1BPFTOOL-CGROUP(8) BPFTOOL-CGROUP(8)
2
6 bpftool-cgroup - tool for inspection and simple manipulation of eBPF
7 progs
8
10 bpftool [OPTIONS] cgroup COMMAND
11 OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -f | --bpffs }
13 }
14 COMMANDS := { show | list | attach | detach | help }
16
18 bpftool cgroup { show | list } CGROUP
19 bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
20 bpftool cgroup detach CGROUP ATTACH_TYPE PROG
21 bpftool cgroup help
22 PROG := { id PROG_ID | pinned FILE | tag PROG_TAG }
24 ATTACH_TYPE := { ingress | egress | sock_create | sock_ops | device |
25 bind4 | bind6 | post_bind4 | post_bind6 | connect4 | connect6 |
26 sendmsg4 | sendmsg6 }
27 ATTACH_FLAGS := { multi | override }
28
31 bpftool cgroup { show | list } CGROUP
32 List all programs attached to the cgroup CGROUP.
33 Output will start with program ID followed by attach type,
35 attach flags and program name.
36 bpftool cgroup attach CGROUP ATTACH_TYPE PROG [ATTACH_FLAGS]
38 Attach program PROG to the cgroup CGROUP with attach type
39 ATTACH_TYPE and optional ATTACH_FLAGS.
40 ATTACH_FLAGS can be one of: override if a sub-cgroup installs
42 some bpf program, the program in this cgroup yields to
43 sub-cgroup program; multi if a sub-cgroup installs some bpf
44 program, that cgroup program gets run in addition to the pro‐
45 gram in this cgroup.
46 Only one program is allowed to be attached to a cgroup with
48 no attach flags or the override flag. Attaching another pro‐
49 gram will release old program and attach the new one.
50 Multiple programs are allowed to be attached to a cgroup with
52 multi. They are executed in FIFO order (those that were
53 attached first, run first).
54 Non-default ATTACH_FLAGS are supported by kernel version 4.14
56 and later.
57 ATTACH_TYPE can be on of: ingress ingress path of the inet
59 socket (since 4.10); egress egress path of the inet socket
60 (since 4.10); sock_create opening of an inet socket (since
61 4.10); sock_ops various socket operations (since 4.12);
62 device device access (since 4.15); bind4 call to bind(2) for
63 an inet4 socket (since 4.17); bind6 call to bind(2) for an
64 inet6 socket (since 4.17); post_bind4 return from bind(2) for
65 an inet4 socket (since 4.17); post_bind6 return from bind(2)
66 for an inet6 socket (since 4.17); connect4 call to connect(2)
67 for an inet4 socket (since 4.17); connect6 call to connect(2)
68 for an inet6 socket (since 4.17); sendmsg4 call to sendto(2),
69 sendmsg(2), sendmmsg(2) for an unconnected udp4 socket (since
70 4.18); sendmsg6 call to sendto(2), sendmsg(2), sendmmsg(2)
71 for an unconnected udp6 socket (since 4.18).
72 bpftool cgroup detach CGROUP ATTACH_TYPE PROG
74 Detach PROG from the cgroup CGROUP and attach type
75 ATTACH_TYPE.
76 bpftool prog help
78 Print short help message.
79
81 -h, --help
82 Print short generic help message (similar to bpftool help).
83 -v, --version
85 Print version number (similar to bpftool version).
86 -j, --json
88 Generate JSON output. For commands that cannot produce JSON,
89 this option has no effect.
90 -p, --pretty
92 Generate human-readable JSON output. Implies -j.
93 -f, --bpffs
95 Show file names of pinned programs.
96
98 # mount -t bpf none /sys/fs/bpf/
99 # mkdir /sys/fs/cgroup/test.slice
100 # bpftool prog load ./device_cgroup.o /sys/fs/bpf/prog
101 # bpftool cgroup attach /sys/fs/cgroup/test.slice/ device id 1 allow_multi
102 # bpftool cgroup list /sys/fs/cgroup/test.slice/
105 ID AttachType AttachFlags Name
107 1 device allow_multi bpf_prog1
108 # bpftool cgroup detach /sys/fs/cgroup/test.slice/ device id 1
110 # bpftool cgroup list /sys/fs/cgroup/test.slice/
111 ID AttachType AttachFlags Name
114
116 bpftool(8), bpftool-prog(8), bpftool-map(8)
117 BPFTOOL-CGROUP(8)