bpftool-cgroup(8)

1BPFTOOL-CGROUP(8)                                            BPFTOOL-CGROUP(8)
2
3
4

NAME

6       bpftool-cgroup  -  tool  for inspection and simple manipulation of eBPF
7       progs
8

SYNOPSIS

10          bpftool [OPTIONS] cgroup COMMAND
11
12          OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs  }
13          }
14
15          COMMANDS := { show | list | attach | detach | help }
16

MAP COMMANDS

18       bpftool cgroup { show | list } CGROUP
19       bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
20       bpftool cgroup detach CGROUP ATTACH_TYPE PROG
21       bpftool cgroup help
22
23       PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }
24       ATTACH_TYPE := { ingress | egress | sock_create | sock_ops | device }
25       ATTACH_FLAGS := { multi | override }
26
27

DESCRIPTION

29          bpftool cgroup { show | list } CGROUP
30                 List all programs attached to the cgroup CGROUP.
31
32                 Output  will  start  with program ID followed by attach type,
33                 attach flags and program name.
34
35          bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
36                 Attach program PROG to the cgroup  CGROUP  with  attach  type
37                 ATTACH_TYPE and optional ATTACH_FLAGS.
38
39                 ATTACH_FLAGS can be one of: override if a sub-cgroup installs
40                 some bpf program,  the  program  in  this  cgroup  yields  to
41                 sub-cgroup  program;  multi if a sub-cgroup installs some bpf
42                 program, that cgroup program gets run in addition to the pro‐
43                 gram in this cgroup.
44
45                 Only  one  program is allowed to be attached to a cgroup with
46                 no attach flags or the override flag. Attaching another  pro‐
47                 gram will release old program and attach the new one.
48
49                 Multiple programs are allowed to be attached to a cgroup with
50                 multi. They are executed  in  FIFO  order  (those  that  were
51                 attached first, run first).
52
53                 Non-default ATTACH_FLAGS are supported by kernel version 4.14
54                 and later.
55
56                 ATTACH_TYPE can be on of: ingress ingress path  of  the  inet
57                 socket  (since  4.10);  egress egress path of the inet socket
58                 (since 4.10); sock_create opening of an  inet  socket  (since
59                 4.10);  sock_ops  various  socket  operations  (since  4.12);
60                 device device access (since 4.15).
61
62          bpftool cgroup detach CGROUP ATTACH_TYPE PROG
63                 Detach  PROG  from  the  cgroup  CGROUP   and   attach   type
64                 ATTACH_TYPE.
65
66          bpftool prog help
67                 Print short help message.
68

OPTIONS

70          -h, --help
71                 Print short generic help message (similar to bpftool help).
72
73          -v, --version
74                 Print version number (similar to bpftool version).
75
76          -j, --json
77                 Generate  JSON output. For commands that cannot produce JSON,
78                 this option has no effect.
79
80          -p, --pretty
81                 Generate human-readable JSON output. Implies -j.
82
83          -f, --bpffs
84                 Show file names of pinned programs.
85

EXAMPLES

87       # mount -t bpf none /sys/fs/bpf/
88       # mkdir /sys/fs/cgroup/test.slice
89       # bpftool prog load ./device_cgroup.o /sys/fs/bpf/prog
90       # bpftool cgroup attach /sys/fs/cgroup/test.slice/ device id 1 allow_multi
91
92
93       # bpftool cgroup list /sys/fs/cgroup/test.slice/
94
95          ID       AttachType      AttachFlags     Name
96          1        device          allow_multi     bpf_prog1
97
98       # bpftool cgroup detach /sys/fs/cgroup/test.slice/ device id 1
99       # bpftool cgroup list /sys/fs/cgroup/test.slice/
100
101
102          ID       AttachType      AttachFlags     Name
103

NOTES

105       Attaching of programs to cgroups is not supported in RHEL 7.
106