samples/bpf: Update cgroup socket examples to use uid gid helper
Signed-off-by: David Ahern <dsahern@gmail.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
33aeb5e30a
commit
0adc3dd900
|
@ -9,8 +9,13 @@ SEC("cgroup/sock1")
|
|||
int bpf_prog1(struct bpf_sock *sk)
|
||||
{
|
||||
char fmt[] = "socket: family %d type %d protocol %d\n";
|
||||
char fmt2[] = "socket: uid %u gid %u\n";
|
||||
__u64 gid_uid = bpf_get_current_uid_gid();
|
||||
__u32 uid = gid_uid & 0xffffffff;
|
||||
__u32 gid = gid_uid >> 32;
|
||||
|
||||
bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol);
|
||||
bpf_trace_printk(fmt2, sizeof(fmt2), uid, gid);
|
||||
|
||||
/* block PF_INET6, SOCK_RAW, IPPROTO_ICMPV6 sockets
|
||||
* ie., make ping6 fail
|
||||
|
|
|
@ -46,8 +46,18 @@ static int prog_load(__u32 idx, __u32 mark, __u32 prio)
|
|||
|
||||
/* set mark on socket */
|
||||
struct bpf_insn prog_mark[] = {
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
/* get uid of process */
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
|
||||
BPF_FUNC_get_current_uid_gid),
|
||||
BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffffffff),
|
||||
|
||||
/* if uid is 0, use given mark, else use the uid as the mark */
|
||||
BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
|
||||
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
||||
BPF_MOV64_IMM(BPF_REG_3, mark),
|
||||
|
||||
/* set the mark on the new socket */
|
||||
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
|
||||
BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, mark)),
|
||||
BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, mark)),
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue