On 5/13/20 2:38 PM, Andrey Ignatov wrote:
cgroup skb programs already can use bpf_skb_cgroup_id. Allow bpf_skb_ancestor_cgroup_id as well so that container policies can be implemented for a container that can have sub-cgroups dynamically created, but policies should still be implemented based on cgroup id of container itself not on an id of a sub-cgroup. Signed-off-by: Andrey Ignatov <rdna@xxxxxx>
Acked-by: Yonghong Song <yhs@xxxxxx>
