To allow user space tools to check if a device guard is active, we extend the struct bpf_prog_info by a cgroup_device_guard field. This is then used by the bpftool in print_prog_header_*() functions. Output of bpftool, here for the bpf prog of a GyroidOS container: # ./bpftool prog show id 37 37: cgroup_device tag 1824c08482acee1b gpl cgdev_guard loaded_at 2023-08-14T13:47:10+0200 uid 0 xlated 456B jited 311B memlock 4096B Signed-off-by: Michael Weiß <michael.weiss@xxxxxxxxxxxxxxxxxxx> --- include/uapi/linux/bpf.h | 3 ++- kernel/bpf/syscall.c | 1 + tools/bpf/bpftool/prog.c | 2 ++ tools/include/uapi/linux/bpf.h | 3 ++- 4 files changed, 7 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 3be57f7957b1..7b383665d5f4 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -6331,7 +6331,8 @@ struct bpf_prog_info { char name[BPF_OBJ_NAME_LEN]; __u32 ifindex; __u32 gpl_compatible:1; - __u32 :31; /* alignment pad */ + __u32 cgroup_device_guard:1; + __u32 :30; /* alignment pad */ __u64 netns_dev; __u64 netns_ino; __u32 nr_jited_ksyms; diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 33ea67c702c1..9bc6d5dd2e90 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -4062,6 +4062,7 @@ static int bpf_prog_get_info_by_fd(struct file *file, info.created_by_uid = from_kuid_munged(current_user_ns(), prog->aux->user->uid); info.gpl_compatible = prog->gpl_compatible; + info.cgroup_device_guard = prog->aux->cgroup_device_guard; memcpy(info.tag, prog->tag, sizeof(prog->tag)); memcpy(info.name, prog->aux->name, sizeof(prog->aux->name)); diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c index 8443a149dd17..66d21794b641 100644 --- a/tools/bpf/bpftool/prog.c +++ b/tools/bpf/bpftool/prog.c @@ -434,6 +434,7 @@ static void print_prog_header_json(struct bpf_prog_info *info, int fd) info->tag[4], info->tag[5], info->tag[6], info->tag[7]); jsonw_bool_field(json_wtr, "gpl_compatible", info->gpl_compatible); + jsonw_bool_field(json_wtr, "cgroup_device_guard", info->cgroup_device_guard); if (info->run_time_ns) { jsonw_uint_field(json_wtr, "run_time_ns", info->run_time_ns); jsonw_uint_field(json_wtr, "run_cnt", info->run_cnt); @@ -519,6 +520,7 @@ static void print_prog_header_plain(struct bpf_prog_info *info, int fd) fprint_hex(stdout, info->tag, BPF_TAG_SIZE, ""); print_dev_plain(info->ifindex, info->netns_dev, info->netns_ino); printf("%s", info->gpl_compatible ? " gpl" : ""); + printf("%s", info->cgroup_device_guard ? " cgdev_guard" : ""); if (info->run_time_ns) printf(" run_time_ns %lld run_cnt %lld", info->run_time_ns, info->run_cnt); diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 3be57f7957b1..7b383665d5f4 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -6331,7 +6331,8 @@ struct bpf_prog_info { char name[BPF_OBJ_NAME_LEN]; __u32 ifindex; __u32 gpl_compatible:1; - __u32 :31; /* alignment pad */ + __u32 cgroup_device_guard:1; + __u32 :30; /* alignment pad */ __u64 netns_dev; __u64 netns_ino; __u32 nr_jited_ksyms; -- 2.30.2