bpf: Enable bpf cgroup hooks to retrieve cgroup v2 and ancestor id
authorDaniel Borkmann <daniel@iogearbox.net>
Fri, 27 Mar 2020 15:58:54 +0000 (16:58 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Sat, 28 Mar 2020 02:40:39 +0000 (19:40 -0700)
commit0f09abd105da6c37713d2b253730a86cb45e127a
tree53099c731ea40e72c37abb521564cd08fc6c68e6
parent5a52ae4e32a61ad06ef67f0b3123adbdbac4fb83
bpf: Enable bpf cgroup hooks to retrieve cgroup v2 and ancestor id

Enable the bpf_get_current_cgroup_id() helper for connect(), sendmsg(),
recvmsg() and bind-related hooks in order to retrieve the cgroup v2
context which can then be used as part of the key for BPF map lookups,
for example. Given these hooks operate in process context 'current' is
always valid and pointing to the app that is performing mentioned
syscalls if it's subject to a v2 cgroup. Also with same motivation of
commit 7723628101aa ("bpf: Introduce bpf_skb_ancestor_cgroup_id helper")
enable retrieval of ancestor from current so the cgroup id can be used
for policy lookups which can then forbid connect() / bind(), for example.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/d2a7ef42530ad299e3cbb245e6c12374b72145ef.1585323121.git.daniel@iogearbox.net
include/linux/bpf.h
include/uapi/linux/bpf.h
kernel/bpf/core.c
kernel/bpf/helpers.c
net/core/filter.c
tools/include/uapi/linux/bpf.h