If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command to the given cgroup the descendent cgroup will be able to override effective bpf program that was inherited from this cgroup. By default it's not passed, therefore override is disallowed. Examples: 1. prog X attached to /A with default prog Y fails to attach to /A/B and /A/B/C Everything under /A runs prog X 2. prog X attached to /A with allow_override. prog Y fails to attach to /A/B with default (non-override) prog M attached to /A/B with allow_override. Everything under /A/B runs prog M only. 3. prog X attached to /A with allow_override. prog Y fails to attach to /A with default. The user has to detach first to switch the mode. In the future this behavior may be extended with a chain of non-overridable programs. Also fix the bug where detach from cgroup where nothing is attached was not throwing error. Return ENOENT in such case. Add several testcases and adjust libbpf.
Showing the changes to include/uapi/linux (1 of 11 files). Show all
Unified · Split
| @@ -116,6 +116,12 @@ enum bpf_attach_type { · 115 unmodified lines | ||
| 116 | 116 | |
| 117 | 117 | #define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE |
| 118 | 118 | |
| 119 | +/* If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command | |
| 120 | + * to the given target_fd cgroup the descendent cgroup will be able to | |
| 121 | + * override effective bpf program that was inherited from this cgroup | |
| 122 | + */ | |
| 123 | +#define BPF_F_ALLOW_OVERRIDE (1U << 0) | |
| 124 | + | |
| 119 | 125 | #define BPF_PSEUDO_MAP_FD 1 |
| 120 | 126 | |
| 121 | 127 | /* flags for BPF_MAP_UPDATE_ELEM command */ |
| @@ -171,6 +177,7 @@ union bpf_attr { · 49 unmodified lines | ||
| 171 | 177 | __u32 target_fd; /* container object to attach to */ |
| 172 | 178 | __u32 attach_bpf_fd; /* eBPF program to attach */ |
| 173 | 179 | __u32 attach_type; |
| 180 | + __u32 attach_flags; | |
| 174 | 181 | }; |
| 175 | 182 | } __attribute__((aligned(8))); |
| 176 | 183 | |