)]}'
{
  "commit": "f307fa2cb4c935f7f1ff0aeb880c7b44fb9a642b",
  "tree": "dce575da97bf84e2fc907274202d228f8aa1a6c6",
  "parents": [
    "06d3e4c9f11afc849dc201ecf9ef7a43eeb1dddd"
  ],
  "author": {
    "name": "Andrey Ignatov",
    "email": "rdna@fb.com",
    "time": "Thu May 14 13:03:47 2020 -0700"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Thu May 14 18:41:07 2020 -0700"
  },
  "message": "bpf: Introduce bpf_sk_{, ancestor_}cgroup_id helpers\n\nWith having ability to lookup sockets in cgroup skb programs it becomes\nuseful to access cgroup id of retrieved sockets so that policies can be\nimplemented based on origin cgroup of such socket.\n\nFor example, a container running in a cgroup can have cgroup skb ingress\nprogram that can lookup peer socket that is sending packets to a process\ninside the container and decide whether those packets should be allowed\nor denied based on cgroup id of the peer.\n\nMore specifically such ingress program can implement intra-host policy\n\"allow incoming packets only from this same container and not from any\nother container on same host\" w/o relying on source IP addresses since\nquite often it can be the case that containers share same IP address on\nthe host.\n\nIntroduce two new helpers for this use-case: bpf_sk_cgroup_id() and\nbpf_sk_ancestor_cgroup_id().\n\nThese helpers are similar to existing bpf_skb_{,ancestor_}cgroup_id\nhelpers with the only difference that sk is used to get cgroup id\ninstead of skb, and share code with them.\n\nSee documentation in UAPI for more details.\n\nSigned-off-by: Andrey Ignatov \u003crdna@fb.com\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nAcked-by: Yonghong Song \u003cyhs@fb.com\u003e\nLink: https://lore.kernel.org/bpf/f5884981249ce911f63e9b57ecd5d7d19154ff39.1589486450.git.rdna@fb.com\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "85cfdffde18270e4009b033c96ab9d90f8f720ad",
      "old_mode": 33188,
      "old_path": "include/uapi/linux/bpf.h",
      "new_id": "146c742f1d491a91be76ea5fa06c615530f6a2be",
      "new_mode": 33188,
      "new_path": "include/uapi/linux/bpf.h"
    },
    {
      "type": "modify",
      "old_id": "a47dc5b9dad4fbd74bc86654ab9e10ffa3a37627",
      "old_mode": 33188,
      "old_path": "net/core/filter.c",
      "new_id": "5815902bb617fe85f6b47c04a5fecf42c2b5b18d",
      "new_mode": 33188,
      "new_path": "net/core/filter.c"
    },
    {
      "type": "modify",
      "old_id": "85cfdffde18270e4009b033c96ab9d90f8f720ad",
      "old_mode": 33188,
      "old_path": "tools/include/uapi/linux/bpf.h",
      "new_id": "146c742f1d491a91be76ea5fa06c615530f6a2be",
      "new_mode": 33188,
      "new_path": "tools/include/uapi/linux/bpf.h"
    }
  ]
}