linux-kernel - [PATCH 3/3] Documentation: cgroup-v2: Document misc.mask interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251205005841.3942668-5-avagin@google.com>
Date: Fri,  5 Dec 2025 00:58:32 +0000
From: Andrei Vagin <avagin@...gle.com>
To: Kees Cook <kees@...nel.org>
Cc: linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, 
	linux-mm@...ck.org, cgroups@...r.kernel.org, criu@...ts.linux.dev, 
	Tejun Heo <tj@...nel.org>, Johannes Weiner <hannes@...xchg.org>, 
	"Michal Koutný" <mkoutny@...e.com>, Vipin Sharma <vipinsh@...gle.com>, Jonathan Corbet <corbet@....net>, 
	Andrei Vagin <avagin@...gle.com>
Subject: [PATCH 3/3] Documentation: cgroup-v2: Document misc.mask interface

Updates the cgroup-v2 documentation to include details about the newly
introduced 'misc.mask' interface. This interface, part of the 'misc'
cgroup controller, allows masking out hardware capabilities (AT_HWCAP,
AT_HWCAP2, AT_HWCAP3, AT_HWCAP4) reported to user-space processes within
a cgroup.

Signed-off-by: Andrei Vagin <avagin@...gle.com>
---
 Documentation/admin-guide/cgroup-v2.rst | 25 +++++++++++++++++++++++++
 Documentation/arch/arm64/elf_hwcaps.rst | 21 +++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index 4c072e85acdf..9d9d923e0d4e 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -2924,6 +2924,31 @@ Miscellaneous controller provides 3 interface files. If two misc resources (res_
         cgroup i.e. not hierarchical. The file modified event generated on
         this file reflects only the local events.
 
+Miscellaneous controller provides one interface file to control masks.
+
+  misc.mask
+	A read-write flat-keyed file shown in all cgroups. It allows
+	setting/reading the masks.  The file format is a series of lines, each
+	describing a mask of a specific mask type.
+
+	The file has the following format for each line::
+
+	  $NAME\t$LOCAL_MASK\t$EFFECTIVE_MASK
+
+	Where $NAME is the mask type name, $LOCAL_MASK is the mask for the
+	current cgroup, and $EFFECTIVE_MASK is the effective mask for the
+	current cgroup, which is a combination of the masks from the current
+	cgroup and all its ancestors.
+
+	To set a mask, write a string in the following format to the file::
+
+	  $NAME $MASK
+
+	For example, to set a mask for the mask_a type, you would write the
+	following to the file::
+
+	  # echo "mask_a 0x3000" > misc.mask
+
 Migration and Ownership
 ~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/Documentation/arch/arm64/elf_hwcaps.rst b/Documentation/arch/arm64/elf_hwcaps.rst
index a15df4956849..5526daff5d30 100644
--- a/Documentation/arch/arm64/elf_hwcaps.rst
+++ b/Documentation/arch/arm64/elf_hwcaps.rst
@@ -450,3 +450,24 @@ HWCAP3_LSFE
 
 For interoperation with userspace, the kernel guarantees that bits 62
 and 63 of AT_HWCAP will always be returned as 0.
+
+5. Masking hwcaps for a group of processes
+--------------------------------
+
+The misc cgroup controller provides a mechanism to mask hwcaps for a specific
+workload. This can be useful for limiting the features available to a
+containerized application.
+
+To mask hwcaps, you can write a mask to the ``misc.mask`` file in the cgroup
+directory. The mask is specified per AT_HWCAP entry (AT_HWCAP, AT_HWCAP2,
+AT_HWCAP3) in the format ``<HWCAP_ENTRY_NAME> <BITMASK>``.
+
+For example, to mask ``HWCAP_FP`` and ``HWCAP_ASIMD`` (which are represented by
+bits 0 and 1 of AT_HWCAP, so a mask of 0x3) for a workload, you would write the
+mask for AT_HWCAP to the ``misc.mask`` file in the new cgroup directory::
+
+    # echo "AT_HWCAP 0x3" > /sys/fs/cgroup/misc/my-workload/misc.mask
+
+Any new processes started in this cgroup will have the specified hwcaps
+masked. You can verify this by reading the ``misc.mask`` file, which will
+show the effective mask for the cgroup.
-- 
2.52.0.223.gf5cc29aaa4-goog