tree 705cb439fe6009f52b1a157b0c298941783e0c94
parent 760b55c0cab98e39d4520f58f1d62227cae88686
author Daniel Mack <daniel@zonque.org> 1479916346 +0100
committer Chenbo Feng <fengc@google.com> 1495492256 -0700

UPSTREAM: cgroup: add support for eBPF programs

Cherry-pick from commit 3007098494bec614fb55dee7bc0410bb7db5ad18

This patch adds two sets of eBPF program pointers to struct cgroup.
One for such that are directly pinned to a cgroup, and one for such
that are effective for it.

To illustrate the logic behind that, assume the following example
cgroup hierarchy.

  A - B - C
        \ D - E

If only B has a program attached, it will be effective for B, C, D
and E. If D then attaches a program itself, that will be effective for
both D and E, and the program in B will only affect B and C. Only one
program of a given type is effective for a cgroup.

Attaching and detaching programs will be done through the bpf(2)
syscall. For now, ingress and egress inet socket filtering are the
only supported use-cases.

Signed-off-by: Daniel Mack <daniel@zonque.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Bug: 30950746
Change-Id: I3df35d8d3b1261503f9b5bcd90b18c9358f1ac28