| From: |
| Alexander Mikhalitsyn <aleksandr.mikhalitsyn-AT-canonical.com> |
| To: |
| kuniyu-AT-amazon.com |
| Subject: |
| [PATCH net-next 0/4] Add getsockopt(SO_PEERCGROUPID) and fdinfo API to retreive socket's peer cgroup id |
| Date: |
| Sun, 09 Mar 2025 14:28:11 +0100 |
| Message-ID: |
| <20250309132821.103046-1-aleksandr.mikhalitsyn@canonical.com> |
| Cc: |
| Alexander Mikhalitsyn <aleksandr.mikhalitsyn-AT-canonical.com>, linux-kernel-AT-vger.kernel.org, netdev-AT-vger.kernel.org, cgroups-AT-vger.kernel.org, "David S. Miller" <davem-AT-davemloft.net>, Eric Dumazet <edumazet-AT-google.com>, Jakub Kicinski <kuba-AT-kernel.org>, Paolo Abeni <pabeni-AT-redhat.com>, Willem de Bruijn <willemb-AT-google.com>, Leon Romanovsky <leon-AT-kernel.org>, Arnd Bergmann <arnd-AT-arndb.de>, Christian Brauner <brauner-AT-kernel.org>, Lennart Poettering <mzxreary-AT-0pointer.de>, Luca Boccassi <bluca-AT-debian.org>, Tejun Heo <tj-AT-kernel.org>, Johannes Weiner <hannes-AT-cmpxchg.org>, Michal Koutný <mkoutny-AT-suse.com>, Shuah Khan <shuah-AT-kernel.org> |
| Archive-link: |
| Article |
1. Add socket cgroup id and socket's peer cgroup id in socket's fdinfo
2. Add SO_PEERCGROUPID which allows to retrieve socket's peer cgroup id
3. Add SO_PEERCGROUPID kselftest
Generally speaking, this API allows race-free resolution of socket's peer cgroup id.
Currently, to do that SCM_CREDENTIALS/SCM_PIDFD -> pid -> /proc/<pid>/cgroup sequence
is used which is racy.
As we don't add any new state to the socket itself there is no potential locking issues
or performance problems. We use already existing sk->sk_cgrp_data.
We already have analogical interfaces to retrieve this
information:
- inet_diag: INET_DIAG_CGROUP_ID
- eBPF: bpf_sk_cgroup_id
Having getsockopt() interface makes sense for many applications, because using eBPF is
not always an option, while inet_diag has obvious complexety and performance drawbacks
if we only want to get this specific info for one specific socket.
Idea comes from UAPI kernel group:
https://uapi-group.org/kernel-features/
Huge thanks to Christian Brauner, Lennart Poettering and Luca Boccassi for proposing
and exchanging ideas about this.
Git tree:
https://github.com/mihalicyn/linux/tree/so_peercgroupid
Cc: linux-kernel@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: cgroups@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Kuniyuki Iwashima <kuniyu@amazon.com>
Cc: Lennart Poettering <mzxreary@0pointer.de>
Cc: Luca Boccassi <bluca@debian.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Michal Koutný" <mkoutny@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Alexander Mikhalitsyn (4):
net: unix: print cgroup_id and peer_cgroup_id in fdinfo
net: core: add getsockopt SO_PEERCGROUPID
tools/testing/selftests/cgroup/cgroup_util: add cg_get_id helper
tools/testing/selftests/cgroup: add test for SO_PEERCGROUPID
arch/alpha/include/uapi/asm/socket.h | 2 +
arch/mips/include/uapi/asm/socket.h | 2 +
arch/parisc/include/uapi/asm/socket.h | 2 +
arch/sparc/include/uapi/asm/socket.h | 2 +
include/uapi/asm-generic/socket.h | 2 +
net/core/sock.c | 17 +
net/unix/af_unix.c | 84 +++++
tools/include/uapi/asm-generic/socket.h | 2 +
tools/testing/selftests/cgroup/Makefile | 2 +
tools/testing/selftests/cgroup/cgroup_util.c | 15 +
tools/testing/selftests/cgroup/cgroup_util.h | 2 +
.../selftests/cgroup/test_so_peercgroupid.c | 308 ++++++++++++++++++
12 files changed, 440 insertions(+)
create mode 100644 tools/testing/selftests/cgroup/test_so_peercgroupid.c
--
2.43.0
