From: Michael Tremer <michael.tremer@ipfire.org>
Date: Fri, 29 May 2026 15:44:37 +0000 (+0000)
Subject: cgroups: Remove BPF program to permit access to block devices
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=31cdc5e6f9b8d6d04a86d26b7168e88d6d7e9370;p=pakfire.git

cgroups: Remove BPF program to permit access to block devices

This was an experiment to make loop devices accessible which we are no
longer interesting in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/pakfire/cgroup.c b/src/pakfire/cgroup.c
index e991fbd8..864c5247 100644
--- a/src/pakfire/cgroup.c
+++ b/src/pakfire/cgroup.c
@@ -21,14 +21,10 @@
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <linux/bpf.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <sys/types.h>
 
-// libbpf
-#include <bpf/bpf.h>
-
 #include <pakfire/ctx.h>
 #include <pakfire/cgroup.h>
 #include <pakfire/logging.h>
@@ -38,26 +34,6 @@
 
 #define BUFFER_SIZE			64 * 1024
 
-// Short form of mov, dst_reg = src_reg
-#define BPF_MOV64_IMM(DST, IMM) \
-	((struct bpf_insn){ \
-		.code = BPF_ALU64 | BPF_MOV | BPF_K, \
-		.dst_reg = DST, \
-		.src_reg = 0, \
-		.off = 0, \
-		.imm = IMM \
-	})
-
-// Program exit
-#define BPF_EXIT_INSN() \
-	((struct bpf_insn){ \
-		.code = BPF_JMP | BPF_EXIT, \
-		.dst_reg = 0, \
-		.src_reg = 0, \
-		.off = 0, \
-		.imm = 0 \
-	})
-
 struct pakfire_cgroup {
 	pakfire_ctx* ctx;
 	int nrefs;
@@ -89,43 +65,6 @@ static const char* pakfire_cgroup_path(pakfire_cgroup* cgroup) {
 	return cgroup->path;
 }
 
-static int pakfire_cgroup_setup_devices(pakfire_cgroup* cgroup) {
-	static char bpf_log_buffer[BPF_LOG_BUF_SIZE];
-
-	LIBBPF_OPTS(bpf_prog_load_opts, opts,
-		// Log Buffer
-		.log_buf  = bpf_log_buffer,
-		.log_size = sizeof(bpf_log_buffer),
-	);
-	int r;
-
-	struct bpf_insn program[] = {
-		BPF_MOV64_IMM(BPF_REG_0, 1), // r0 = 1
-		BPF_EXIT_INSN(),             // return r0
-	};
-
-	// Load the BPF program
-	r = bpf_prog_load(BPF_PROG_TYPE_CGROUP_DEVICE, NULL, "GPL",
-		program, sizeof(program) / sizeof(*program), &opts);
-	if (r < 0) {
-		ERROR(cgroup->ctx, "Could not load BPF program: %m\n");
-		return r;
-	}
-
-	// Store the file descriptor
-	cgroup->devicesfd = r;
-
-	// Attach the program to the cgroup
-	r = bpf_prog_attach(cgroup->devicesfd, cgroup->fd,
-		BPF_CGROUP_DEVICE, BPF_F_ALLOW_MULTI);
-	if (r) {
-		ERROR(cgroup->ctx, "Could not attach BPF program to cgroup: %m\n");
-		return r;
-	}
-
-	return 0;
-}
-
 static int pakfire_cgroup_open_root(pakfire_cgroup* cgroup) {
 	const char* path = "/sys/fs/cgroup";
 	int fd;
@@ -405,13 +344,6 @@ static int pakfire_cgroup_open(pakfire_cgroup** cgroup,
 	if (r < 0)
 		goto ERROR;
 
-#if 0
-	// Setup the devices filter
-	r = pakfire_cgroup_setup_devices(c);
-	if (r)
-		goto ERROR;
-#endif
-
 	DEBUG(c->ctx, "Created cgroup %s\n", pakfire_cgroup_path(c));
 
 	// Return the pointer