Commit 7cac5303 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'bpf-under-cgroup' 



Sargun Dhillon says:

====================
Add test_current_task_under_cgroup bpf helper and test

This patchset includes a helper and an example to determine whether the probe is
currently executing in the context of a specific cgroup based on a cgroup bpf
map / array. The helper checks the cgroupsv2 hierarchy based on the handle in
the map and if the current cgroup is equal to it, or a descendant of it. The
helper was tested with the example program, and it was verified that the correct
behaviour occurs in the interrupt context.

In an earlier version of this patchset I had added an "opensnoop"-like tool, and
I realized I was basically reimplementing a lot of the code that already exists
in the bcc repo. So, instead I decided to write a test that creates a new mount
namespace, mounts up the cgroupv2 hierarchy, and does some basic tests.  I used
the sync syscall as a canary for these tests because it's a simple, 0-arg
syscall. Once this patch is accepted, adding support to opensnoop will be easy.

I also added a task_under_cgroup_hierarchy function in cgroups.h, as this
pattern is used in a couple places. Converting those can be done in a later
patchset.

Thanks to Alexei, Tejun, and Daniel for providing review.

v1->v2: Clean up
v2->v3: Move around ifdefs out of *.c files, add an "integration" test
v3->v4: De-genercize arraymap fetching function;
	rename helper from in_cgroup to under_cgroup (makes much more sense)
	Split adding cgroups task_under_cgroup_hierarchy function
v4->v5: Fix formatting
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents f9f9ab17 9e6e60ec

include/linux/cgroup.h

+23 −0
Original line number Original line Diff line number Diff line
@@ -497,6 +497,23 @@ static inline bool cgroup_is_descendant(struct cgroup *cgrp, 
	return cgrp->ancestor_ids[ancestor->level] == ancestor->id;

	return cgrp->ancestor_ids[ancestor->level] == ancestor->id;

}

}





/**

 * task_under_cgroup_hierarchy - test task's membership of cgroup ancestry

 * @task: the task to be tested

 * @ancestor: possible ancestor of @task's cgroup

 *

 * Tests whether @task's default cgroup hierarchy is a descendant of @ancestor.

 * It follows all the same rules as cgroup_is_descendant, and only applies

 * to the default hierarchy.

 */

static inline bool task_under_cgroup_hierarchy(struct task_struct *task,

					       struct cgroup *ancestor)

{

	struct css_set *cset = task_css_set(task);



	return cgroup_is_descendant(cset->dfl_cgrp, ancestor);

}



/* no synchronization, the result can only be used as a hint */

/* no synchronization, the result can only be used as a hint */

static inline bool cgroup_is_populated(struct cgroup *cgrp)

static inline bool cgroup_is_populated(struct cgroup *cgrp)

{

{
@@ -557,6 +574,7 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp) 
#else /* !CONFIG_CGROUPS */

#else /* !CONFIG_CGROUPS */





struct cgroup_subsys_state;

struct cgroup_subsys_state;

struct cgroup;





static inline void css_put(struct cgroup_subsys_state *css) {}

static inline void css_put(struct cgroup_subsys_state *css) {}

static inline int cgroup_attach_task_all(struct task_struct *from,

static inline int cgroup_attach_task_all(struct task_struct *from,
@@ -574,6 +592,11 @@ static inline void cgroup_free(struct task_struct *p) {} 
static inline int cgroup_init_early(void) { return 0; }

static inline int cgroup_init_early(void) { return 0; }

static inline int cgroup_init(void) { return 0; }

static inline int cgroup_init(void) { return 0; }





static inline bool task_under_cgroup_hierarchy(struct task_struct *task,

					       struct cgroup *ancestor)

{

	return true;

}

#endif /* !CONFIG_CGROUPS */

#endif /* !CONFIG_CGROUPS */





/*

/*

include/uapi/linux/bpf.h

+11 −0
Original line number Original line Diff line number Diff line
@@ -375,6 +375,17 @@ enum bpf_func_id { 
	 */

	 */

	BPF_FUNC_probe_write_user,

	BPF_FUNC_probe_write_user,





	/**

	 * bpf_current_task_under_cgroup(map, index) - Check cgroup2 membership of current task

	 * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type

	 * @index: index of the cgroup in the bpf_map

	 * Return:

	 *   == 0 current failed the cgroup2 descendant test

	 *   == 1 current succeeded the cgroup2 descendant test

	 *    < 0 error

	 */

	BPF_FUNC_current_task_under_cgroup,



	__BPF_FUNC_MAX_ID,

	__BPF_FUNC_MAX_ID,

};

};

kernel/bpf/arraymap.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -538,7 +538,7 @@ static int __init register_perf_event_array_map(void) 
}

}

late_initcall(register_perf_event_array_map);

late_initcall(register_perf_event_array_map);





#ifdef CONFIG_SOCK_CGROUP_DATA

#ifdef CONFIG_CGROUPS

static void *cgroup_fd_array_get_ptr(struct bpf_map *map,

static void *cgroup_fd_array_get_ptr(struct bpf_map *map,

				     struct file *map_file /* not used */,

				     struct file *map_file /* not used */,

				     int fd)

				     int fd)

kernel/bpf/verifier.c

+3 −1
Original line number Original line Diff line number Diff line
@@ -1053,7 +1053,8 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id) 
			goto error;

			goto error;

		break;

		break;

	case BPF_MAP_TYPE_CGROUP_ARRAY:

	case BPF_MAP_TYPE_CGROUP_ARRAY:

		if (func_id != BPF_FUNC_skb_in_cgroup)

		if (func_id != BPF_FUNC_skb_in_cgroup &&

		    func_id != BPF_FUNC_current_task_under_cgroup)

			goto error;

			goto error;

		break;

		break;

	default:

	default:
@@ -1075,6 +1076,7 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id) 
		if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)

		if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)

			goto error;

			goto error;

		break;

		break;

	case BPF_FUNC_current_task_under_cgroup:

	case BPF_FUNC_skb_in_cgroup:

	case BPF_FUNC_skb_in_cgroup:

		if (map->map_type != BPF_MAP_TYPE_CGROUP_ARRAY)

		if (map->map_type != BPF_MAP_TYPE_CGROUP_ARRAY)

			goto error;

			goto error;

kernel/trace/bpf_trace.c

+30 −0
Original line number Original line Diff line number Diff line
@@ -376,6 +376,34 @@ static const struct bpf_func_proto bpf_get_current_task_proto = { 
	.ret_type	= RET_INTEGER,

	.ret_type	= RET_INTEGER,

};

};





static u64 bpf_current_task_under_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)

{

	struct bpf_map *map = (struct bpf_map *)(long)r1;

	struct bpf_array *array = container_of(map, struct bpf_array, map);

	struct cgroup *cgrp;

	u32 idx = (u32)r2;



	if (unlikely(in_interrupt()))

		return -EINVAL;



	if (unlikely(idx >= array->map.max_entries))

		return -E2BIG;



	cgrp = READ_ONCE(array->ptrs[idx]);

	if (unlikely(!cgrp))

		return -EAGAIN;



	return task_under_cgroup_hierarchy(current, cgrp);

}



static const struct bpf_func_proto bpf_current_task_under_cgroup_proto = {

	.func           = bpf_current_task_under_cgroup,

	.gpl_only       = false,

	.ret_type       = RET_INTEGER,

	.arg1_type      = ARG_CONST_MAP_PTR,

	.arg2_type      = ARG_ANYTHING,

};



static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)

static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id)

{

{

	switch (func_id) {

	switch (func_id) {
@@ -407,6 +435,8 @@ static const struct bpf_func_proto *tracing_func_proto(enum bpf_func_id func_id) 
		return &bpf_perf_event_read_proto;

		return &bpf_perf_event_read_proto;

	case BPF_FUNC_probe_write_user:

	case BPF_FUNC_probe_write_user:

		return bpf_get_probe_write_proto();

		return bpf_get_probe_write_proto();

	case BPF_FUNC_current_task_under_cgroup:

		return &bpf_current_task_under_cgroup_proto;

	default:

	default:

		return NULL;

		return NULL;

	}

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE