Add a new bpf_skb_cgroup_id() helper that allows to retrieve the cgroup id from the skb's socket. This is useful in particular to enable bpf_get_cgroup_classid()-like behavior for cgroup v1 in cgroup v2 by allowing ID based matching on egress. This can in particular be used in combination with applying policy e.g. from map lookups, and also complements the older bpf_skb_under_cgroup() interface. In user space the cgroup id for a given path can be retrieved through the f_handle as demonstrated in [0] recently. [0] https://lkml.org/lkml/2018/5/22/1190
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -2054,6 +2054,22 @@ union bpf_attr { · 2053 unmodified lines | ||
| 2054 | 2054 | * |
| 2055 | 2055 | * Return |
| 2056 | 2056 | * 0 |
| 2057 | + * | |
| 2058 | + * uint64_t bpf_skb_cgroup_id(struct sk_buff *skb) | |
| 2059 | + * Description | |
| 2060 | + * Return the cgroup v2 id of the socket associated with the *skb*. | |
| 2061 | + * This is roughly similar to the **bpf_get_cgroup_classid**\ () | |
| 2062 | + * helper for cgroup v1 by providing a tag resp. identifier that | |
| 2063 | + * can be matched on or used for map lookups e.g. to implement | |
| 2064 | + * policy. The cgroup v2 id of a given path in the hierarchy is | |
| 2065 | + * exposed in user space through the f_handle API in order to get | |
| 2066 | + * to the same 64-bit id. | |
| 2067 | + * | |
| 2068 | + * This helper can be used on TC egress path, but not on ingress, | |
| 2069 | + * and is available only if the kernel was compiled with the | |
| 2070 | + * **CONFIG_SOCK_CGROUP_DATA** configuration option. | |
| 2071 | + * Return | |
| 2072 | + * The id is returned or 0 in case the id could not be retrieved. | |
| 2057 | 2073 | */ |
| 2058 | 2074 | #define __BPF_FUNC_MAPPER(FN) \ |
| 2059 | 2075 | FN(unspec), \ |
| @@ -2134,7 +2150,8 @@ union bpf_attr { · 74 unmodified lines | ||
| 2134 | 2150 | FN(lwt_seg6_adjust_srh), \ |
| 2135 | 2151 | FN(lwt_seg6_action), \ |
| 2136 | 2152 | FN(rc_repeat), \ |
| 2137 | − FN(rc_keydown), | |
| 2153 | + FN(rc_keydown), \ | |
| 2154 | + FN(skb_cgroup_id), | |
| 2138 | 2155 | |
| 2139 | 2156 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 2140 | 2157 | * function eBPF program intends to call |