Merge branch 'bpf: Allow bpf_get_netns_cookie in BPF_PROG_TYPE_CGROUP_SOCKOPT'

Browse source

Stanislav Fomichev says:

====================

We'd like to be able to identify netns from setsockopt hooks
to be able to do the enforcement of some options only in the
"initial" netns (to give users the ability to create clear/isolated
sandboxes if needed without any enforcement by doing unshare(net)).

v3:
- remove extra 'ctx->skb == NULL' check (Martin KaFai Lau)
- rework test to make sure the helper is really called, not just
  verified

v2:
- add missing CONFIG_NET
====================

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

...

This commit is contained in:

Andrii Nakryiko 2021-08-13 17:49:24 -07:00

parent d164dd9a5c 6a3a3dcc3f

commit faff1cca3b

2 changed files with 34 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

18

kernel/bpf/cgroup.c

View file

16

tools/testing/selftests/bpf/progs/sockopt_sk.c

View file