With having ability to lookup sockets in cgroup skb programs it becomes useful to access cgroup id of retrieved sockets so that policies can be implemented based on origin cgroup of such socket. For example, a container running in a cgroup can have cgroup skb ingress program that can lookup peer socket that is sending packets to a process inside the container and decide whether those packets should be allowed or denied based on cgroup id of the peer. More specifically such ingress program can implement intra-host policy "allow incoming packets only from this same container and not from any other container on same host" w/o relying on source IP addresses since quite often it can be the case that containers share same IP address on the host. Introduce two new helpers for this use-case: bpf_sk_cgroup_id() and bpf_sk_ancestor_cgroup_id(). These helpers are similar to existing bpf_skb_{,ancestor_}cgroup_id helpers with the only difference that sk is used to get cgroup id instead of skb, and share code with them. See documentation in UAPI for more details.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -3121,6 +3121,38 @@ union bpf_attr { · 3120 unmodified lines | |||
| 3121 | * 0 on success, or a negative error in case of failure: | 3121 | * 0 on success, or a negative error in case of failure: |
| 3122 | * | 3122 | * |
| 3123 | * **-EOVERFLOW** if an overflow happened: The same object will be tried again. | 3123 | * **-EOVERFLOW** if an overflow happened: The same object will be tried again. |
| 3124 | * | ||
| 3125 | * u64 bpf_sk_cgroup_id(struct bpf_sock *sk) | ||
| 3126 | * Description | ||
| 3127 | * Return the cgroup v2 id of the socket *sk*. | ||
| 3128 | * | ||
| 3129 | * *sk* must be a non-**NULL** pointer to a full socket, e.g. one | ||
| 3130 | * returned from **bpf_sk_lookup_xxx**\ (), | ||
| 3131 | * **bpf_sk_fullsock**\ (), etc. The format of returned id is | ||
| 3132 | * same as in **bpf_skb_cgroup_id**\ (). | ||
| 3133 | * | ||
| 3134 | * This helper is available only if the kernel was compiled with | ||
| 3135 | * the **CONFIG_SOCK_CGROUP_DATA** configuration option. | ||
| 3136 | * Return | ||
| 3137 | * The id is returned or 0 in case the id could not be retrieved. | ||
| 3138 | * | ||
| 3139 | * u64 bpf_sk_ancestor_cgroup_id(struct bpf_sock *sk, int ancestor_level) | ||
| 3140 | * Description | ||
| 3141 | * Return id of cgroup v2 that is ancestor of cgroup associated | ||
| 3142 | * with the *sk* at the *ancestor_level*. The root cgroup is at | ||
| 3143 | * *ancestor_level* zero and each step down the hierarchy | ||
| 3144 | * increments the level. If *ancestor_level* == level of cgroup | ||
| 3145 | * associated with *sk*, then return value will be same as that | ||
| 3146 | * of **bpf_sk_cgroup_id**\ (). | ||
| 3147 | * | ||
| 3148 | * The helper is useful to implement policies based on cgroups | ||
| 3149 | * that are upper in hierarchy than immediate cgroup associated | ||
| 3150 | * with *sk*. | ||
| 3151 | * | ||
| 3152 | * The format of returned id and helper limitations are same as in | ||
| 3153 | * **bpf_sk_cgroup_id**\ (). | ||
| 3154 | * Return | ||
| 3155 | * The id is returned or 0 in case the id could not be retrieved. | ||
| 3124 | */ | 3156 | */ |
| 3125 | #define __BPF_FUNC_MAPPER(FN) \ | 3157 | #define __BPF_FUNC_MAPPER(FN) \ |
| 3126 | FN(unspec), \ | 3158 | FN(unspec), \ |
| @@ -3250,7 +3282,9 @@ union bpf_attr { · 123 unmodified lines | |||
| 3250 | FN(sk_assign), \ | 3282 | FN(sk_assign), \ |
| 3251 | FN(ktime_get_boot_ns), \ | 3283 | FN(ktime_get_boot_ns), \ |
| 3252 | FN(seq_printf), \ | 3284 | FN(seq_printf), \ |
| 3253 | FN(seq_write), | 3285 | FN(seq_write), \ |
| 3286 | FN(sk_cgroup_id), \ | ||
| 3287 | FN(sk_ancestor_cgroup_id), | ||
| 3254 | 3288 | ||
| 3255 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper | 3289 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 3256 | * function eBPF program intends to call | 3290 | * function eBPF program intends to call |