManager, error) {
 	if fileIDMapper == nil {
 		var err error
 		fileIDMapper, err = newFileIDMapper(lruFileIDCacheSize)
@@ -101,6 +101,7 @@ func New(ctx context.Context, includeTracers types.IncludedTracers, monitorInter
 		reporter:                 symbolReporter,
 		metricsAddSlice:          metrics.AddSlice,
 		filterErrorFrames:        filterErrorFrames,
+		includeEnvVars:           includeEnvVars,
 	}
 
 	collectInterpreterMetrics(ctx, pm, monitorInterval)

processmanager/processinfo.go

@@ -16,6 +16,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"strings"
 	"syscall"
 	"time"
 
@@ -88,11 +89,26 @@ func (pm *ProcessManager) updatePidInformation(pid libpf.PID, m *Mapping) (bool,
 		if name, err := os.ReadFile(fmt.Sprintf("/prod/%d/comm", pid)); err == nil {
 			processName = string(name)
 		}
+
+		envVarMap := make(map[string]string)
+		if envVars, err := os.ReadFile(fmt.Sprintf("/proc/%d/environ", pid)); err == nil {
+			splittedVars := strings.Split(string(envVars), "\000")
+			for _, envVar := range splittedVars {
+				keyValuePair := strings.SplitN(envVar, "=", 2)
+				_, envVarShouldBeCaptured := pm.includeEnvVars[keyValuePair[0]]
+
+				if envVarShouldBeCaptured {
+					envVarMap[keyValuePair[0]] = keyValuePair[1]
+				}
+			}
+		}
+
 		info = &processInfo{
 			name:             processName,
 			executable:       exePath,
 			mappings:         make(map[libpf.Address]*Mapping),
 			mappingsByFileID: make(map[host.FileID]map[libpf.Address]*Mapping),
+			envVariables:     envVarMap,
 			tsdInfo:          nil,
 		}
 		pm.pidToProcessInfo[pid] = info
@@ -730,3 +746,14 @@ func (pm *ProcessManager) ProcessedUntil(traceCaptureKTime times.KTime) {
 
 // Compile time check to make sure we satisfy the interface.
 var _ tracehandler.TraceProcessor = (*ProcessManager)(nil)
+
+func (pm *ProcessManager) EnvVarsForPID(pid libpf.PID) map[string]string {
+	var envVars map[string]string
+
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+	if procInfo, ok := pm.pidToProcessInfo[pid]; ok {
+		envVars = procInfo.envVariables
+	}
+	return envVars
+}

processmanager/types.go

@@ -96,6 +96,9 @@ type ProcessManager struct {
 
 	// filterErrorFrames determines whether error frames are dropped by `ConvertTrace`.
 	filterErrorFrames bool
+
+	// includeEnvVars holds a list of env vars that should be captured from processes
+	includeEnvVars libpf.Set[string]
 }
 
 // Mapping represents an executable memory mapping of a process.
@@ -148,6 +151,8 @@ type processInfo struct {
 	mappingsByFileID map[host.FileID]map[libpf.Address]*Mapping
 	// C-library Thread Specific Data information
 	tsdInfo *tpbase.TSDInfo
+	// process env vars from /proc/PID/environ
+	envVariables map[string]string
 }
 
 // addMapping adds a mapping to the internal indices.

reporter/base_reporter.go

@@ -145,6 +145,7 @@ func (b *baseReporter) ReportTraceEvent(trace *libpf.Trace, meta *samples.TraceE
 		MappingFileOffsets: trace.MappingFileOffsets,
 		Timestamps:         []uint64{uint64(meta.Timestamp)},
 		OffTimes:           []int64{meta.OffTime},
+		EnvVars:            meta.EnvVars,
 	}
 }
 

reporter/internal/pdata/generate.go

@@ -11,6 +11,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"go.opentelemetry.io/collector/pdata/pcommon"
 	"go.opentelemetry.io/collector/pdata/pprofile"
+	"go.opentelemetry.io/otel/attribute"
 	semconv "go.opentelemetry.io/otel/semconv/v1.4.0"
 
 	"go.opentelemetry.io/ebpf-profiler/libpf"
@@ -206,6 +207,10 @@ func (p *Pdata) setProfile(
 		attrMgr.AppendInt(sample.AttributeIndices(),
 			semconv.ProcessPIDKey, traceKey.Pid)
 
+		for key, value := range traceInfo.EnvVars {
+			attrMgr.AppendOptionalString(sample.AttributeIndices(), attribute.Key("env."+key), value)
+		}
+
 		if p.ExtraSampleAttrProd != nil {
 			extra := p.ExtraSampleAttrProd.ExtraSampleAttrs(attrMgr, traceKey.ExtraMeta)
 			sample.AttributeIndices().Append(extra...)

reporter/samples/samples.go

@@ -15,6 +15,7 @@ type TraceEventMeta struct {
 	CPU            int
 	Origin         libpf.Origin
 	OffTime        int64
+	EnvVars        map[string]string
 }
 
 // TraceEvents holds known information about a trace.
@@ -27,6 +28,7 @@ type TraceEvents struct {
 	MappingFileOffsets []uint64
 	Timestamps         []uint64 // in nanoseconds
 	OffTimes           []int64  // in nanoseconds
+	EnvVars            map[string]string
 }
 
 // TraceAndMetaKey is the deduplication key for samples. This **must always**
@@ -44,6 +46,7 @@ type TraceAndMetaKey struct {
 	ProcessName string
 	// Executable path is retrieved from /proc/PID/exe
 	ExecutablePath string
+
 	// ExtraMeta stores extra meta info that may have been produced by a
 	// `SampleAttrProducer` instance. May be nil.
 	ExtraMeta any

support/ebpf/errors.h

@@ -121,8 +121,7 @@ typedef enum ErrorCode {
   // Native: Unable to read the IRQ stack link
   ERR_NATIVE_CHASE_IRQ_STACK_LINK = 4010,
 
-  // Native: Unexpectedly encountered a kernel mode pointer while attempting to unwind user-mode
-  // stack
+  // Native: Unexpectedly encountered a kernel mode pointer while attempting to unwind user-mode stack
   ERR_NATIVE_UNEXPECTED_KERNEL_ADDRESS = 4011,
 
   // Native: Unable to locate the PID page mapping for the current instruction pointer

tracehandler/tracehandler.go

@@ -129,6 +129,7 @@ func (m *traceHandler) HandleTrace(bpfTrace *host.Trace) {
 		ExecutablePath: bpfTrace.ExecutablePath,
 		Origin:         bpfTrace.Origin,
 		OffTime:        bpfTrace.OffTime,
+		EnvVars:        bpfTrace.EnvVars,
 	}
 
 	if !m.reporter.SupportsReportTraceEvent() {

tracer/tracer.go

@@ -156,6 +156,8 @@ type Config struct {
 	ProbabilisticThreshold uint
 	// OffCPUThreshold is the user defined threshold for off-cpu profiling.
 	OffCPUThreshold uint32
+	// IncludeEnvVars holds a list of environment variables that should be captured and reported from processes
+	IncludeEnvVars libpf.Set[string]
 }
 
 // hookPoint specifies the group and name of the hooked point in the kernel.
@@ -296,7 +298,7 @@ func NewTracer(ctx context.Context, cfg *Config) (*Tracer, error) {
 
 	processManager, err := pm.New(ctx, cfg.IncludeTracers, cfg.Intervals.MonitorInterval(),
 		ebpfHandler, nil, cfg.Reporter, elfunwindinfo.NewStackDeltaProvider(),
-		cfg.FilterErrorFrames)
+		cfg.FilterErrorFrames, cfg.IncludeEnvVars)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create processManager: %v", err)
 	}
@@ -990,6 +992,7 @@ func (t *Tracer) loadBpfTrace(raw []byte, cpu int) *host.Trace {
 		OffTime:          int64(ptr.offtime),
 		KTime:            times.KTime(ptr.ktime),
 		CPU:              cpu,
+		EnvVars:          t.processManager.EnvVarsForPID(pid),
 	}
 
 	if trace.Origin != support.TraceOriginSampling && trace.Origin != support.TraceOriginOffCPU {