| Message ID | 20180927213730.1224816-1-yhs@fb.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next] bpf: permit CGROUP_DEVICE programs accessing helper bpf_get_current_cgroup_id() | expand |
On Thu, Sep 27, 2018 at 02:37:30PM -0700, Yonghong Song wrote: > Currently, helper bpf_get_current_cgroup_id() is not permitted > for CGROUP_DEVICE type of programs. If the helper is used > in such cases, the verifier will log the following error: > > 0: (bf) r6 = r1 > 1: (69) r7 = *(u16 *)(r6 +0) > 2: (85) call bpf_get_current_cgroup_id#80 > unknown func bpf_get_current_cgroup_id#80 > > The bpf_get_current_cgroup_id() is useful for CGROUP_DEVICE > type of programs in order to customize action based on cgroup id. > This patch added such a support. > > Cc: Roman Gushchin <guro@fb.com> > Signed-off-by: Yonghong Song <yhs@fb.com> Acked-by: Alexei Starovoitov <ast@kernel.org>
On Thu, Sep 27, 2018 at 02:37:30PM -0700, Yonghong Song wrote: > Currently, helper bpf_get_current_cgroup_id() is not permitted > for CGROUP_DEVICE type of programs. If the helper is used > in such cases, the verifier will log the following error: > > 0: (bf) r6 = r1 > 1: (69) r7 = *(u16 *)(r6 +0) > 2: (85) call bpf_get_current_cgroup_id#80 > unknown func bpf_get_current_cgroup_id#80 > > The bpf_get_current_cgroup_id() is useful for CGROUP_DEVICE > type of programs in order to customize action based on cgroup id. > This patch added such a support. > > Cc: Roman Gushchin <guro@fb.com> > Signed-off-by: Yonghong Song <yhs@fb.com> Acked-by: Roman Gushchin <guro@fb.com> Thanks, Yonghong!
On 09/28/2018 11:53 AM, Roman Gushchin wrote: > On Thu, Sep 27, 2018 at 02:37:30PM -0700, Yonghong Song wrote: >> Currently, helper bpf_get_current_cgroup_id() is not permitted >> for CGROUP_DEVICE type of programs. If the helper is used >> in such cases, the verifier will log the following error: >> >> 0: (bf) r6 = r1 >> 1: (69) r7 = *(u16 *)(r6 +0) >> 2: (85) call bpf_get_current_cgroup_id#80 >> unknown func bpf_get_current_cgroup_id#80 >> >> The bpf_get_current_cgroup_id() is useful for CGROUP_DEVICE >> type of programs in order to customize action based on cgroup id. >> This patch added such a support. >> >> Cc: Roman Gushchin <guro@fb.com> >> Signed-off-by: Yonghong Song <yhs@fb.com> > > Acked-by: Roman Gushchin <guro@fb.com> Applied to bpf-next, thanks!
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 065c3d9ff8eb..00f6ed2e4f9a 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -707,6 +707,8 @@ cgroup_dev_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_get_current_uid_gid_proto; case BPF_FUNC_get_local_storage: return &bpf_get_local_storage_proto; + case BPF_FUNC_get_current_cgroup_id: + return &bpf_get_current_cgroup_id_proto; case BPF_FUNC_trace_printk: if (capable(CAP_SYS_ADMIN)) return bpf_get_trace_printk_proto();
Currently, helper bpf_get_current_cgroup_id() is not permitted for CGROUP_DEVICE type of programs. If the helper is used in such cases, the verifier will log the following error: 0: (bf) r6 = r1 1: (69) r7 = *(u16 *)(r6 +0) 2: (85) call bpf_get_current_cgroup_id#80 unknown func bpf_get_current_cgroup_id#80 The bpf_get_current_cgroup_id() is useful for CGROUP_DEVICE type of programs in order to customize action based on cgroup id. This patch added such a support. Cc: Roman Gushchin <guro@fb.com> Signed-off-by: Yonghong Song <yhs@fb.com> --- kernel/bpf/cgroup.c | 2 ++ 1 file changed, 2 insertions(+)