summaryrefslogtreecommitdiffstats
path: root/init
diff options
context:
space:
mode:
authorDaniel Mack <daniel@zonque.org>2016-11-23 16:52:26 +0100
committerDavid S. Miller <davem@davemloft.net>2016-11-25 16:25:52 -0500
commit3007098494bec614fb55dee7bc0410bb7db5ad18 (patch)
treeff07e31da90fd790d2ae4f129d04954b70766057 /init
parent0e33661de493db325435d565a4a722120ae4cbf3 (diff)
downloadlinux-3007098494bec614fb55dee7bc0410bb7db5ad18.tar.gz
linux-3007098494bec614fb55dee7bc0410bb7db5ad18.tar.bz2
linux-3007098494bec614fb55dee7bc0410bb7db5ad18.zip
cgroup: add support for eBPF programs
This patch adds two sets of eBPF program pointers to struct cgroup. One for such that are directly pinned to a cgroup, and one for such that are effective for it. To illustrate the logic behind that, assume the following example cgroup hierarchy. A - B - C \ D - E If only B has a program attached, it will be effective for B, C, D and E. If D then attaches a program itself, that will be effective for both D and E, and the program in B will only affect B and C. Only one program of a given type is effective for a cgroup. Attaching and detaching programs will be done through the bpf(2) syscall. For now, ingress and egress inet socket filtering are the only supported use-cases. Signed-off-by: Daniel Mack <daniel@zonque.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'init')
-rw-r--r--init/Kconfig12
1 files changed, 12 insertions, 0 deletions
diff --git a/init/Kconfig b/init/Kconfig
index 34407f15e6d3..405120b5f13e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1154,6 +1154,18 @@ config CGROUP_PERF
Say N if unsure.
+config CGROUP_BPF
+ bool "Support for eBPF programs attached to cgroups"
+ depends on BPF_SYSCALL && SOCK_CGROUP_DATA
+ help
+ Allow attaching eBPF programs to a cgroup using the bpf(2)
+ syscall command BPF_PROG_ATTACH.
+
+ In which context these programs are accessed depends on the type
+ of attachment. For instance, programs that are attached using
+ BPF_CGROUP_INET_INGRESS will be executed on the ingress path of
+ inet sockets.
+
config CGROUP_DEBUG
bool "Example controller"
default n