LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/ directory. Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 . https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92
(insts asm.Instructions, license string, dirFD int)
| 32 | // |
| 33 | // https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92 |
| 34 | func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFD int) (func() error, error) { |
| 35 | nilCloser := func() error { |
| 36 | return nil |
| 37 | } |
| 38 | spec := &ebpf.ProgramSpec{ |
| 39 | Type: ebpf.CGroupDevice, |
| 40 | Instructions: insts, |
| 41 | License: license, |
| 42 | } |
| 43 | prog, err := ebpf.NewProgram(spec) |
| 44 | if err != nil { |
| 45 | return nilCloser, err |
| 46 | } |
| 47 | err = link.RawAttachProgram(link.RawAttachProgramOptions{ |
| 48 | Target: dirFD, |
| 49 | Program: prog, |
| 50 | Attach: ebpf.AttachCGroupDevice, |
| 51 | Flags: unix.BPF_F_ALLOW_MULTI, |
| 52 | }) |
| 53 | if err != nil { |
| 54 | return nilCloser, fmt.Errorf("failed to call BPF_PROG_ATTACH (BPF_CGROUP_DEVICE, BPF_F_ALLOW_MULTI): %w", err) |
| 55 | } |
| 56 | closer := func() error { |
| 57 | err = link.RawDetachProgram(link.RawDetachProgramOptions{ |
| 58 | Target: dirFD, |
| 59 | Program: prog, |
| 60 | Attach: ebpf.AttachCGroupDevice, |
| 61 | }) |
| 62 | if err != nil { |
| 63 | return fmt.Errorf("failed to call BPF_PROG_DETACH (BPF_CGROUP_DEVICE): %w", err) |
| 64 | } |
| 65 | return nil |
| 66 | } |
| 67 | return closer, nil |
| 68 | } |
| 69 | |
| 70 | func isRWM(cgroupPermissions string) bool { |
| 71 | r := false |
no outgoing calls
no test coverage detected
searching dependent graphs…