Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Device access filtering in cgroup v2

KONDO Uchio
October 09, 2021

Device access filtering in cgroup v2

第15回 コンテナ技術の情報交換会@オンライン -> https://ct-study.connpass.com/event/223739/

KONDO Uchio

October 09, 2021
Tweet

More Decks by KONDO Uchio

Other Decks in Technology

Transcript

  1. ͳΜͰ΋#1'Ͱ΍Δ࣌୅ͳΜͩͳΝ
    6DIJP,POEP(.01FQBCP *OD
    DHSPVQWͷ
    σόΠεΞΫηεϑΟϧλ

    View full-size slide

  2. γχΞɾϓϦϯγύϧΤϯδχΞ
    ۙ౻ Ӊஐ࿕ / @udzura
    https://blog.udzura.jp/
    Uchio Kondo
    ٕज़෦ ٕज़ج൫νʔϜ/σʔλج൫νʔϜ @ GMOϖύϘ
    ΤϯδχΞΧϑΣʢ෱Ԭࢢ੺ẂנจԽձؗʣ αϙʔλʔ
    Duolingo Diamond Leaguer 💎
    * ޷͖ͳγεςϜίʔϧ: open_by_handle_at(2)
    * ޷͖ͳLinux Namespace: Time Namespace
    * ࠷ۙ͸ݴޠ࣮૷ʼOSࣗ࡞ʼBPFɺίϯςφɺͱ͍͏ײ͡...

    View full-size slide

  3. ͜Ε·Ͱͷ͋Β͢͡
    wF#1'ͱ͍͏ٕज़͕͋Δ
    w·ͨ͸Ͱݕࡧ
    wͳΜ΍ΧʔωϧͰ҆શߴ଎ʹϑΟϧλ͢Δٕज़

    View full-size slide

  4. F#1'ͷϓϩάϥϜλΠϓ
    wW
    w ଟ͗ͯ͢೺ѲͰ͖ͳ͍ͷͰ
    ୭͔෩དྷͷγϨϯʹྫ͑ͯ؆ܿʹڭ͑ͯཉ͍͠

    View full-size slide

  5. BPF_PROG_TYPE_CGROUP_DEVICE

    View full-size slide

  6. DHSPVQWͷσόΠεΞΫηε੍ݶ
    wEFWJDFTͱ͍͏αϒγεςϜ͕͋ͬͨ
    wಛఆͷϑΥʔϚοτͰEFWJDFTBMMPX΍EFWJDFTEFOZʹॻ͖ࠐΉ
    IUUQTXXXLFSOFMPSHEPD%PDVNFOUBUJPODHSPVQWEFWJDFTUYU

    View full-size slide

  7. DHSPVQWͰͷσόΠεΞΫηε੍ݶ
    wJOUFSGBDFpMF͕ͳ͘ͳΔʢʂʣ
    w#1'@$(3061@%&7*$&ͳϓϩάϥϜΛDHSPVQʹΞλον͢Δͱͷ͜ͱ
    wϓϩάϥϜͰΑΓࡉ੍͔͘ޚՄೳԿͳΒྫ͑͹ϩάΛ࢒ͨ͠Γ΋Ͱ͖Δ
    IUUQTXXXLFSOFMPSHEPD%PDVNFOUBUJPODHSPVQWUYUɹ

    View full-size slide

  8. σϞϓϩάϥϜ

    View full-size slide

  9. ϑΟϧλ͢ΔϓϩάϥϜʢ$Ͱॻ͘ʣ

    View full-size slide

  10. ϑΟϧλ͢ΔϓϩάϥϜʢ$Ͱॻ͘ʣ
    ηΫγϣϯ໊ͷࢦఆ
    EFWVSBOEPNͰ͋Ε͹Λฦ͢
    σϑΥϧτΛฦ͢

    View full-size slide

  11. Ϗϧυ͢Δ
    ͖ͬ͞ͷ$ίʔυ͕͜͏͍͏
    #1'ϓϩάϥϜʹίϯύΠϧ͞Ε͍ͯΔ

    View full-size slide

  12. Ξλον͢Δ
    w΄΅Χʔωϧಉࠝͷ
    αϯϓϧίʔυͦͷ
    ··Ͱ͕͢

    View full-size slide

  13. ΧϨϯτϓϩηε͕UFTUCQGʹॴଐ͍ͯ͠Δ
    WͳͷͰͷߦͷΈݟΔ

    EFWVSBOEPNʹΞΫηεͰ͖ͳ͍
    ʢͪͳΈʹSPPUͰ΋Ͱ͖·ͤΜʣ
    ଞͷσόΠε͸0,

    View full-size slide

  14. ͔͜͜Β༨ஊ

    View full-size slide

  15. 3VDZͱ͍͏ϓϩάϥϜΛ࡞ͬͨ
    w3VCZͷεΫϦϓτΛ௚઀#1'ʹ͠·͢
    SVDZίϚϯυͰΦϒδΣΫτϑΝΠϧΛ
    ੜ੒͠ɺಉ༷ʹϩʔυ͢Δͱ༗ޮʹͳΔ

    View full-size slide

  16. ࢓૊Έ
    Ruby Script mruby OpCodes BPF OpCodes BPF Object
    (ELF format)
    mruby Rucy transpiler
    wNSVCZͷ0Q$PEFΛ࡞ΓɺͦΕΛ#1'0Q$PEFʹ຋༁͢Δ

    View full-size slide

  17. ໋ྩηοτͷൺֱʢҰ෦ʣ
    wNSVCZ
    wϨδελϚγϯ7.ɺϨδελ͸ݸʢݸΛਪ঑ʣ
    w໋ྩ͸Մม௕ɺҾ਺͸3 3ɺ೚ҙͷϨδελΛฦ٫Մ
    w#1'
    wϨδελϚγϯ7.ɺϨδελ͸ݸ
    w໋ྩ͸ݪଇݻఆ௕ʢCJUɺඞཁͳ৔߹CJUʣ
    wҾ਺͸3 3ɺฦ٫஋͸ඞͣ3

    View full-size slide

  18. ॴײͱ͔
    w#1'ϓϩάϥϜͷதͰ΋ɺσόΠεΞΫηεϑΟϧλ͸
    খ͍࣮͞૷Ͱࢼ͢͜ͱ͕Ͱ͖ΔͷͰɺ
    3VDZͷ࣮૷Λ͢Δࡍʹςετઌͱͯ͠ศརͩͬͨɻ
    wΈͳ͞Μ΋σόΠεΞΫηεϑΟϧλ͔Β#1'࢝Ί·ͤΜ͔ʁ

    View full-size slide