4 -------------------------------------------------------------------------------
5 tool for inspection and simple manipulation of eBPF progs
6 -------------------------------------------------------------------------------
13 **bpftool** [*OPTIONS*] **cgroup** *COMMAND*
15 *OPTIONS* := { { **-j** | **--json** } [{ **-p** | **--pretty** }] | { **-d** | **--debug** } |
16 { **-f** | **--bpffs** } }
19 { **show** | **list** | **tree** | **attach** | **detach** | **help** }
24 | **bpftool** **cgroup** { **show** | **list** } *CGROUP* [**effective**]
25 | **bpftool** **cgroup tree** [*CGROUP_ROOT*] [**effective**]
26 | **bpftool** **cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
27 | **bpftool** **cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
28 | **bpftool** **cgroup help**
30 | *PROG* := { **id** *PROG_ID* | **pinned** *FILE* | **tag** *PROG_TAG* }
31 | *ATTACH_TYPE* := { **ingress** | **egress** | **sock_create** | **sock_ops** | **device** |
32 | **bind4** | **bind6** | **post_bind4** | **post_bind6** | **connect4** | **connect6** |
33 | **getpeername4** | **getpeername6** | **getsockname4** | **getsockname6** | **sendmsg4** |
34 | **sendmsg6** | **recvmsg4** | **recvmsg6** | **sysctl** | **getsockopt** | **setsockopt** |
36 | *ATTACH_FLAGS* := { **multi** | **override** }
40 **bpftool cgroup { show | list }** *CGROUP* [**effective**]
41 List all programs attached to the cgroup *CGROUP*.
43 Output will start with program ID followed by attach type,
44 attach flags and program name.
46 If **effective** is specified retrieve effective programs that
47 will execute for events within a cgroup. This includes
48 inherited along with attached ones.
50 **bpftool cgroup tree** [*CGROUP_ROOT*] [**effective**]
51 Iterate over all cgroups in *CGROUP_ROOT* and list all
52 attached programs. If *CGROUP_ROOT* is not specified,
53 bpftool uses cgroup v2 mountpoint.
55 The output is similar to the output of cgroup show/list
56 commands: it starts with absolute cgroup path, followed by
57 program ID, attach type, attach flags and program name.
59 If **effective** is specified retrieve effective programs that
60 will execute for events within a cgroup. This includes
61 inherited along with attached ones.
63 **bpftool cgroup attach** *CGROUP* *ATTACH_TYPE* *PROG* [*ATTACH_FLAGS*]
64 Attach program *PROG* to the cgroup *CGROUP* with attach type
65 *ATTACH_TYPE* and optional *ATTACH_FLAGS*.
67 *ATTACH_FLAGS* can be one of: **override** if a sub-cgroup installs
68 some bpf program, the program in this cgroup yields to sub-cgroup
69 program; **multi** if a sub-cgroup installs some bpf program,
70 that cgroup program gets run in addition to the program in this
73 Only one program is allowed to be attached to a cgroup with
74 no attach flags or the **override** flag. Attaching another
75 program will release old program and attach the new one.
77 Multiple programs are allowed to be attached to a cgroup with
78 **multi**. They are executed in FIFO order (those that were
79 attached first, run first).
81 Non-default *ATTACH_FLAGS* are supported by kernel version 4.14
84 *ATTACH_TYPE* can be on of:
85 **ingress** ingress path of the inet socket (since 4.10);
86 **egress** egress path of the inet socket (since 4.10);
87 **sock_create** opening of an inet socket (since 4.10);
88 **sock_ops** various socket operations (since 4.12);
89 **device** device access (since 4.15);
90 **bind4** call to bind(2) for an inet4 socket (since 4.17);
91 **bind6** call to bind(2) for an inet6 socket (since 4.17);
92 **post_bind4** return from bind(2) for an inet4 socket (since 4.17);
93 **post_bind6** return from bind(2) for an inet6 socket (since 4.17);
94 **connect4** call to connect(2) for an inet4 socket (since 4.17);
95 **connect6** call to connect(2) for an inet6 socket (since 4.17);
96 **sendmsg4** call to sendto(2), sendmsg(2), sendmmsg(2) for an
97 unconnected udp4 socket (since 4.18);
98 **sendmsg6** call to sendto(2), sendmsg(2), sendmmsg(2) for an
99 unconnected udp6 socket (since 4.18);
100 **recvmsg4** call to recvfrom(2), recvmsg(2), recvmmsg(2) for
101 an unconnected udp4 socket (since 5.2);
102 **recvmsg6** call to recvfrom(2), recvmsg(2), recvmmsg(2) for
103 an unconnected udp6 socket (since 5.2);
104 **sysctl** sysctl access (since 5.2);
105 **getsockopt** call to getsockopt (since 5.3);
106 **setsockopt** call to setsockopt (since 5.3);
107 **getpeername4** call to getpeername(2) for an inet4 socket (since 5.8);
108 **getpeername6** call to getpeername(2) for an inet6 socket (since 5.8);
109 **getsockname4** call to getsockname(2) for an inet4 socket (since 5.8);
110 **getsockname6** call to getsockname(2) for an inet6 socket (since 5.8).
111 **sock_release** closing an userspace inet socket (since 5.9).
113 **bpftool cgroup detach** *CGROUP* *ATTACH_TYPE* *PROG*
114 Detach *PROG* from the cgroup *CGROUP* and attach type
117 **bpftool prog help**
118 Print short help message.
122 .. include:: common_options.rst
125 Show file names of pinned programs.
130 | **# mount -t bpf none /sys/fs/bpf/**
131 | **# mkdir /sys/fs/cgroup/test.slice**
132 | **# bpftool prog load ./device_cgroup.o /sys/fs/bpf/prog**
133 | **# bpftool cgroup attach /sys/fs/cgroup/test.slice/ device id 1 allow_multi**
135 **# bpftool cgroup list /sys/fs/cgroup/test.slice/**
139 ID AttachType AttachFlags Name
140 1 device allow_multi bpf_prog1
143 | **# bpftool cgroup detach /sys/fs/cgroup/test.slice/ device id 1**
144 | **# bpftool cgroup list /sys/fs/cgroup/test.slice/**
148 ID AttachType AttachFlags Name