From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933144AbdKAPVO (ORCPT ); Wed, 1 Nov 2017 11:21:14 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:53338 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754625AbdKAPVM (ORCPT ); Wed, 1 Nov 2017 11:21:12 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , Roman Gushchin Subject: [PATCH net-next 0/4] eBPF-based device cgroup controller Date: Wed, 1 Nov 2017 11:20:33 -0400 Message-ID: <20171101152037.3288-1-guro@fb.com> X-Mailer: git-send-email 2.13.6 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::3:5dcb] X-ClientProxiedBy: CO2PR04CA0099.namprd04.prod.outlook.com (2603:10b6:104:6::25) To SN2PR15MB1086.namprd15.prod.outlook.com (2603:10b6:804:22::8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f39dd619-7ebe-484e-0d92-08d5213c2634 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(2017052603199);SRVR:SN2PR15MB1086; X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;3:KDsOdPi5ufL3jgxE8ZGluIf4rKxW2MFR1xFHkRN1IDjvEYDPw48TkbgXyPocX0DCLDoz7tzSBTKP7IoZlHexII+7u4B/5n4RTZDaffK+EOyO7bTmW72cJrDcdiU2I3peEItHfGGm4l8Ajwq/Ox6OvzhuWn1lSXlzUwdKDoI8vn5gCm9Ip2Gmj54XdxjJAsP/lFXeSvBZZ+WKCtkkmmDAeA+h/oovVZuhESwi5jCCZVy25/fjJM/s+05UcLj7dc3d;25:IcyK5VcqN/vPr71tS34LwivB69PFmA7ED6Eli5pSTVO/Y/mZ7CxWqu1PpOt14+sbHhXQnmQSnbKEmjgPBL4k5G4o5AA9bgCsyeGBYI/0sg6XwPDGe8wPUGVO14DJcj5PnCfURuCmi2TY4qs7J9Xab+h7VRBtR7hwo/Io97jyHmUyxujpop1/4d7+parkuuycZ6xnaIRJtmLGZ4noWK5UXAgvZZ1/cKdhiFx4c/F5jbCw60+NONxsBUbEFlsF6ui/P3Ia3MBt0f3DyXwGpny68885f1Re/PPRJJz6hHBuu92oCyYuk8Z2yBRi+DXiynkEg5iABxzI9Q3LUFAKKODHSA==;31:8XhWh4JjCxkXrnVSJZow69I5aCEV7mdINRJwwzUFtXs8hoKFTAbq1KzWm5Lrmd+r/ryaWdj8Gs7vbNVvISUCCpI/bzLBBm25j2NuFCyYF385c2DB6Jq+QZxvOLoPPJ0xg/+0tkh9OD9SzgcoSjRY8TRBBlFw1rAwDSSrM/LpTBNKtlBTCiHWyX0HfQd0qGzdLLdmRBg583YSj0zmPoboOGGZLEz4D22+crz1M/ihCCs= X-MS-TrafficTypeDiagnostic: SN2PR15MB1086: X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:/gumNwt1/dF7tiQKBg9j+KuqSeexg0ZATQYnpyIhUwt7e+McbRhuCxJw+6naOwEjqhVFTr/NU78A8bL/F5cAyO61Mjpgb1F2WUE3GW2PMadD4PDwn765hZXA1LHK2bAKglEDhBMnZlDn+hE8lRX8yqkSQBMnPepjjrL1VlUWNge26LsyscTc1cryzQhimnntZmGvbtwahjZFcADGwBuJ4PvSSd567WtgG9i0KZxaCTk5SFsGeQp5Jt+xtSbXvl3TpbY0KQge8RE6rMthEnxIIdbnvbkkdTyCnYRl12RBYUkDNa1zW9Gk7RN9xID78kudMdQwQri5W+gsP0afTRvq4Q0evLf2c2Hb45ocM3dmDwtqNOBZWFy6HCUbOauZewFuOXtXBfzelZb2gD2ixS+mIyo/T03/Ft1JsQi2K+4w1CWx2z4lGPsj86zkxxrIhBghjmVV+ZSMlj/mEstUmFsyKf/6Scz0nCPOolw2wxXO/e3SaaVK77klEjFBj7SPQKiU;4:69kTB7Ss9SDOVlO4pJfs5VSMdk9Hk1B1+tVhrvJvRKOIuY01sWuPWmo/dp/tT+mTw2nkeuzRKvYD2/VoN+VrqezVEkPXNx6Y/Rq8R1Q+JRy3pu6xfuoMEh4zn3uPHE5ntblkJDPvHhvBB5cJyWe04YdbYaM5xUYoLhQJRDet/ZUNzCXP/X3V4mU1nGeisAEvjyCaxqv9bo6C/aABe0uIB/i1TJFb/b44lSBTL3L5kuv4a16191bin9pZsPPyQONdFKedmdUU7LVg1PueB9dYGGiKdtPTCRna0g72ZECZhLLO1sQ85SGthssEDpgVBgLj X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(3231020)(10201501046)(100000703101)(100105400095)(6041248)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN2PR15MB1086;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN2PR15MB1086; X-Forefront-PRVS: 0478C23FE0 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(376002)(346002)(199003)(189002)(6116002)(189998001)(25786009)(6506006)(54906003)(36756003)(6666003)(86362001)(8676002)(47776003)(68736007)(2361001)(5660300001)(1076002)(2351001)(106356001)(33646002)(105586002)(101416001)(6916009)(8936002)(50466002)(478600001)(316002)(6512007)(48376002)(5003940100001)(53936002)(81166006)(2906002)(305945005)(50986999)(97736004)(7736002)(53416004)(69596002)(6486002)(81156014)(4326008)(50226002)(16586007)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN2PR15MB1086;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN2PR15MB1086;23:3NikBsQsKCRI7UvQ1Nk9Cn5ACiB0F6ONz01eASEMt?= =?us-ascii?Q?10f5kC4AcJiDXxxhBu0XLrsQYWcLX43hyCNmd0lm2L7pyL9ujVX21Yw6VoLd?= =?us-ascii?Q?w5Ke1WDkjlTnjDyUO3Honh1C/LLTUhYx5DM6xWkzPmYecD34eV/cACXl48Vj?= =?us-ascii?Q?vWB9L1DT5C0VWNclQxx6XvJvL5EJmYV5ikzHiNhTPIr/NR4hDRDnFPy6g51q?= =?us-ascii?Q?33SASbs6WuXQbnecseBFszlDJNCInacP5yroRO2Ap3zRBDCUymlXzvLeuPt4?= =?us-ascii?Q?WyZ0W5wLyxERHIo01N7WREySPWxtdX7HTRPpAMVpTPBZ87OZI1Jjky9WaTy+?= =?us-ascii?Q?Y0xzj6+ZHgGnfa+qvIT/6NR/TJ646UcjUjRUc6aZBSMiB3facpsz8OYWPzAq?= =?us-ascii?Q?xJpmMfGvEbIPKGrtmqEp/c7dKmo7U7VxD3QcNVe9IOijNSTuDi9QH3Jts3U6?= =?us-ascii?Q?FupoerqxpOcuuTdiDORvHzUoHiv+G0Fd18C3WTspPVdunGuRwIXMhK0Q0PfI?= =?us-ascii?Q?Lbx8kvr9Pa+rfDktBHzbfUSEWMHRGKLU9yOw4FprXLvwJIvOTgH6dHmn2tc2?= =?us-ascii?Q?vK4jB4gvIrB237PP+LIdk0dXp00EivN2zbHuZXpKIJNsTSx+uHjXZH0I6eK/?= =?us-ascii?Q?YAp2aaicdjP7fjeDlUpKC44+H2LVaO4cFF3uhh4mspqgmGZW/h+WXGDvsz9X?= =?us-ascii?Q?sBwioc3bHkKHBuIXiwvscaHSgcXutVfHIEYpjtZD6wmJvdKZUIpp4PiyoIUk?= =?us-ascii?Q?hULL7f0ilt2BB3rV0gfMU/pg9w8/LlBzeklcZ4DLgyoUEEYab1TSXxOkltka?= =?us-ascii?Q?Y1NwX9oVsiLt9/JlR5RpTVcyrFqK5m99dZWxsyfj6hZTbtgOheoSXlMJEGuv?= =?us-ascii?Q?GbR7jahldG4MWNbHFUHpamnNVmeRgpyu5+9EQ99odm/K5+QYZB2QM9cg92IM?= =?us-ascii?Q?EmHPSmV5qRRQgtJdZkhr8H6GYQ/YpHEyJOtYVye9RmwnzUB0BHvvfGi1isZs?= =?us-ascii?Q?2gSZ0HDA8JCNZo3v/GpZOY8qdJXC9W8xNakQOf4tyvDK00VLqRt2o8c3kuMU?= =?us-ascii?Q?kdspfvg4lNU0WGDgue2eXdpYOL0xY50fXFuZIC8K+LXDD33Uw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;6:Q3iJ5HyZO6abzFiOh3+MHovyPiMW1ur9CysafajejbtFaKoAre1GaKtYOYqssRkaJWO4flUwovWjvabcUsgNhix7bQla47nsF5NxXSQpawQpnuv//ivls043bLu0zQDzqvRl4V4bBlJ38re45Z5Z+6zABhl6UowFe+L+LQ3omvqB7XTEn/d+HY5G3BoTxBp2qjA4w5WoPDfEGT1vn2Fy4TbMg9qn67vRDPaJq/QMns4+0DQfdU43ykzNBWRZ1gyLO0H/gEm+E3h0/+JkSC29l01bt3rIhIZuZQj6HZ2WivXPH6oRkcTp0VAZ/3tJD/jkgtB53h6gJvj+tTZCWf4d9RiABiJpIJcJjSaqx0JV/cc=;5:/I8XOhA0eXTgNmyeZLqzU+wK0Hp5HYlroTxF6AgEBJjvMahosef9fo9fs+vnOYTg8bO+F0+A/03e62M8erYMJB+5APNqWW1MXAlvP9Rhyn+TzHzMVD7aPKlr9L+Y5Q8eBGlLJeh4MBEVEo7fA/sCdra3MOHIgyTLO5ftIOnc7EU=;24:MF6gNUJ+J0/F7aX40l/YpJKg9tcJ6DB47LEtMNjidLLsedSwWQfmCOv4V278GdciI45YKg1NevmGJgb2ElXKRC6VaB3MaLe1t9IG2HhhGMU=;7:Hm4+N5F9dgyxXE4ARSa3wsf4eB0qwQvf3Vb/PrJrMZfFxEz5NwKVA/gScEnKH3uNBhEoiAjb9eTg0htxTMvcI6PX0msJRI/uqLigVrPmDygMkqzysCalvrKpL/hXqNykZ0yOUu45+PmxSpFNO6EpiGQG04BrNaDuYw+ZFpMgk6f2Tr4ZZjgqwv8dF5S5gAOsSk/VlkZOq51Se+sCwjnh5uYrTvWVMJz+q6GzAITN62nBlw8W3wDrSx97ScxENX6M SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:EOs1cTg+1FTSr4lCkQHmIpd3ifS7h53UYxK192PaWK/JycfsHzz3jXdWmTYfLyoLiwfcsDbFrPrRW8iiDDcoB+TkVDDp5LXBn28q09uwSbb742FCXYHgKnSdngfEdxmk4nJbh+ybYedMg4WJxroZhdMy0F3g4Kr1+rXyeE2sEYY= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2017 15:20:55.3148 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f39dd619-7ebe-484e-0d92-08d5213c2634 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR15MB1086 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-01_03:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patchset introduces an eBPF-based device controller for cgroup v2. Patch (1) is a preparational work required to share some code with the existing device controller implementation. Patch (2) is the main patch, which introduces a new bpf prog type and all necessary infrastructure. Patch (3) moves cgroup_helpers.c/h to use them by patch (4). Patch (4) implements an example of eBPF program which controls access to device files and corresponding userspace test. Roman Gushchin (4): device_cgroup: prepare code for bpf-based device controller bpf, cgroup: implement eBPF-based device controller for cgroup v2 bpf: move cgroup_helpers from samples/bpf/ to tools/testing/selftesting/bpf/ selftests/bpf: add a test for device cgroup controller include/linux/bpf-cgroup.h | 15 ++++ include/linux/bpf_types.h | 3 + include/linux/device_cgroup.h | 67 +++++++++++++++- include/uapi/linux/bpf.h | 15 ++++ kernel/bpf/cgroup.c | 67 ++++++++++++++++ kernel/bpf/syscall.c | 7 ++ kernel/bpf/verifier.c | 1 + samples/bpf/Makefile | 5 +- security/device_cgroup.c | 47 +---------- tools/include/uapi/linux/bpf.h | 15 ++++ tools/testing/selftests/bpf/Makefile | 6 +- .../testing/selftests}/bpf/cgroup_helpers.c | 0 .../testing/selftests}/bpf/cgroup_helpers.h | 0 tools/testing/selftests/bpf/dev_cgroup.c | 60 ++++++++++++++ tools/testing/selftests/bpf/test_dev_cgroup.c | 93 ++++++++++++++++++++++ 15 files changed, 347 insertions(+), 54 deletions(-) rename {samples => tools/testing/selftests}/bpf/cgroup_helpers.c (100%) rename {samples => tools/testing/selftests}/bpf/cgroup_helpers.h (100%) create mode 100644 tools/testing/selftests/bpf/dev_cgroup.c create mode 100644 tools/testing/selftests/bpf/test_dev_cgroup.c -- 2.13.6