cgroups: Remove BPF program to permit access to block devices

This was an experiment to make loop devices accessible which we are no
longer interesting in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/pakfire/cgroup.c b/src/pakfire/cgroup.c
index e991fbd82c4336f08650bbfdeca5349c551257a8..864c52470f9c990e18c0032951ec144c383574a1 100644 (file)
--- a/src/pakfire/cgroup.c
+++ b/src/pakfire/cgroup.c
@@ -21,14 +21,10 @@
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <linux/bpf.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <sys/types.h>
 
-// libbpf
-#include <bpf/bpf.h>
-
 #include <pakfire/ctx.h>
 #include <pakfire/cgroup.h>
 #include <pakfire/logging.h>
@@ -38,26 +34,6 @@
 
 #define BUFFER_SIZE                    64 * 1024
 
-// Short form of mov, dst_reg = src_reg
-#define BPF_MOV64_IMM(DST, IMM) \
-       ((struct bpf_insn){ \
-               .code = BPF_ALU64 | BPF_MOV | BPF_K, \
-               .dst_reg = DST, \
-               .src_reg = 0, \
-               .off = 0, \
-               .imm = IMM \
-       })
-
-// Program exit
-#define BPF_EXIT_INSN() \
-       ((struct bpf_insn){ \
-               .code = BPF_JMP | BPF_EXIT, \
-               .dst_reg = 0, \
-               .src_reg = 0, \
-               .off = 0, \
-               .imm = 0 \
-       })
-
 struct pakfire_cgroup {
        pakfire_ctx* ctx;
        int nrefs;
@@ -89,43 +65,6 @@ static const char* pakfire_cgroup_path(pakfire_cgroup* cgroup) {
        return cgroup->path;
 }
 
-static int pakfire_cgroup_setup_devices(pakfire_cgroup* cgroup) {
-       static char bpf_log_buffer[BPF_LOG_BUF_SIZE];
-
-       LIBBPF_OPTS(bpf_prog_load_opts, opts,
-               // Log Buffer
-               .log_buf  = bpf_log_buffer,
-               .log_size = sizeof(bpf_log_buffer),
-       );
-       int r;
-
-       struct bpf_insn program[] = {
-               BPF_MOV64_IMM(BPF_REG_0, 1), // r0 = 1
-               BPF_EXIT_INSN(),             // return r0
-       };
-
-       // Load the BPF program
-       r = bpf_prog_load(BPF_PROG_TYPE_CGROUP_DEVICE, NULL, "GPL",
-               program, sizeof(program) / sizeof(*program), &opts);
-       if (r < 0) {
-               ERROR(cgroup->ctx, "Could not load BPF program: %m\n");
-               return r;
-       }
-
-       // Store the file descriptor
-       cgroup->devicesfd = r;
-
-       // Attach the program to the cgroup
-       r = bpf_prog_attach(cgroup->devicesfd, cgroup->fd,
-               BPF_CGROUP_DEVICE, BPF_F_ALLOW_MULTI);
-       if (r) {
-               ERROR(cgroup->ctx, "Could not attach BPF program to cgroup: %m\n");
-               return r;
-       }
-
-       return 0;
-}
-
 static int pakfire_cgroup_open_root(pakfire_cgroup* cgroup) {
        const char* path = "/sys/fs/cgroup";
        int fd;
@@ -405,13 +344,6 @@ static int pakfire_cgroup_open(pakfire_cgroup** cgroup,
        if (r < 0)
                goto ERROR;
 
-#if 0
-       // Setup the devices filter
-       r = pakfire_cgroup_setup_devices(c);
-       if (r)
-               goto ERROR;
-#endif
-
        DEBUG(c->ctx, "Created cgroup %s\n", pakfire_cgroup_path(c));
 
        // Return the pointer