1 .. SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
6 -------------------------------------------------------------------------------
7 tool for inspection and simple manipulation of eBPF progs
8 -------------------------------------------------------------------------------
12 .. include:: substitutions.rst
17 **bpftool** [*OPTIONS*] **cgroup** *COMMAND*
19 *OPTIONS* := { |COMMON_OPTIONS| | { **-f** | **--bpffs** } }
22 { **show** | **list** | **tree** | **attach** | **detach** | **help** }
27 | **bpftool** **cgroup** { **show** | **list** } *CGROUP* [**effective**]
28 | **bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**]
29 | **bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
30 | **bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
31 | **bpftool** **cgroup help**
33 | *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* }
34 | *ATTACH_TYPE* := { **cgroup_inet_ingress** | **cgroup_inet_egress** |
35 | **cgroup_inet_sock_create** | **cgroup_sock_ops** |
36 | **cgroup_device** | **cgroup_inet4_bind** | **cgroup_inet6_bind** |
37 | **cgroup_inet4_post_bind** | **cgroup_inet6_post_bind** |
38 | **cgroup_inet4_connect** | **cgroup_inet6_connect** |
39 | **cgroup_unix_connect** | **cgroup_inet4_getpeername** |
40 | **cgroup_inet6_getpeername** | **cgroup_unix_getpeername** |
41 | **cgroup_inet4_getsockname** | **cgroup_inet6_getsockname** |
42 | **cgroup_unix_getsockname** | **cgroup_udp4_sendmsg** |
43 | **cgroup_udp6_sendmsg** | **cgroup_unix_sendmsg** |
44 | **cgroup_udp4_recvmsg** | **cgroup_udp6_recvmsg** |
45 | **cgroup_unix_recvmsg** | **cgroup_sysctl** |
46 | **cgroup_getsockopt** | **cgroup_setsockopt** |
47 | **cgroup_inet_sock_release** }
48 | *ATTACH_FLAGS* := { **multi** | **override** }
52 **bpftool cgroup { show | list }** *CGROUP* [**effective**]
53 List all programs attached to the cgroup *CGROUP*.
55 Output will start with program ID followed by attach type,
56 attach flags and program name.
58 If **effective** is specified retrieve effective programs that
59 will execute for events within a cgroup. This includes
60 inherited along with attached ones.
62 **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**]
63 Iterate over all cgroups in *CGROUP_ROOT* and list all
64 attached programs. If *CGROUP_ROOT* is not specified,
65 bpftool uses cgroup v2 mountpoint.
67 The output is similar to the output of cgroup show/list
68 commands: it starts with absolute cgroup path, followed by
69 program ID, attach type, attach flags and program name.
71 If **effective** is specified retrieve effective programs that
72 will execute for events within a cgroup. This includes
73 inherited along with attached ones.
75 **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
76 Attach program *PROG* to the cgroup *CGROUP* with attach type
77 *ATTACH_TYPE* and optional *ATTACH_FLAGS*.
79 *ATTACH_FLAGS* can be one of: **override** if a sub-cgroup installs
80 some bpf program, the program in this cgroup yields to sub-cgroup
81 program; **multi** if a sub-cgroup installs some bpf program,
82 that cgroup program gets run in addition to the program in this
85 Only one program is allowed to be attached to a cgroup with
86 no attach flags or the **override** flag. Attaching another
87 program will release old program and attach the new one.
89 Multiple programs are allowed to be attached to a cgroup with
90 **multi**. They are executed in FIFO order (those that were
91 attached first, run first).
93 Non-default *ATTACH_FLAGS* are supported by kernel version 4.14
96 *ATTACH_TYPE* can be on of:
97 **ingress** ingress path of the inet socket (since 4.10);
98 **egress** egress path of the inet socket (since 4.10);
99 **sock_create** opening of an inet socket (since 4.10);
100 **sock_ops** various socket operations (since 4.12);
101 **device** device access (since 4.15);
102 **bind4** call to bind(2) for an inet4 socket (since 4.17);
103 **bind6** call to bind(2) for an inet6 socket (since 4.17);
104 **post_bind4** return from bind(2) for an inet4 socket (since 4.17);
105 **post_bind6** return from bind(2) for an inet6 socket (since 4.17);
106 **connect4** call to connect(2) for an inet4 socket (since 4.17);
107 **connect6** call to connect(2) for an inet6 socket (since 4.17);
108 **connect_unix** call to connect(2) for a unix socket (since 6.7);
109 **sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an
110 unconnected udp4 socket (since 4.18);
111 **sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an
112 unconnected udp6 socket (since 4.18);
113 **sendmsg_unix** call to sendto(2), sendmsg(2), sendmmsg(2) for
114 an unconnected unix socket (since 6.7);
115 **recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for
116 an unconnected udp4 socket (since 5.2);
117 **recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for
118 an unconnected udp6 socket (since 5.2);
119 **recvmsg_unix** call to recvfrom(2), recvmsg(2), recvmmsg(2) for
120 an unconnected unix socket (since 6.7);
121 **sysctl** sysctl access (since 5.2);
122 **getsockopt** call to getsockopt (since 5.3);
123 **setsockopt** call to setsockopt (since 5.3);
124 **getpeername4** call to getpeername(2) for an inet4 socket (since 5.8);
125 **getpeername6** call to getpeername(2) for an inet6 socket (since 5.8);
126 **getpeername_unix** call to getpeername(2) for a unix socket (since 6.7);
127 **getsockname4** call to getsockname(2) for an inet4 socket (since 5.8);
128 **getsockname6** call to getsockname(2) for an inet6 socket (since 5.8).
129 **getsockname_unix** call to getsockname(2) for a unix socket (since 6.7);
130 **sock_release** closing an userspace inet socket (since 5.9).
132 **bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
133 Detach *PROG* from the cgroup *CGROUP* and attach type
136 **bpftool prog help**
137 Print short help message.
141 .. include:: common_options.rst
144 Show file names of pinned programs.
149 | **# mount -t bpf none /sys/fs/bpf/**
150 | **# mkdir /sys/fs/cgroup/test.slice**
151 | **# bpftool prog load ./device_cgroup.o /sys/fs/bpf/prog**
152 | **# bpftool cgroup attach /sys/fs/cgroup/test.slice/ device id 1 allow_multi**
154 **# bpftool cgroup list /sys/fs/cgroup/test.slice/**
158 ID AttachType AttachFlags Name
159 1 device allow_multi bpf_prog1
162 | **# bpftool cgroup detach /sys/fs/cgroup/test.slice/ device id 1**
163 | **# bpftool cgroup list /sys/fs/cgroup/test.slice/**
167 ID AttachType AttachFlags Name