From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933777AbdKBO4P (ORCPT ); Thu, 2 Nov 2017 10:56:15 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:46560 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933718AbdKBOzl (ORCPT ); Thu, 2 Nov 2017 10:55:41 -0400 From: Roman Gushchin To: CC: Tejun Heo , Alexei Starovoitov , Daniel Borkmann , , , Roman Gushchin Subject: [PATCH v2 net-next 3/5] bpf, cgroup: implement eBPF-based device controller for cgroup v2 Date: Thu, 2 Nov 2017 10:54:38 -0400 Message-ID: <20171102145440.12986-4-guro@fb.com> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171102145440.12986-1-guro@fb.com> References: <20171102145440.12986-1-guro@fb.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [2620:10d:c091:200::a050] X-ClientProxiedBy: BN6PR20CA0057.namprd20.prod.outlook.com (2603:10b6:404:151::19) To CO1PR15MB1077.namprd15.prod.outlook.com (2a01:111:e400:7b66::7) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 137b4d89-f6f4-453c-0988-08d52201bef1 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603199);SRVR:CO1PR15MB1077; X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;3:Ctw+EZChkvRi+DWk7vHjPYg13RznvMkVPNnoUgfPDXnhAZoXbLTDBR6qefF5u7CkWYcl7Gw6cs/tGjqfqF2ecv36S94TJaf+dnAcbTCIfwJWVumgOJnWk057b8/uZpl4jQFYQlgUw8Drg2AIpRrK0nyvMUtme+KXRTaXlnT2j+1JpTsxNSv2MK4ctZoOqJrKykM9pa87SfLKw3K/0MGON9OvjEvUyzbA+tEvFFo8QN464IF8HmENc4fLtcIgRdiJ;25:nuXdOg1yEie3pBwwdEZn4Pt0+PZS85f1RbjmpMvUP0COcgtCoAfX1hLHma44jRRoVwvNZ3ZQKl7U9HPIK8sUCqag1KaTrD+YsWrb9knIQdSqqM2ztrFRTZiFyHgwf45ZarRGNqFsrrzdwS4tnUlY/mRWcIDcEcwBs2o9TtFEjs5RM7IoYUfBSFlho7dONyY4x6PCd6UN6c8Z+1983aK6fw56TjvOYEsGt6AakJq5KRTaO/JZJsODb0wsJSwfjH2Sjl1Kk0wKBoSSwhz4FsqhP399YtKthj6zFYoY8ZtA8/ciI2Z8rgkdeDZ63Czs2M+4NbX0f7+CMiGYwvH39FgI3A==;31:UrC303RuAXefdHcnH4kCIWSixfitXt3b8/kMwNIfaZ/pJnO4/DoP+qbh2WbLdCVzbvbbQUmrypKxNZ4M53RHj3HIvhB9eSa27+Dpn3GMH+EJajQoDiJMIxXUw2p2DFkukGKuu2/ic8iIBSsxod+jhvvzEde9w7T1cBBGcjqhM3lkDukC7DyQHkMPxrxtvPPq6vL1/x5uR0hDIOVk8fZI0UeT52RTnuRf7FPUfhuU+n8= X-MS-TrafficTypeDiagnostic: CO1PR15MB1077: X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;20:AHg4aAuAtO8vOSTyHA3817yO1Y2KOfvctpuPjtHuxSp5r6WvlUaRlQx4fI+vmsOWmVB1OTEcrnTy2xJ1IjXATen4drCHkaAbxCqx4/S4SctXF9nbgjqCWLkO9bBEqVza9Xwb2R68N3EKZwS/AWqwsANA6BUBXcsKHZKKZ329hgyP2Os4/5IBk+DBPH4/OKJtK3dFZnBbb+QmUGWAp2GiFImi/wdCjRwIsqYRsxoRS41eKabQC4DqJZt3rkZaWXq/jWBALRw4JB8K4tLwWXQKOuJK7ojj7f8cIpzdclvnqFschBvsQ6LtOzRA4HWcXiHtiIia6Vc13vHsHIGOZPDvqaB1oquAQe+s923wQsfwuSdkxLRJEuymAx00/5m7Nq6YQw/RdM3AfaXbG65EdWHcKTdroTXDA/pUVGtYgMxIB3JVdVMVn04m4PcaiATDO6HpNfwAH25VUbtHxbUal2VIaFHRmRjIbQf5csGWA67MrmVvJs+RtJosGYcTB1rTAuyi;4:nvHnwkdfUYqmZ3J6Ev5OXty4bz78WBKu1cIjRPCJ8C3AILA16766Rrgp6Ms1dlvhieZ/vGUmgsAaV1y7gFo4YQEIwZvE3QYaZv+0AojxpE0Ssp2gInvzwRz2o7bnAdw6KDFcoqaNr8Ob8nzkyaqkbtJDlY5fULkIELtNFT3fSXr6To7UcjJJag6Yg2YorXBBpmxdwvJJIoaoliQXEoTAqDX4+sbk/3v+CHzDWN+fbS4hiGLr661iURU3s2noiXelJFOwnEzXzxq5MNQHzw+NkMDMbc1AgjeS5wRG2ArnlRuXr3y2l8R6fxeYGpRaVktB X-Exchange-Antispam-Report-Test: UriScan:(67672495146484); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(11241501159)(6040450)(2401047)(5005006)(8121501046)(3231020)(93006095)(93001095)(3002001)(10201501046)(100000703101)(100105400095)(6041248)(20161123562025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(20161123555025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CO1PR15MB1077;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CO1PR15MB1077; X-Forefront-PRVS: 047999FF16 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(6009001)(346002)(376002)(199003)(189002)(81156014)(50466002)(189998001)(48376002)(76176999)(50986999)(25786009)(4326008)(2361001)(36756003)(7736002)(5660300001)(2351001)(1076002)(8676002)(101416001)(68736007)(97736004)(33646002)(2906002)(81166006)(6666003)(6116002)(105586002)(106356001)(316002)(5003940100001)(8936002)(478600001)(54906003)(53936002)(305945005)(16586007)(2950100002)(6916009)(5890100001)(6486002)(47776003)(53416004)(69596002)(86362001)(6506006)(50226002)(6512007)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:CO1PR15MB1077;H:castle.thefacebook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;CO1PR15MB1077;23:XLrLzSWCARWofpmHoDoJZV/2dws1KTRjZ4/1Y7Jj9?= =?us-ascii?Q?ha4/pzH/bwnDTLlOztCUD/6cVfLYY/Yfv927ibFKDf9KQwqZnP7/zIwLbH5z?= =?us-ascii?Q?Iszn70Fx/pmcCB4E04+MRZIePgTI9Pnd9oTXj7bo3+mdOjtLt0yQpzdc4EE8?= =?us-ascii?Q?js8ce6nVdZYaaexGy9HxqnmFqi9buxz11sdDcQeWKqlgMdzZLUKOQTvVJE0x?= =?us-ascii?Q?vKYwMw4lg/dELUVDQMv9PjWy7T4OWSBWsRV9sstiVBB1Z4NjtxggibMMRAzF?= =?us-ascii?Q?A1qR++VPEuaXyC8h3gcn/eEHw+t1DOD41KAQ7EOTzF2ryymVm3E9jdHh7W95?= =?us-ascii?Q?P8tp5HarMzYJf4VlnSsovdhMvrhCdiQenila8mUiDQjvfSNHIqhNxD/ABlVa?= =?us-ascii?Q?IUa7Rnp8+ACGRB8TC+ZShw89CSEkpgfQmfQ1L23N77JgH79m7aPoGR7NNCzv?= =?us-ascii?Q?Zy3OnVCfHQ//T/tH4m5RI0w9gw8Q1T6ON03CQHxyJBhcwLsw/Y/18SWyag2k?= =?us-ascii?Q?I7hy0nifhOWThc+nLpTdPnQxTripFR5pZ0BR+RW/Z8LVHtt03E2eVvgfLoCI?= =?us-ascii?Q?5m/kQD/FKYgNOit29HvgbB+vOqN+cDcxaZ5Cqw+U/Xb7wBIrSxaOOJM3rHJ8?= =?us-ascii?Q?4K9z1MtUZljzLEfiQ9Tyl9vwKNlOycFDgaTlivMNqnV/yYxwFHX1+1dOzmcU?= =?us-ascii?Q?mHPhT9vZZmc0OPHnD7SUYECfpeODuNmn50trYRYE6xWbC8MJ1fAmnnxbjpDW?= =?us-ascii?Q?hT8IGn5coG2ds/2hhMShGxKb3lEs5G1kahEfD6YUrN9uxP9J2wPqJJhHXg5M?= =?us-ascii?Q?Ampc3n84ZHn1KkYqDexVsOwS7G8JI4YHOWr632elOAvThRAwZbVQfqf7m0lP?= =?us-ascii?Q?CmRWthAy+hNCm3YzIwhLovTO3K/pQ2EseclQwu9YCGNwOxpHg2UoAivK1m3n?= =?us-ascii?Q?GAZ5MLtwC3TKJwpC2gBUdu9Qt6nVBLcjhsRNWc/tsyC6qlw7Ds4L8aNIO+0H?= =?us-ascii?Q?BBLT5/rH67lj1qH+qcTtdx1a9zWyeD7d4b7IrP79nli5TzxoXV4PivXhRGBl?= =?us-ascii?Q?bsmCB5EmyhvjmEVAZHI8pEImgaINJd0aWzAL81z1HOkdASurxRAnDRiIlQnj?= =?us-ascii?Q?KJObrTeRHLLG0FnrCF5WJc5VkIR0sKo7YGXoGPZmZkWG0BXOVElDg=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;6:xwsK7SHzv6XW4RowN5x/tZvZ4swZnaiGtw2q5pnl8jihhXrQx5lgGoKOFXzdK+a61kgrbjqNyrWvAJW4L865wFcHoc5tyrCWyDMDaealY5C7qTCakeJONSBvPgHtpe0iEZqftPw/DUXZsfQdFJCj1UJYbu4Rr8pd1jJHHX4HTgppxI6zh5AQ54JFOacv324j4duFk8BVINdm038VSBKBX2bpmBxrbDqhaFniiEX0t8vuzRKGr49kK0gLeBtt5w78+RLLvEHdIqYy/wL7N6xAZ0myU1udDhcYxep5lG/xRJugdSFPTWxiw5MzvVPY/7wmwGi9n/PiJl/uk6rqg8Iio86kKXmgdHEYWamPoCpW2tk=;5:A6Sg2SOpucxLAcZEYACeCBna/KagW/VkZ44t/XWJeqJ9K/bgypuBDCubRohR47gu3BV4f/QeJYSR8FA0Z2eK+Kder8ATIlsI4IDjsXfsPzJgBlk9p8N9wLJpjhuX4xXYAvnypm763SPJXJDvoYfUFo5RECuntreBGn6wCUWPX8Q=;24:iDwH3EZpwmcCzoMdJ21TlbwbpYfNa5Q9Ac/HRUcDfcnZZyQGVaizqDA9lRaJl6lOiaFuI/rA9j1PW/FwW1/t7iLnG1sLx7q8xcL1Hg5sSgk=;7:AVeHjy1y/1PHQdzzpEebNQ06mqtggrliRMcn/dpOqxm34a667qo13ERob/48fKJaW+N1sgHpsGLT7f8fkvjLfqFlQjzmB0AbCxm6orTk55i2edKvNILr0RHj5LJOiesMNHNUneRqTaNfucZ2VbsAQXehNuimh2VU7OousL4ROwiNiQ0QAmyWIYJSZilnHsL6UF+P67Ub2B0muspcIcRvXXNr+1rPMNOb1X39NkPcIfPj7m+SRKvyo+TMtmj+iWEt SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CO1PR15MB1077;20:nNxbyPu0q6QSSQ5m81spcxMStRNQJmNCrs25YvS6o0EcUxI7/aAFpwSWXZNyFcJoPdXKjG8QyDHlixUikyk0xFniGVlUn09o0QavE/J7ngok/CKQbAMyeclGL8qhtwvp13BLK1PjRuYzWahQdIcW/lUBYGAaYmrFPLpgZ83rDfE= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2017 14:55:22.1884 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 137b4d89-f6f4-453c-0988-08d52201bef1 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR15MB1077 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-11-02_05:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Cgroup v2 lacks the device controller, provided by cgroup v1. This patch adds a new eBPF program type, which in combination of previously added ability to attach multiple eBPF programs to a cgroup, will provide a similar functionality, but with some additional flexibility. This patch introduces a BPF_PROG_TYPE_CGROUP_DEVICE program type. A program takes major and minor device numbers, device type (block/character) and access type (mknod/read/write) as parameters and returns an integer which defines if the operation should be allowed or terminated with -EPERM. Signed-off-by: Roman Gushchin Acked-by: Alexei Starovoitov Acked-by: Tejun Heo Cc: Daniel Borkmann --- include/linux/bpf-cgroup.h | 15 ++++++++++ include/linux/bpf_types.h | 3 ++ include/linux/device_cgroup.h | 8 ++++- include/uapi/linux/bpf.h | 15 ++++++++++ kernel/bpf/cgroup.c | 67 ++++++++++++++++++++++++++++++++++++++++++ kernel/bpf/syscall.c | 7 +++++ kernel/bpf/verifier.c | 1 + tools/include/uapi/linux/bpf.h | 15 ++++++++++ 8 files changed, 130 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h index 359b6f5d3d90..d77cefb3fe99 100644 --- a/include/linux/bpf-cgroup.h +++ b/include/linux/bpf-cgroup.h @@ -66,6 +66,9 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, struct bpf_sock_ops_kern *sock_ops, enum bpf_attach_type type); +int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, + short access, enum bpf_attach_type type); + /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */ #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \ ({ \ @@ -111,6 +114,17 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, } \ __ret; \ }) + +#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access) \ +({ \ + int __ret = 0; \ + if (cgroup_bpf_enabled) \ + __ret = __cgroup_bpf_check_dev_permission(type, major, minor, \ + access, \ + BPF_CGROUP_DEVICE); \ + \ + __ret; \ +}) #else struct cgroup_bpf {}; @@ -121,6 +135,7 @@ static inline int cgroup_bpf_inherit(struct cgroup *cgrp) { return 0; } #define BPF_CGROUP_RUN_PROG_INET_EGRESS(sk,skb) ({ 0; }) #define BPF_CGROUP_RUN_PROG_INET_SOCK(sk) ({ 0; }) #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; }) +#define BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type,major,minor,access) ({ 0; }) #endif /* CONFIG_CGROUP_BPF */ diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index 36418ad43245..963a97ee4b7c 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -18,6 +18,9 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_KPROBE, kprobe) BPF_PROG_TYPE(BPF_PROG_TYPE_TRACEPOINT, tracepoint) BPF_PROG_TYPE(BPF_PROG_TYPE_PERF_EVENT, perf_event) #endif +#ifdef CONFIG_CGROUP_BPF +BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_DEVICE, cg_dev) +#endif BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops) BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops) diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h index 1e42d33accbf..90245a70d940 100644 --- a/include/linux/device_cgroup.h +++ b/include/linux/device_cgroup.h @@ -1,4 +1,5 @@ #include +#include #define DEVCG_ACC_MKNOD 1 #define DEVCG_ACC_READ 2 @@ -18,10 +19,15 @@ static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, { return 0; } #endif -#ifdef CONFIG_CGROUP_DEVICE +#if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) static inline int devcgroup_check_permission(short type, u32 major, u32 minor, short access) { + int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access); + + if (rc) + return -EPERM; + return __devcgroup_check_permission(type, major, minor, access); } diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 0b7b54d898bd..4deb3c9acbb2 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -131,6 +131,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, + BPF_PROG_TYPE_CGROUP_DEVICE, }; enum bpf_attach_type { @@ -140,6 +141,7 @@ enum bpf_attach_type { BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, + BPF_CGROUP_DEVICE, __MAX_BPF_ATTACH_TYPE }; @@ -984,4 +986,17 @@ struct bpf_perf_event_value { __u64 running; }; +#define DEV_BPF_ACC_MKNOD (1ULL << 0) +#define DEV_BPF_ACC_READ (1ULL << 1) +#define DEV_BPF_ACC_WRITE (1ULL << 2) + +#define DEV_BPF_DEV_BLOCK (1ULL << 0) +#define DEV_BPF_DEV_CHAR (1ULL << 1) + +struct bpf_cgroup_dev_ctx { + __u32 access_type; /* (access << 16) | type */ + __u32 major; + __u32 minor; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 3db5a17fcfe8..b789ab78d28f 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -522,3 +522,70 @@ int __cgroup_bpf_run_filter_sock_ops(struct sock *sk, return ret == 1 ? 0 : -EPERM; } EXPORT_SYMBOL(__cgroup_bpf_run_filter_sock_ops); + +int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, + short access, enum bpf_attach_type type) +{ + struct cgroup *cgrp; + struct bpf_cgroup_dev_ctx ctx = { + .access_type = (access << 16) | dev_type, + .major = major, + .minor = minor, + }; + int allow = 1; + + rcu_read_lock(); + cgrp = task_dfl_cgroup(current); + allow = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], &ctx, + BPF_PROG_RUN); + rcu_read_unlock(); + + return !allow; +} +EXPORT_SYMBOL(__cgroup_bpf_check_dev_permission); + +static const struct bpf_func_proto * +cgroup_dev_func_proto(enum bpf_func_id func_id) +{ + switch (func_id) { + case BPF_FUNC_map_lookup_elem: + return &bpf_map_lookup_elem_proto; + case BPF_FUNC_map_update_elem: + return &bpf_map_update_elem_proto; + case BPF_FUNC_map_delete_elem: + return &bpf_map_delete_elem_proto; + case BPF_FUNC_get_current_uid_gid: + return &bpf_get_current_uid_gid_proto; + case BPF_FUNC_trace_printk: + if (capable(CAP_SYS_ADMIN)) + return bpf_get_trace_printk_proto(); + default: + return NULL; + } +} + +static bool cgroup_dev_is_valid_access(int off, int size, + enum bpf_access_type type, + struct bpf_insn_access_aux *info) +{ + if (type == BPF_WRITE) + return false; + + if (off < 0 || off + size > sizeof(struct bpf_cgroup_dev_ctx)) + return false; + /* The verifier guarantees that size > 0. */ + if (off % size != 0) + return false; + if (size != sizeof(__u32)) + return false; + + return true; +} + +const struct bpf_prog_ops cg_dev_prog_ops = { +}; + +const struct bpf_verifier_ops cg_dev_verifier_ops = { + .get_func_proto = cgroup_dev_func_proto, + .is_valid_access = cgroup_dev_is_valid_access, +}; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 323be2473c4b..08f7b450828e 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1291,6 +1291,9 @@ static int bpf_prog_attach(const union bpf_attr *attr) case BPF_CGROUP_SOCK_OPS: ptype = BPF_PROG_TYPE_SOCK_OPS; break; + case BPF_CGROUP_DEVICE: + ptype = BPF_PROG_TYPE_CGROUP_DEVICE; + break; case BPF_SK_SKB_STREAM_PARSER: case BPF_SK_SKB_STREAM_VERDICT: return sockmap_get_from_fd(attr, true); @@ -1343,6 +1346,9 @@ static int bpf_prog_detach(const union bpf_attr *attr) case BPF_CGROUP_SOCK_OPS: ptype = BPF_PROG_TYPE_SOCK_OPS; break; + case BPF_CGROUP_DEVICE: + ptype = BPF_PROG_TYPE_CGROUP_DEVICE; + break; case BPF_SK_SKB_STREAM_PARSER: case BPF_SK_SKB_STREAM_VERDICT: return sockmap_get_from_fd(attr, false); @@ -1385,6 +1391,7 @@ static int bpf_prog_query(const union bpf_attr *attr, case BPF_CGROUP_INET_EGRESS: case BPF_CGROUP_INET_SOCK_CREATE: case BPF_CGROUP_SOCK_OPS: + case BPF_CGROUP_DEVICE: break; default: return -EINVAL; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 2bb6d6aa7085..811f0582a1cc 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3100,6 +3100,7 @@ static int check_return_code(struct bpf_verifier_env *env) case BPF_PROG_TYPE_CGROUP_SKB: case BPF_PROG_TYPE_CGROUP_SOCK: case BPF_PROG_TYPE_SOCK_OPS: + case BPF_PROG_TYPE_CGROUP_DEVICE: break; default: return 0; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 4a4b6e78c977..c0306ac49860 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -131,6 +131,7 @@ enum bpf_prog_type { BPF_PROG_TYPE_LWT_XMIT, BPF_PROG_TYPE_SOCK_OPS, BPF_PROG_TYPE_SK_SKB, + BPF_PROG_TYPE_CGROUP_DEVICE, }; enum bpf_attach_type { @@ -140,6 +141,7 @@ enum bpf_attach_type { BPF_CGROUP_SOCK_OPS, BPF_SK_SKB_STREAM_PARSER, BPF_SK_SKB_STREAM_VERDICT, + BPF_CGROUP_DEVICE, __MAX_BPF_ATTACH_TYPE }; @@ -984,4 +986,17 @@ struct bpf_perf_event_value { __u64 running; }; +#define DEV_BPF_ACC_MKNOD (1ULL << 0) +#define DEV_BPF_ACC_READ (1ULL << 1) +#define DEV_BPF_ACC_WRITE (1ULL << 2) + +#define DEV_BPF_DEV_BLOCK (1ULL << 0) +#define DEV_BPF_DEV_CHAR (1ULL << 1) + +struct bpf_cgroup_dev_ctx { + __u32 access_type; /* (access << 16) | type */ + __u32 major; + __u32 minor; +}; + #endif /* _UAPI__LINUX_BPF_H__ */ -- 2.13.6