msphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget*/translations/zh_CN/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/zh_TW/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/it_IT/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ja_JP/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/ko_KR/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/pt_BR/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget*/translations/sp_SP/bpf/prog_cgroup_sysctlmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h3SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)h]h3SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhhD/var/lib/git/docbuild/linux/Documentation/bpf/prog_cgroup_sysctl.rsthKubhsection)}(hhh](htitle)}(hBPF_PROG_TYPE_CGROUP_SYSCTLh]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hnThis document describes ``BPF_PROG_TYPE_CGROUP_SYSCTL`` program type that provides cgroup-bpf hook for sysctl.h](hThis document describes }(hhhhhNhNubhliteral)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhubh7 program type that provides cgroup-bpf hook for sysctl.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hThe hook has to be attached to a cgroup and will be called every time a process inside that cgroup tries to read from or write to sysctl knob in proc.h]hThe hook has to be attached to a cgroup and will be called every time a process inside that cgroup tries to read from or write to sysctl knob in proc.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(h1. Attach typeh]h1. Attach type}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(ho``BPF_CGROUP_SYSCTL`` attach type has to be used to attach ``BPF_PROG_TYPE_CGROUP_SYSCTL`` program to a cgroup.h](h)}(h``BPF_CGROUP_SYSCTL``h]hBPF_CGROUP_SYSCTL}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj ubh& attach type has to be used to attach }(hj hhhNhNubh)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj ubh program to a cgroup.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h] attach-typeah ]h"]1. attach typeah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h 2. Contexth]h 2. Context}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjVhhhhhKubh)}(h[``BPF_PROG_TYPE_CGROUP_SYSCTL`` provides access to the following context from BPF program::h](h)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjgubh; provides access to the following context from BPF program:}(hjghhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjVhhubh literal_block)}(h;struct bpf_sysctl { __u32 write; __u32 file_pos; };h]h;struct bpf_sysctl { __u32 write; __u32 file_pos; };}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjVhhubh bullet_list)}(hhh](h list_item)}(hl``write`` indicates whether sysctl value is being read (``0``) or written (``1``). This field is read-only. h]h)}(hk``write`` indicates whether sysctl value is being read (``0``) or written (``1``). This field is read-only.h](h)}(h ``write``h]hwrite}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh/ indicates whether sysctl value is being read (}(hjhhhNhNubh)}(h``0``h]h0}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh) or written (}(hjhhhNhNubh)}(h``1``h]h1}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh). This field is read-only.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX``file_pos`` indicates file position sysctl is being accessed at, read or written. This field is read-write. Writing to the field sets the starting position in sysctl proc file ``read(2)`` will be reading from or ``write(2)`` will be writing to. Writing zero to the field can be used e.g. to override whole sysctl value by ``bpf_sysctl_set_new_value()`` on ``write(2)`` even when it's called by user space on ``file_pos > 0``. Writing non-zero value to the field can be used to access part of sysctl value starting from specified ``file_pos``. Not all sysctl support access with ``file_pos != 0``, e.g. writes to numeric sysctl entries must always be at file position ``0``. See also ``kernel.sysctl_writes_strict`` sysctl. h]h)}(hX``file_pos`` indicates file position sysctl is being accessed at, read or written. This field is read-write. Writing to the field sets the starting position in sysctl proc file ``read(2)`` will be reading from or ``write(2)`` will be writing to. Writing zero to the field can be used e.g. to override whole sysctl value by ``bpf_sysctl_set_new_value()`` on ``write(2)`` even when it's called by user space on ``file_pos > 0``. Writing non-zero value to the field can be used to access part of sysctl value starting from specified ``file_pos``. Not all sysctl support access with ``file_pos != 0``, e.g. writes to numeric sysctl entries must always be at file position ``0``. See also ``kernel.sysctl_writes_strict`` sysctl.h](h)}(h ``file_pos``h]hfile_pos}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh indicates file position sysctl is being accessed at, read or written. This field is read-write. Writing to the field sets the starting position in sysctl proc file }(hjhhhNhNubh)}(h ``read(2)``h]hread(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh will be reading from or }(hjhhhNhNubh)}(h ``write(2)``h]hwrite(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubhb will be writing to. Writing zero to the field can be used e.g. to override whole sysctl value by }(hjhhhNhNubh)}(h``bpf_sysctl_set_new_value()``h]hbpf_sysctl_set_new_value()}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh on }(hjhhhNhNubh)}(h ``write(2)``h]hwrite(2)}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh* even when it’s called by user space on }(hjhhhNhNubh)}(h``file_pos > 0``h]h file_pos > 0}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubhi. Writing non-zero value to the field can be used to access part of sysctl value starting from specified }(hjhhhNhNubh)}(h ``file_pos``h]hfile_pos}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh%. Not all sysctl support access with }(hjhhhNhNubh)}(h``file_pos != 0``h]h file_pos != 0}(hjjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubhH, e.g. writes to numeric sysctl entries must always be at file position }(hjhhhNhNubh)}(h``0``h]h0}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh . See also }(hjhhhNhNubh)}(h``kernel.sysctl_writes_strict``h]hkernel.sysctl_writes_strict}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh sysctl.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK!hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1jhhhKhjVhhubh)}(hISee `linux/bpf.h`_ for more details on how context field can be accessed.h](hSee }(hjhhhNhNubh reference)}(h`linux/bpf.h`_h]h linux/bpf.h}(hjhhhNhNubah}(h]h ]h"]h$]h&]name linux/bpf.hrefuri../../include/uapi/linux/bpf.huh1jhjresolvedKubh7 for more details on how context field can be accessed.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK,hjVhhubeh}(h]contextah ]h"] 2. contextah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(h3. Return codeh]h3. Return code}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK/ubh)}(hV``BPF_PROG_TYPE_CGROUP_SYSCTL`` program must return one of the following return codes:h](h)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh7 program must return one of the following return codes:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK1hjhhubj)}(hhh](j)}(h&``0`` means "reject access to sysctl";h]h)}(hjh](h)}(h``0``h]h0}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh% means “reject access to sysctl”;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK4hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h#``1`` means "proceed with access". h]h)}(h"``1`` means "proceed with access".h](h)}(h``1``h]h1}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj<ubh! means “proceed with access”.}(hj<hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK5hj8ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhK4hjhhubh)}(h|If program returns ``0`` user space will get ``-1`` from ``read(2)`` or ``write(2)`` and ``errno`` will be set to ``EPERM``.h](hIf program returns }(hjdhhhNhNubh)}(h``0``h]h0}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh user space will get }(hjdhhhNhNubh)}(h``-1``h]h-1}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh from }(hjdhhhNhNubh)}(h ``read(2)``h]hread(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh or }(hjdhhhNhNubh)}(h ``write(2)``h]hwrite(2)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh and }(hjdhhhNhNubh)}(h ``errno``h]herrno}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh will be set to }(hjdhhhNhNubh)}(h ``EPERM``h]hEPERM}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjdubh.}(hjdhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK7hjhhubeh}(h] return-codeah ]h"]3. return codeah$]h&]uh1hhhhhhhhK/ubh)}(hhh](h)}(h 4. Helpersh]h 4. Helpers}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK;ubh)}(hSince sysctl knob is represented by a name and a value, sysctl specific BPF helpers focus on providing access to these properties:h]hSince sysctl knob is represented by a name and a value, sysctl specific BPF helpers focus on providing access to these properties:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK=hjhhubj)}(hhh](j)}(ht``bpf_sysctl_get_name()`` to get sysctl name as it is visible in ``/proc/sys`` into provided by BPF program buffer; h]h)}(hs``bpf_sysctl_get_name()`` to get sysctl name as it is visible in ``/proc/sys`` into provided by BPF program buffer;h](h)}(h``bpf_sysctl_get_name()``h]hbpf_sysctl_get_name()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj ubh( to get sysctl name as it is visible in }(hj hhhNhNubh)}(h ``/proc/sys``h]h /proc/sys}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj ubh% into provided by BPF program buffer;}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK@hjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h``bpf_sysctl_get_current_value()`` to get string value currently held by sysctl into provided by BPF program buffer. This helper is available on both ``read(2)`` from and ``write(2)`` to sysctl; h]h)}(h``bpf_sysctl_get_current_value()`` to get string value currently held by sysctl into provided by BPF program buffer. This helper is available on both ``read(2)`` from and ``write(2)`` to sysctl;h](h)}(h"``bpf_sysctl_get_current_value()``h]hbpf_sysctl_get_current_value()}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjDubht to get string value currently held by sysctl into provided by BPF program buffer. This helper is available on both }(hjDhhhNhNubh)}(h ``read(2)``h]hread(2)}(hjZhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjDubh from and }(hjDhhhNhNubh)}(h ``write(2)``h]hwrite(2)}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjDubh to sysctl;}(hjDhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKChj@ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h``bpf_sysctl_get_new_value()`` to get new string value currently being written to sysctl before actual write happens. This helper can be used only on ``ctx->write == 1``; h]h)}(h``bpf_sysctl_get_new_value()`` to get new string value currently being written to sysctl before actual write happens. This helper can be used only on ``ctx->write == 1``;h](h)}(h``bpf_sysctl_get_new_value()``h]hbpf_sysctl_get_new_value()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubhx to get new string value currently being written to sysctl before actual write happens. This helper can be used only on }(hjhhhNhNubh)}(h``ctx->write == 1``h]hctx->write == 1}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh;}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKGhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX``bpf_sysctl_set_new_value()`` to override new string value currently being written to sysctl before actual write happens. Sysctl value will be overridden starting from the current ``ctx->file_pos``. If the whole value has to be overridden BPF program can set ``file_pos`` to zero before calling to the helper. This helper can be used only on ``ctx->write == 1``. New string value set by the helper is treated and verified by kernel same way as an equivalent string passed by user space. h]h)}(hX``bpf_sysctl_set_new_value()`` to override new string value currently being written to sysctl before actual write happens. Sysctl value will be overridden starting from the current ``ctx->file_pos``. If the whole value has to be overridden BPF program can set ``file_pos`` to zero before calling to the helper. This helper can be used only on ``ctx->write == 1``. New string value set by the helper is treated and verified by kernel same way as an equivalent string passed by user space.h](h)}(h``bpf_sysctl_set_new_value()``h]hbpf_sysctl_set_new_value()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh to override new string value currently being written to sysctl before actual write happens. Sysctl value will be overridden starting from the current }(hjhhhNhNubh)}(h``ctx->file_pos``h]h ctx->file_pos}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh>. If the whole value has to be overridden BPF program can set }(hjhhhNhNubh)}(h ``file_pos``h]hfile_pos}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubhG to zero before calling to the helper. This helper can be used only on }(hjhhhNhNubh)}(h``ctx->write == 1``h]hctx->write == 1}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubh}. New string value set by the helper is treated and verified by kernel same way as an equivalent string passed by user space.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhK@hjhhubh)}(hBPF program sees sysctl value same way as user space does in proc filesystem, i.e. as a string. Since many sysctl values represent an integer or a vector of integers, the following helpers can be used to get numeric value from the string:h]hBPF program sees sysctl value same way as user space does in proc filesystem, i.e. as a string. Since many sysctl values represent an integer or a vector of integers, the following helpers can be used to get numeric value from the string:}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKShjhhubj)}(hhh](j)}(hj``bpf_strtol()`` to convert initial part of the string to long integer similar to user space `strtol(3)`_;h]h)}(hj``bpf_strtol()`` to convert initial part of the string to long integer similar to user space `strtol(3)`_;h](h)}(h``bpf_strtol()``h]h bpf_strtol()}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj9ubhM to convert initial part of the string to long integer similar to user space }(hj9hhhNhNubj)}(h `strtol(3)`_h]h strtol(3)}(hjOhhhNhNubah}(h]h ]h"]h$]h&]name strtol(3)j3http://man7.org/linux/man-pages/man3/strtol.3p.htmluh1jhj9jKubh;}(hj9hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKXhj5ubah}(h]h ]h"]h$]h&]uh1jhj2hhhhhNubj)}(hv``bpf_strtoul()`` to convert initial part of the string to unsigned long integer similar to user space `strtoul(3)`_; h]h)}(hu``bpf_strtoul()`` to convert initial part of the string to unsigned long integer similar to user space `strtoul(3)`_;h](h)}(h``bpf_strtoul()``h]h bpf_strtoul()}(hjxhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjtubhV to convert initial part of the string to unsigned long integer similar to user space }(hjthhhNhNubj)}(h `strtoul(3)`_h]h strtoul(3)}(hjhhhNhNubah}(h]h ]h"]h$]h&]name strtoul(3)j4http://man7.org/linux/man-pages/man3/strtoul.3p.htmluh1jhjtjKubh;}(hjthhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKZhjpubah}(h]h ]h"]h$]h&]uh1jhj2hhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKXhjhhubh)}(h>See `linux/bpf.h`_ for more details on helpers described here.h](hSee }(hjhhhNhNubj)}(h`linux/bpf.h`_h]h linux/bpf.h}(hjhhhNhNubah}(h]h ]h"]h$]h&]name linux/bpf.hjjuh1jhjjKubh, for more details on helpers described here.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK]hjhhubeh}(h]helpersah ]h"] 4. helpersah$]h&]uh1hhhhhhhhK;ubh)}(hhh](h)}(h 5. Examplesh]h 5. Examples}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK`ubh)}(hSee `test_sysctl_prog.c`_ for an example of BPF program in C that access sysctl name and value, parses string value to get vector of integers and uses the result to make decision whether to allow or deny access to sysctl.h](hSee }(hjhhhNhNubj)}(h`test_sysctl_prog.c`_h]htest_sysctl_prog.c}(hjhhhNhNubah}(h]h ]h"]h$]h&]nametest_sysctl_prog.cj:../../tools/testing/selftests/bpf/progs/test_sysctl_prog.cuh1jhjjKubh for an example of BPF program in C that access sysctl name and value, parses string value to get vector of integers and uses the result to make decision whether to allow or deny access to sysctl.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKbhjhhubeh}(h]examplesah ]h"] 5. examplesah$]h&]uh1hhhhhhhhK`ubh)}(hhh](h)}(h6. Notesh]h6. Notes}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKgubh)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL`` is intended to be used in **trusted** root environment, for example to monitor sysctl usage or catch unreasonable values an application, running as root in a separate cgroup, is trying to set.h](h)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj(ubh is intended to be used in }(hj(hhhNhNubhstrong)}(h **trusted**h]htrusted}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1j>hj(ubh root environment, for example to monitor sysctl usage or catch unreasonable values an application, running as root in a separate cgroup, is trying to set.}(hj(hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKihjhhubh)}(hXSince `task_dfl_cgroup(current)` is called at `sys_read` / `sys_write` time it may return results different from that at `sys_open` time, i.e. process that opened sysctl file in proc filesystem may differ from process that is trying to read from / write to it and two such processes may run in different cgroups, what means ``BPF_PROG_TYPE_CGROUP_SYSCTL`` should not be used as a security mechanism to limit sysctl usage.h](hSince }(hjXhhhNhNubhtitle_reference)}(h`task_dfl_cgroup(current)`h]htask_dfl_cgroup(current)}(hjbhhhNhNubah}(h]h ]h"]h$]h&]uh1j`hjXubh is called at }(hjXhhhNhNubja)}(h `sys_read`h]hsys_read}(hjthhhNhNubah}(h]h ]h"]h$]h&]uh1j`hjXubh / }(hjXhhhNhNubja)}(h `sys_write`h]h sys_write}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j`hjXubh3 time it may return results different from that at }(hjXhhhNhNubja)}(h `sys_open`h]hsys_open}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j`hjXubh time, i.e. process that opened sysctl file in proc filesystem may differ from process that is trying to read from / write to it and two such processes may run in different cgroups, what means }(hjXhhhNhNubh)}(h``BPF_PROG_TYPE_CGROUP_SYSCTL``h]hBPF_PROG_TYPE_CGROUP_SYSCTL}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjXubhB should not be used as a security mechanism to limit sysctl usage.}(hjXhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKmhjhhubh)}(hAs with any cgroup-bpf program additional care should be taken if an application running as root in a cgroup should not be allowed to detach/replace BPF program attached by administrator.h]hAs with any cgroup-bpf program additional care should be taken if an application running as root in a cgroup should not be allowed to detach/replace BPF program attached by administrator.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKthjhhubh)}(hLinksh]hLinks}hjsbah}(h]h ]h"]h$]h&]hhuh1hhjhhhhhKxubhtarget)}(h/.. _linux/bpf.h: ../../include/uapi/linux/bpf.hh]h}(h] linux-bpf-hah ]h"] linux/bpf.hah$]h&]jjuh1jhKyhjhhhhnj referencedKubj)}(hB.. _strtol(3): http://man7.org/linux/man-pages/man3/strtol.3p.htmlh]h}(h]strtol-3ah ]h"] strtol(3)ah$]h&]jj_uh1jhKzhjhhhhjKubj)}(hD.. _strtoul(3): http://man7.org/linux/man-pages/man3/strtoul.3p.htmlh]h}(h] strtoul-3ah ]h"] strtoul(3)ah$]h&]jjuh1jhK{hjhhhhjKubj)}(hU.. _test_sysctl_prog.c: ../../tools/testing/selftests/bpf/progs/test_sysctl_prog.ch]h}(h]test-sysctl-prog-cah ]h"]test_sysctl_prog.cah$]h&]jjuh1jhK|hjhhhhjKubeh}(h]notesah ]h"]6. notesah$]h&]uh1hhhhhhhhKgubeh}(h]bpf-prog-type-cgroup-sysctlah ]h"]bpf_prog_type_cgroup_sysctlah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjDerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}( linux/bpf.h](jje strtol(3)]jOa strtoul(3)]jatest_sysctl_prog.c]jaurefids}nameids}(jjjSjPjjjjjjjjjjjjjjjjjj u nametypes}(jjSjjjjjjjjjuh}(jhjPjjjVjjjjjjjjjjjjjjj ju footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.