https://github.com/schu/bpf-cgroup-firewall-demo
https://github.com/schu/bpf-cgroup-firewall-demo
Last synced: 3 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/schu/bpf-cgroup-firewall-demo
- Owner: schu
- Created: 2019-01-13T14:37:21.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2019-05-17T20:25:23.000Z (about 6 years ago)
- Last Synced: 2025-01-28T16:32:46.855Z (5 months ago)
- Language: Go
- Size: 4.88 KB
- Stars: 2
- Watchers: 2
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
Demo code showing how to create and pin a `cgroup/skb` eBPF program (here done
with `load-firewall`) that can be loaded and used from a second program (here
done with `attach-firewall`)
```
go get -u github.com/iovisor/gobpf/elf
make
./load-firewall /sys/fs/bpf/cgroup-firewall-demo
mkdir /sys/fs/cgroup/unified/cgroup-firewall-demo
./attach-firewall /sys/fs/bpf/cgroup-firewall-demo /sys/fs/cgroup/unified/cgroup-firewall-demo/
```
Now open a new shell and add its pid to the cgroup:
```
echo PID > /sys/fs/cgroup/unified/cgroup-firewall-demo/cgroup.procs
```
Then run e.g. `ping -4 ipschwein.de` from the shell in the cgroup.
In the kernel's `trace_pipe` you should see a TODO message for each packet:
```
cat /sys/kernel/debug/tracing/trace_pipe
```