From: David Ahern <dsahern@gmail.com>
To: netdev@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org,
tj@kernel.org, davem@davemloft.net
Cc: David Ahern <dsahern@gmail.com>
Subject: [PATCH net-next 1/8] bpf: Recursively apply cgroup sock filters
Date: Tue, 22 Aug 2017 17:20:14 -0700 [thread overview]
Message-ID: <1503447621-27997-2-git-send-email-dsahern@gmail.com> (raw)
In-Reply-To: <1503447621-27997-1-git-send-email-dsahern@gmail.com>
Recursively apply sock filters attached to a cgroup. For now, start
with the inner cgroup attached to the socket and work back to the
root. If desired the inverse can be done use an attach flag (start
with parent cgroup and go in).
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/linux/bpf-cgroup.h | 5 +++--
kernel/bpf/cgroup.c | 4 +---
kernel/cgroup/cgroup.c | 18 ++++++++++++++++++
3 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index d41d40ac3efd..d95e44ccd549 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -40,8 +40,9 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk,
struct sk_buff *skb,
enum bpf_attach_type type);
-int __cgroup_bpf_run_filter_sk(struct sock *sk,
+int __cgroup_bpf_run_filter_sk(struct cgroup *cgrp, struct sock *sk,
enum bpf_attach_type type);
+int cgroup_bpf_run_filter_sk(struct sock *sk, enum bpf_attach_type type);
int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
struct bpf_sock_ops_kern *sock_ops,
@@ -74,7 +75,7 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
({ \
int __ret = 0; \
if (cgroup_bpf_enabled && sk) { \
- __ret = __cgroup_bpf_run_filter_sk(sk, \
+ __ret = cgroup_bpf_run_filter_sk(sk, \
BPF_CGROUP_INET_SOCK_CREATE); \
} \
__ret; \
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 546113430049..0480610bda83 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -217,14 +217,12 @@ EXPORT_SYMBOL(__cgroup_bpf_run_filter_skb);
* This function will return %-EPERM if any if an attached program was found
* and if it returned != 1 during execution. In all other cases, 0 is returned.
*/
-int __cgroup_bpf_run_filter_sk(struct sock *sk,
+int __cgroup_bpf_run_filter_sk(struct cgroup *cgrp, struct sock *sk,
enum bpf_attach_type type)
{
- struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
struct bpf_prog *prog;
int ret = 0;
-
rcu_read_lock();
prog = rcu_dereference(cgrp->bpf.effective[type]);
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index df2e0f14a95d..7480cebab073 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5186,4 +5186,22 @@ int cgroup_bpf_update(struct cgroup *cgrp, struct bpf_prog *prog,
mutex_unlock(&cgroup_mutex);
return ret;
}
+
+int cgroup_bpf_run_filter_sk(struct sock *sk,
+ enum bpf_attach_type type)
+{
+ struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
+ int ret = 0;
+
+ while (cgrp) {
+ ret = __cgroup_bpf_run_filter_sk(cgrp, sk, type);
+ if (ret < 0)
+ break;
+
+ cgrp = cgroup_parent(cgrp);
+ }
+
+ return ret;
+}
+EXPORT_SYMBOL(cgroup_bpf_run_filter_sk);
#endif /* CONFIG_CGROUP_BPF */
--
2.1.4
next prev parent reply other threads:[~2017-08-23 0:20 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-23 0:20 [PATCH net-next 0/8] bpf: Add option to set mark and priority in cgroup sock programs David Ahern
2017-08-23 0:20 ` David Ahern [this message]
2017-08-23 1:40 ` [PATCH net-next 1/8] bpf: Recursively apply cgroup sock filters Alexei Starovoitov
2017-08-23 16:33 ` David Ahern
2017-08-23 0:20 ` [PATCH net-next 2/8] bpf: Add mark and priority to sock options that can be set David Ahern
2017-08-23 1:41 ` Alexei Starovoitov
2017-08-23 0:20 ` [PATCH net-next 3/8] bpf: Allow cgroup sock filters to use get_current_uid_gid helper David Ahern
2017-08-23 1:49 ` Alexei Starovoitov
2017-08-23 0:20 ` [PATCH net-next 4/8] bpf samples: Update sock test to allow setting mark and priority David Ahern
2017-08-23 0:20 ` [PATCH net-next 5/8] bpf/samples: Add detach option to test_cgrp2_sock David Ahern
2017-08-23 0:20 ` [PATCH net-next 6/8] samples/bpf: Add option to dump socket settings David Ahern
2017-08-23 0:20 ` [PATCH net-next 7/8] samples/bpf: Add test case for nested socket options David Ahern
2017-08-23 0:20 ` [PATCH net-next 8/8] samples/bpf: Update cgroup socket examples to use uid gid helper David Ahern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1503447621-27997-2-git-send-email-dsahern@gmail.com \
--to=dsahern@gmail.com \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).