diff options
| author | Daniel Mack <daniel@zonque.org> | 2016-11-23 16:52:26 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-11-25 22:25:52 +0100 |
| commit | 3007098494bec614fb55dee7bc0410bb7db5ad18 (patch) | |
| tree | ff07e31da90fd790d2ae4f129d04954b70766057 /init/Kconfig | |
| parent | bpf: add new prog type for cgroup socket filtering (diff) | |
| download | linux-3007098494bec614fb55dee7bc0410bb7db5ad18.tar.xz linux-3007098494bec614fb55dee7bc0410bb7db5ad18.zip | |
cgroup: add support for eBPF programs
This patch adds two sets of eBPF program pointers to struct cgroup.
One for such that are directly pinned to a cgroup, and one for such
that are effective for it.
To illustrate the logic behind that, assume the following example
cgroup hierarchy.
A - B - C
\ D - E
If only B has a program attached, it will be effective for B, C, D
and E. If D then attaches a program itself, that will be effective for
both D and E, and the program in B will only affect B and C. Only one
program of a given type is effective for a cgroup.
Attaching and detaching programs will be done through the bpf(2)
syscall. For now, ingress and egress inet socket filtering are the
only supported use-cases.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'init/Kconfig')
| -rw-r--r-- | init/Kconfig | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/init/Kconfig b/init/Kconfig index 34407f15e6d3..405120b5f13e 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1154,6 +1154,18 @@ config CGROUP_PERF Say N if unsure. +config CGROUP_BPF + bool "Support for eBPF programs attached to cgroups" + depends on BPF_SYSCALL && SOCK_CGROUP_DATA + help + Allow attaching eBPF programs to a cgroup using the bpf(2) + syscall command BPF_PROG_ATTACH. + + In which context these programs are accessed depends on the type + of attachment. For instance, programs that are attached using + BPF_CGROUP_INET_INGRESS will be executed on the ingress path of + inet sockets. + config CGROUP_DEBUG bool "Example controller" default n |