Add cgroup v2 support

.github/workflows/ci.yml

@@ -9,11 +9,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install dependency
+      - name: Install apt dependency
         run: |
             sudo apt-get update
             sudo apt-get install -y libudev-dev
 
+      # Need to use nightly toolchain for eBPF
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rust-src
+
+      - name: Install bpf-linker
+        run: |
+          cargo install bpf-linker
+
       - name: Build
         run: cargo build --release
 

.gitignore

@@ -1,2 +1,3 @@
 /target
-/ott
+/cgroup_device_filter/target
+/ott

Cargo.toml

@@ -30,3 +30,11 @@ bollard = "0.16"
 futures = "0.3"
 rustix = { version = "0.38", features = ["fs", "stdio", "termios"] }
 bitflags = "2"
+aya = { git = "https://github.com/aya-rs/aya.git" }
+
+[build-dependencies]
+anyhow = { version = "1", features = ["backtrace"] }
+walkdir = "2"
+
+[workspace]
+exclude = ["cgroup_device_filter"]

README.md

@@ -25,10 +25,7 @@ Another concern is providing a container with well known paths for the devices.
 On bare-metal systems this would usually be achieved with a `SYMLINK` directive in a udev rule.
 This program tries to provide a similar functionality for containers, allowing you to specify symlinks for certain devices.
 
-## Limitations
-
-`container-hotplug` needs to be run as root and relies on `cgroup v1`. It does not support `cgroup v2`.
-On distributions with `cgroup v2`, you can switch back to `cgroup v1` by setting the [kernel parameter](https://wiki.ubuntu.com/Kernel/KernelBootParameters) `systemd.unified_cgroup_hierarchy=0`.
+This tool supports both cgroup v1 and v2.
 
 ## Example
 

build.rs

@@ -0,0 +1,35 @@
+use anyhow::{Context, Result};
+
+fn main() -> Result<()> {
+    // We need to rerun the build script if any files in the cgroup_device_filter change.
+    for entry in walkdir::WalkDir::new("cgroup_device_filter")
+        .into_iter()
+        .filter_entry(|entry| {
+            entry
+                .file_name()
+                .to_str()
+                .map(|s| s != "target")
+                .unwrap_or(true)
+        })
+    {
+        let entry = entry?;
+        if entry.file_type().is_file() {
+            println!(
+                "cargo:rerun-if-changed={}",
+                entry.path().to_str().context("file name not UTF-8")?
+            );
+        }
+    }
+
+    // Run cargo to compile the eBPF program.
+    let status = std::process::Command::new("cargo")
+        .current_dir("cgroup_device_filter")
+        .args(["build", "--release"])
+        .status()?;
+
+    if !status.success() {
+        anyhow::bail!("Failed to build eBPF program");
+    }
+
+    Ok(())
+}

cgroup_device_filter/.cargo/config.toml

@@ -0,0 +1,5 @@
+[build]
+target = "bpfel-unknown-none"
+
+[unstable]
+build-std = ["core"]