From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: [PATCH v2 net-next 8/8] samples/bpf: Update cgroup socket examples to use uid gid helper Date: Fri, 25 Aug 2017 12:05:41 -0700 Message-ID: <1503687941-626-9-git-send-email-dsahern@gmail.com> References: <1503687941-626-1-git-send-email-dsahern@gmail.com> Cc: David Ahern To: netdev@vger.kernel.org, daniel@iogearbox.net, ast@kernel.org, tj@kernel.org, davem@davemloft.net Return-path: Received: from mail-pg0-f66.google.com ([74.125.83.66]:35877 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756602AbdHYTF7 (ORCPT ); Fri, 25 Aug 2017 15:05:59 -0400 Received: by mail-pg0-f66.google.com with SMTP id 83so890707pgb.3 for ; Fri, 25 Aug 2017 12:05:58 -0700 (PDT) In-Reply-To: <1503687941-626-1-git-send-email-dsahern@gmail.com> Sender: netdev-owner@vger.kernel.org List-ID: Signed-off-by: David Ahern --- samples/bpf/sock_flags_kern.c | 5 +++++ samples/bpf/test_cgrp2_sock.c | 12 +++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/samples/bpf/sock_flags_kern.c b/samples/bpf/sock_flags_kern.c index 533dd11a6baa..05dcdf8a4baa 100644 --- a/samples/bpf/sock_flags_kern.c +++ b/samples/bpf/sock_flags_kern.c @@ -9,8 +9,13 @@ SEC("cgroup/sock1") int bpf_prog1(struct bpf_sock *sk) { char fmt[] = "socket: family %d type %d protocol %d\n"; + char fmt2[] = "socket: uid %u gid %u\n"; + __u64 gid_uid = bpf_get_current_uid_gid(); + __u32 uid = gid_uid & 0xffffffff; + __u32 gid = gid_uid >> 32; bpf_trace_printk(fmt, sizeof(fmt), sk->family, sk->type, sk->protocol); + bpf_trace_printk(fmt2, sizeof(fmt2), uid, gid); /* block PF_INET6, SOCK_RAW, IPPROTO_ICMPV6 sockets * ie., make ping6 fail diff --git a/samples/bpf/test_cgrp2_sock.c b/samples/bpf/test_cgrp2_sock.c index eabf530a5223..e9eeaaf52219 100644 --- a/samples/bpf/test_cgrp2_sock.c +++ b/samples/bpf/test_cgrp2_sock.c @@ -46,8 +46,18 @@ static int prog_load(__u32 idx, __u32 mark, __u32 prio) /* set mark on socket */ struct bpf_insn prog_mark[] = { - BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), + /* get uid of process */ + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, + BPF_FUNC_get_current_uid_gid), + BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffffffff), + + /* if uid is 0, use given mark, else use the uid as the mark */ + BPF_MOV64_REG(BPF_REG_3, BPF_REG_0), + BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), BPF_MOV64_IMM(BPF_REG_3, mark), + + /* set the mark on the new socket */ + BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), BPF_MOV64_IMM(BPF_REG_2, offsetof(struct bpf_sock, mark)), BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3, offsetof(struct bpf_sock, mark)), }; -- 2.1.4