From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754821AbdKAPVp (ORCPT ); Wed, 1 Nov 2017 11:21:45 -0400 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:57942 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754714AbdKAPVg (ORCPT ); Wed, 1 Nov 2017 11:21:36 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , Roman Gushchin Subject: [PATCH net-next 2/4] bpf, cgroup: implement eBPF-based device controller for cgroup v2 Date: Wed, 1 Nov 2017 11:20:35 -0400 Message-ID: <20171101152037.3288-3-guro@fb.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171101152037.3288-1-guro@fb.com> References: <20171101152037.3288-1-guro@fb.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::3:5dcb] X-ClientProxiedBy: CO2PR04CA0099.namprd04.prod.outlook.com (2603:10b6:104:6::25) To SN2PR15MB1086.namprd15.prod.outlook.com (2603:10b6:804:22::8) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: a285f6bb-5685-4e64-7028-08d5213c2858 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(2017052603199);SRVR:SN2PR15MB1086; X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;3:/AJo84JKWvdfR+6nHRMgn+Y7xK7KD5qlZ4nfUt/oOOYegamQxpSR/NZ37sN4PcsDxQ058o4mPdEyLeOKAKC3+VVo0Q64HBfdWCQ5WtoWDcpgST5IpdGaXnT/qgJqWWkhA2bpsueSOorEbHMe37n5KDpNy1GR6A8lOwQSf1numLj4elqGl5kNLPTv+oYCQZFLuTMRB9lF4eVCv8pGCgvjYY2O3iLMC1PmIRwUzAZHqrt4vpqof0tr0GbYaVKB5Tni;25:JHhIGBVJ8nPJo1s4JpO9HcjumG2V3+DJrV1AkyXTTtEhvq06EaaWKDSQMSEv7MZb93/FeloDmy7GjLCPjwKEDcTe39o5Ntq6uhRJuLLApg33Y4eurzxjiyw78ncAmCzuaqzhzq8XOAqEefI57sUdUmtAA3MZ0z5YBDXgt0vGepupRoYkP0Z9mfMXxyGGH3Y3o4VywaRFdwwGv+pJRdMDyIPP/9ME+zl/zOCPx+008cCCHMTHzY2XUYgYRsb+PACGYW1vCaf6157hQdxB81gRIe5mNjPQ+j1/H4bY3v1O+is2mAzzIecIsuf3mInoodb/i6ylLwHRpwZT+pzjvldmYA==;31:6v7Mn0DNBOj5uGIjEobzb9Xh0vxl01COCsVO+MgT/BYCIoqkJbk/kxKEic+2PENyfjYw0Oc8DvmVD456RRHCyHcD5owWEXKWXdj39VlSGqjMmSLKfLn2JyHuyT6o0JeFiTdpCwTWQ1Y+9BWFQplq+oO7z2S4KVveNcs5q8Yg5JgKFc9mCbXugI6uc37hPCrQDkJCYTNW6H+l5hUAGAfrZ3uqiwqKd21JEf4JGYExgDI= X-MS-TrafficTypeDiagnostic: SN2PR15MB1086: X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:s/g3K8brQNTQEm0tRC95v+g0UXRzS5N+amToqR6JcuGw0+4/OhJLhU//Sv5H4k6Y11PbOCgdniGJy+huzIOaD1hDZsHvgAe7Zwq6BfYOb7tXbSKqZB6jL2ZqPQ0/ojDGzlZVyI3RnIflCkx6bOVFUZ2/gwvYrC03s1ub9OKHrxFsQMHMgbxMjL6Tgt664AqAQXE611O3wnmWjb+pt2PZEj48wFQww2IDyEZxcsbwCLyKrgqcbKJHuYcmIi9mMzZVL1SEPIwPx3lWOqnlyszU2hsaObGL0C7icm6y3ylFqbKsqCr1t0zvt4UElUWi+U+rLnW2g4VaULgIuNa8v35li0eB/pJm7vRYp3zCk8+x97WGtFs3EAjPEWHiFUU6mocOYyFAC885T2JKuFjIzcIj6oSwl50lUG0vTVE2akTdSNhT6Sf2eVju8UmbTDWvda4RdCzVgqQIpos+uMws0eo2HSS4rqJ2YLKNhRUjECj1hMlYEuV29rp8pmQLJhAMd00Q;4:w3xfteuzLymgFPeIrrA6/Iq862H8QL008LFMLKYCsT4Cl/NaWtH5lRw4YaicrbJwiIkrWsm+795/IBJAeuqAqTdUlgbz7fvSQBBhdFiIJOm3sscbTw02TzH0CEXWpMgMk36WC8L5KGQtAkMd89LH0I449HUByODnlP+kd2VvMoXVUVL/Rnw+Afn5OW9nFt0a/mHjhk0XwQCg0fl+gK7K/MsSM54ACRbU38WUWBXBXW+VhMQ3/QLuHfponfzK71gPJ2Ssy9Ai6AFkRWuLbi5w00RhG/YMyy3m9GUeR/puThFsUBy9P155JoAsnfAFfBeT X-Exchange-Antispam-Report-Test: UriScan:(67672495146484); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(8121501046)(5005006)(3002001)(93006095)(93001095)(3231020)(10201501046)(100000703101)(100105400095)(6041248)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123562025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN2PR15MB1086;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN2PR15MB1086; X-Forefront-PRVS: 0478C23FE0 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(376002)(346002)(199003)(189002)(6116002)(189998001)(25786009)(6506006)(54906003)(36756003)(6666003)(86362001)(8676002)(47776003)(2950100002)(68736007)(2361001)(5660300001)(1076002)(2351001)(106356001)(33646002)(105586002)(101416001)(6916009)(8936002)(50466002)(478600001)(316002)(6512007)(48376002)(5003940100001)(53936002)(81166006)(2906002)(305945005)(50986999)(97736004)(7736002)(76176999)(5890100001)(53416004)(69596002)(6486002)(81156014)(4326008)(50226002)(16586007)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN2PR15MB1086;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN2PR15MB1086;23:qbP2RBEW7MwQ/f/DLOLPplqBlyatgT7fzcG+ga+0d?= =?us-ascii?Q?EHPXdbmsS7GOtxdcBup4lfiHCDl5bhbjdUX4GD/px7ZMsvC3JhgWd5LgmZK8?= =?us-ascii?Q?MIKy+IyjhDtZxDwBpT6UQP92up58T5oCDUWebfg0sqBa5DMuz/b2ppoimsW7?= =?us-ascii?Q?CfoxzPMf74AmiePZsooEYtCyA1Nx4ISgndAV6V79SEKIy4OkaGu9C3B3TYho?= =?us-ascii?Q?BxHiOadgRix1WdLCGAQZuQ/30q5lQBypZ5d8wI8V7mQdZsqlZakDQ5PsAEyW?= =?us-ascii?Q?pLggg4hJuE51OzktAM9g3w9qySho2e69ozWuiwvM6xbsdssnK+6fhp3KhfJm?= =?us-ascii?Q?fIRyJ2VAvWpmJzKD1mSnPeeUSCFmDXn8TRDCtt6LpgJST2mgYRFXywxxmxmJ?= =?us-ascii?Q?7adivoHGHHC7qe0aXSr8kJiudwFjQ3AYA+xFWlTJF3Ijf8wy+l7VL42LQ48D?= =?us-ascii?Q?TAhhTqi/p9ImS/MRTnCSX7E1svUdF0InKp5P8Z4GOVsOpBge+2HSv/cCgk7x?= =?us-ascii?Q?JoMBRhCDRkB3wcKewtkb5h1mWvS2fTw5kj0zNg3rGD+crskphePmrOABiUcl?= =?us-ascii?Q?6Hru1iv8aW/O6q5rKvP2LxgaCHOfHlGD1mH1R2vOqpRc5zPHhpUFsnMNJmgX?= =?us-ascii?Q?/mlwI771sW7fd848xKSqkjQV2xgptTj9v/NtvaYbjVGyiwOLhaiZWjkJuoo7?= =?us-ascii?Q?fJf5X2A3ERWzS3u1cStbd2RXDx/nrIe3TD4GyD9heBQzHfQTcd3O1JwknG+R?= =?us-ascii?Q?tiTsjmn896gGq/sjJb3uW19PLeLClenm0/sbEEWGGwf0jyjRJB5cegTcAnPx?= =?us-ascii?Q?aeKpwt83hGQTO4n+Gbj+laBgAxDmDPbVG1r+ZbeVHgRhaiCBSAiN6n5TjQh8?= =?us-ascii?Q?onwjr7eSu04kEBbrQBGHFLyMX+DoMca3Tp2THBC0xgS4NdS4Iz885XK0I1h6?= =?us-ascii?Q?Tn3HbFKlxsDwkC/oEPYcAJRKCXosH3MGUuUXTQUJqas6C7l6Muog6x/j+TMz?= =?us-ascii?Q?7MW8p3ocRDfDfIgNhENk4ETJw0l6HIsshkqJbzeQqVLU5Gop7HflTdxU6rea?= =?us-ascii?Q?mecgwLrcHQllb+ohpQ+3HL1OMn1gOWtGHjP7IUpHFyS1dYZy/o+mx5uKUSzr?= =?us-ascii?Q?ubgX1dztQFeG1wovncB6V+Zq07PxsAjKyFR6UzWC8jRtJL67qtpFw=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;6:piTTaXLqUiEViOKbVX2CQK9cRHQk+ISm54/dURqfi+av/tYKEfUEXCiZxBuZ0yo1GvDDhoK1XaWEoFwTPLcM8rp22i66c12CRAG38PfHUzlJ/As0utIwiczmbGBzCIGFfWozz3n/XE3CBZL37MALSI7k4dBBc3JlCMw/X33U9uRbqUdyFEflpztGvfNEn1ajVojyqkVO6NxCzvMM3SqGJ0EbT8AKlrd25uJ4tccJ0hpQqW+vKKYR8YtYaVhltN1FnDnKemnJv2Qcqtbfv5fHFwBhPGiT+VXdlatljclEiNV/LBCwsLXWsZc16o8YJT+cMxhHFW7EA3sDiKYi2KFvWCasjKMBDWW4H1NtJpYPUjs=;5:6dBO5WpAdhPkCdQ6y1U9+1eJSs4z7WxKvu55kohoYqYGjWPvWm+hXYG4OFI8E6gnkfbi5oLzD/hlRrhGjLQmQY1KKc76Bc69ncWQHKhLh0cmE7Rs7Q2awfGFvc1Mr2oIBmdqB6w0gCETUSH5K6OQXfBYK8sEirrznEg5J3LA9BE=;24:6KJ+Hy9wW02GI9MnrAzTUApCrAjyT1f2lPZS5JxMXb00VYQyB9eMvhoyQr9W8P3aDEdECU9zE37F5wzUDBRMf3HIgPU36lxMLr/cSvQNOdU=;7:DgpLE7jkf/xJnr42g24E2F8MgzT6QjBQa7H8z6O0c06olPinIxF6diccaZhSbham6Cg+qHSs7L3SBdHpsdB2k8NOTqmtnxE4RgHzFzSYRbBsgUwmEwPu2KsFCqMoV+aiJ9VQffyaYxGnUcdEwtO+AwDTaO1Ru0Ui3jgIS65eFM0cJT2Y6myU9BqljohGV1/n/DrZmgRjsbKl1nJzpsjaPVnxGTgQBSu8GkeGqXBceYnIdG+jqnw2hfUZMMrz83ZI SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN2PR15MB1086;20:Q66WLoeLRG+Xisq9NzrgdY4KsD5Eqs3+tX+blkEpH18df8H8wHOXyjZOqD3Zs5DvqH7nD964QsLMxgb5gslU4pjC8TC1TMttQsrwW1GlOiW0kQocCWfOQva7xqEXwc+wgvHb2RveUQkLD5G1LRXSqa9Zw4MaXxfeb34RDF/nS8E= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2017 15:20:58.8775 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a285f6bb-5685-4e64-7028-08d5213c2858 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN2PR15MB1086 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-01_03:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Cgroup v2 lacks the device controller, provided by cgroup v1. This patch adds a new eBPF program type, which in combination of previously added ability to attach multiple eBPF programs to a cgroup, will provide a similar functionality, but with some additional flexibility. This patch introduces a BPF_PROG_TYPE_CGROUP_DEVICE program type. A program takes major and minor device numbers, device type (block/character) and access type (mknod/read/write) as parameters and returns an integer which defines if the operation should be allowed or terminated with -EPERM. Signed-off-by: Roman Gushchin Acked-by: Alexei Starovoitov Acked-by: Tejun Heo Cc: Daniel Borkmann --- include/linux/bpf-cgroup.h | 15 ++++++++++ include/linux/bpf_types.h | 3 ++ include/linux/device_cgroup.h | 8 ++++- include/uapi/linux/bpf.h | 15 ++++++++++ kernel/bpf/cgroup.c | 67 ++++++++++++++++++++++++++++++++++++++++++ kernel/bpf/syscall.c | 7 +++++ kernel/bpf/verifier.c | 1 + tools/include/uapi/linux/bpf.h | 15 ++++++++++ 8 files changed, 130 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 359b6f5d3d90..d77cefb3fe99 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -66,6 +66,9 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, struct bpf_sock_ops_kern *sock_ops, enum bpf_attach_type type); +int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, + short access, enum bpf_attach_type type); + /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */ #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \ ({ \ @@ -111,6 +114,17 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, } \ __ret; \ }) + +#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \ +({ \ + int __ret = 0; \ + if (cgroup_bpf_enabled) \ + __ret = __cgroup_bpf_check_dev_permission(type, major, minor, \ + access, \ + BPF_CGROUP_DEVICE); \ + \ + __ret; \ +}) #else struct cgroup_bpf {}; @@ -121,6 +135,7 @@ static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; } #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; }) #endif /* CONFIG_CGROUP_BPF */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index 36418ad43245..963a97ee4b7c 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -18,6 +18,9 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_KPROBE, kprobe) BPF_PROG_TYPE(BPF_PROG_TYPE_TRACEPOINT, tracepoint) BPF_PROG_TYPE(BPF_PROG_TYPE_PERF_EVENT, perf_event) #endif +#ifdef CONFIG_CGROUP_BPF +BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_DEVICE, cg_dev) +#endif BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index 25f1dc7673db..9a4f849f73cb 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,4 +1,5 @@ #include +#include #define ACC_MKNOD 1 #define ACC_READ 2 @@ -18,10 +19,15 @@ static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, { return 0; } #endif -#ifdef CONFIG_CGROUP_DEVICE +#if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) static inline int devcgroup_check_permission(short type, u32 major, u32 minor, short access) { + int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access); + + if (rc) + return -EPERM; + return __devcgroup_check_permission(type, major, minor, access); } diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 0b7b54d898bd..4deb3c9acbb2 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -131,6 +131,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, + BPF_PROG_TYPE_CGROUP_DEVICE, }; enum bpf_attach_type { @@ -140,6 +141,7 @@ enum bpf_attach_type { BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, + BPF_CGROUP_DEVICE, __MAX_BPF_ATTACH_TYPE }; @@ -984,4 +986,17 @@ struct bpf_perf_event_value { __u64 running; }; +#define DEV_BPF_ACC_MKNOD (1ULL << 0) +#define DEV_BPF_ACC_READ (1ULL << 1) +#define DEV_BPF_ACC_WRITE (1ULL << 2) + +#define DEV_BPF_DEV_BLOCK (1ULL << 0) +#define DEV_BPF_DEV_CHAR (1ULL << 1) + +struct bpf_cgroup_dev_ctx { + __u32 access_type; /* (access << 16) | type */ + __u32 major; + __u32 minor; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 3db5a17fcfe8..b789ab78d28f 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -522,3 +522,70 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, return ret == 1 ? 0 : -EPERM; } EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_ops); + +int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, + short access, enum bpf_attach_type type) +{ + struct cgroup *cgrp; + struct bpf_cgroup_dev_ctx ctx = { + .access_type = (access << 16) | dev_type, + .major = major, + .minor = minor, + }; + int allow = 1; + + rcu_read_lock(); + cgrp = task_dfl_cgroup(current); + allow = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], &ctx, + BPF_PROG_RUN); + rcu_read_unlock(); + + return !allow; +} +EXPORT_SYMBOL(__cgroup_bpf_check_dev_permission); + +static const struct bpf_func_proto * +cgroup_dev_func_proto(enum bpf_func_id func_id) +{ + switch (func_id) { + case BPF_FUNC_map_lookup_elem: + return &bpf_map_lookup_elem_proto; + case BPF_FUNC_map_update_elem: + return &bpf_map_update_elem_proto; + case BPF_FUNC_map_delete_elem: + return &bpf_map_delete_elem_proto; + case BPF_FUNC_get_current_uid_gid: + return &bpf_get_current_uid_gid_proto; + case BPF_FUNC_trace_printk: + if (capable(CAP_SYS_ADMIN)) + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +static bool cgroup_dev_is_valid_access(int off, int size, + enum bpf_access_type type, + struct bpf_insn_access_aux *info) +{ + if (type == BPF_WRITE) + return false; + + if (off < 0 || off + size > sizeof(struct bpf_cgroup_dev_ctx)) + return false; + /* The verifier guarantees that size > 0. */ + if (off % size != 0) + return false; + if (size != sizeof(__u32)) + return false; + + return true; +} + +const struct bpf_prog_ops cg_dev_prog_ops = { +}; + +const struct bpf_verifier_ops cg_dev_verifier_ops = { + .get_func_proto = cgroup_dev_func_proto, + .is_valid_access = cgroup_dev_is_valid_access, +}; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 323be2473c4b..08f7b450828e 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1291,6 +1291,9 @@ static int bpf_prog_attach(const union bpf_attr *attr) case BPF_CGROUP_SOCK_OPS: ptype = BPF_PROG_TYPE_SOCK_OPS; break; + case BPF_CGROUP_DEVICE: + ptype = BPF_PROG_TYPE_CGROUP_DEVICE; + break; case BPF_SK_SKB_STREAM_PARSER: case BPF_SK_SKB_STREAM_VERDICT: return sockmap_get_from_fd(attr, true); @@ -1343,6 +1346,9 @@ static int bpf_prog_detach(const union bpf_attr *attr) case BPF_CGROUP_SOCK_OPS: ptype = BPF_PROG_TYPE_SOCK_OPS; break; + case BPF_CGROUP_DEVICE: + ptype = BPF_PROG_TYPE_CGROUP_DEVICE; + break; case BPF_SK_SKB_STREAM_PARSER: case BPF_SK_SKB_STREAM_VERDICT: return sockmap_get_from_fd(attr, false); @@ -1385,6 +1391,7 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_EGRESS: case BPF_CGROUP_INET_SOCK_CREATE: case BPF_CGROUP_SOCK_OPS: + case BPF_CGROUP_DEVICE: break; default: return -EINVAL; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 2bb6d6aa7085..811f0582a1cc 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3100,6 +3100,7 @@ static int check_return_code(struct bpf_verifier_env *env) case BPF_PROG_TYPE_CGROUP_SKB: case BPF_PROG_TYPE_CGROUP_SOCK: case BPF_PROG_TYPE_SOCK_OPS: + case BPF_PROG_TYPE_CGROUP_DEVICE: break; default: return 0; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 4a4b6e78c977..c0306ac49860 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -131,6 +131,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, + BPF_PROG_TYPE_CGROUP_DEVICE, }; enum bpf_attach_type { @@ -140,6 +141,7 @@ enum bpf_attach_type { BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, + BPF_CGROUP_DEVICE, __MAX_BPF_ATTACH_TYPE }; @@ -984,4 +986,17 @@ struct bpf_perf_event_value { __u64 running; }; +#define DEV_BPF_ACC_MKNOD (1ULL << 0) +#define DEV_BPF_ACC_READ (1ULL << 1) +#define DEV_BPF_ACC_WRITE (1ULL << 2) + +#define DEV_BPF_DEV_BLOCK (1ULL << 0) +#define DEV_BPF_DEV_CHAR (1ULL << 1) + +struct bpf_cgroup_dev_ctx { + __u32 access_type; /* (access << 16) | type */ + __u32 major; + __u32 minor; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ -- 2.13.6