https://github.com/schu/bpf-cgroup-firewall-demo

https://github.com/schu/bpf-cgroup-firewall-demo

Last synced: 24 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/schu/bpf-cgroup-firewall-demo
• Owner: schu
• Created: 2019-01-13T14:37:21.000Z (almost 6 years ago)
• Default Branch: master
• Last Pushed: 2019-05-17T20:25:23.000Z (over 5 years ago)
• Last Synced: 2024-06-19T05:32:16.604Z (5 months ago)
• Language: Go
• Size: 4.88 KB
• Stars: 2
• Watchers: 2
• Forks: 2
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
Demo code showing how to create and pin a `cgroup/skb` eBPF program (here done

with `load-firewall`) that can be loaded and used from a second program (here

done with `attach-firewall`)

```

go get -u github.com/iovisor/gobpf/elf

make

./load-firewall /sys/fs/bpf/cgroup-firewall-demo

mkdir /sys/fs/cgroup/unified/cgroup-firewall-demo

./attach-firewall /sys/fs/bpf/cgroup-firewall-demo /sys/fs/cgroup/unified/cgroup-firewall-demo/

```

Now open a new shell and add its pid to the cgroup:

```

echo PID > /sys/fs/cgroup/unified/cgroup-firewall-demo/cgroup.procs

```

Then run e.g. `ping -4 ipschwein.de` from the shell in the cgroup.

In the kernel's `trace_pipe` you should see a TODO message for each packet:

```

cat /sys/kernel/debug/tracing/trace_pipe

```