[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFE: BPF programs on cgroups #10227

Closed
jaymzh opened this issue Oct 1, 2018 · 1 comment · Fixed by #12419
Closed

RFE: BPF programs on cgroups #10227

jaymzh opened this issue Oct 1, 2018 · 1 comment · Fixed by #12419
Labels
pid1 RFE 🎁 Request for Enhancement, i.e. a feature request

Comments

@jaymzh
Copy link
jaymzh commented Oct 1, 2018

At ASG2018 hack we discussed a path to allow users to ask Systemd to install BPF programs into cgroups. This issue is to document that design as an RFE.

The motivation is to allow users to associate a BPF program with a unit file so that systemd can install them after the cgroup is setup.

The design we came up with was:

The user would be responsible for creating any maps, loading the program and associating any maps with the program. At this point the user simply needs to pass the FD for the BPF program to systemd. The suggested name for this was BPFProgramPath. In this case, the suggested way of doing this was via /proc/$PID/fds/<appropriate FD>.

An option to systemd-nspawn could then be made to expose this as well.
@jaymzh jaymzh changed the title BPF programs on cgroups RFI: BPF programs on cgroups Oct 1, 2018
@jaymzh jaymzh changed the title RFI: BPF programs on cgroups RFE: BPF programs on cgroups Oct 1, 2018
@poettering poettering added RFE 🎁 Request for Enhancement, i.e. a feature request pid1 labels Oct 2, 2018
@alban
Copy link
Member
alban commented Nov 29, 2018

Here is a previous discussion:
#6764 (comment)
where I suggest to use eBPF programs on the BPF filesystem as an alternative to /proc/$PID/fd/<appropriate FD>. We also need to be able to speify different eBPF programs for egress and ingress.

pothos added a commit to pothos/systemd that referenced this issue Apr 26, 2019
@pothos
bpf-firewall: support custom BPF programs through IPFilter(Ingress|Eg…
7192b58 
…ress)=

Takes a single /sys/fs/bpf/pinned_prog string as argument but may be
specified multiple times.

systemd#10227
pothos added a commit to pothos/systemd that referenced this issue Apr 26, 2019
@pothos
bpf-firewall: support custom BPF programs through IPFilter(Ingress|Eg…
db90ec5 
…ress)=

Takes a single /sys/fs/bpf/pinned_prog string as argument but may be
specified multiple times.

systemd#10227
@pothos pothos mentioned this issue Apr 26, 2019
Merged
pothos added a commit to pothos/systemd that referenced this issue May 2, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
1f0f3e7 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue May 3, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
530f48c 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue May 3, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
0fb069d 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue May 3, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
9883630 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue May 3, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
a302ddb 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue May 31, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
00745c3 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue Jun 21, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
7078fe2 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue Jun 24, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
735220d 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue Jun 24, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
57d5e18 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
pothos added a commit to pothos/systemd that referenced this issue Jun 24, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
8550c24 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
poettering pushed a commit that referenced this issue Jun 25, 2019
@pothos @poettering
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
fab3474 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes #10227
edevolder pushed a commit to edevolder/systemd that referenced this issue Jun 26, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
77703d5 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
edevolder pushed a commit to edevolder/systemd that referenced this issue Jun 26, 2019
@pothos
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
8fbbbed 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
zachsmith pushed a commit to zachsmith/systemd that referenced this issue Jul 26, 2019
@pothos @zachsmith
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
a5a7a05 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd#10227
Yamakuzure pushed a commit to elogind/elogind that referenced this issue Sep 23, 2019
@pothos @Yamakuzure
bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath=
2ebb1f5 
Takes a single /sys/fs/bpf/pinned_prog string as argument, but may be
specified multiple times. An empty assignment resets all previous filters.

Closes systemd/systemd#10227
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
pid1 RFE 🎁 Request for Enhancement, i.e. a feature request
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

bpf-firewall: custom BPF programs through IP(Ingress|Egress)FilterPath= pothos/systemd
3 participants
@alban @jaymzh @poettering