Add an interface to the misc cgroup controller that allows masking out
hardware capabilities (AT_HWCAP) reported to user-space processes. This
provides a mechanism to restrict the features a containerized
application can see.

The new "misc.mask" cgroup file allows users to specify masks for
AT_HWCAP, AT_HWCAP2, AT_HWCAP3, and AT_HWCAP4.

The output of "misc.mask" is extended to display the effective mask,
which is a combination of the masks from the current cgroup and all its
ancestors.

Signed-off-by: Andrei Vagin <avagin@google.com>
---
 fs/binfmt_elf.c             |  24 +++++--
 include/linux/misc_cgroup.h |  25 +++++++
 kernel/cgroup/misc.c        | 126 ++++++++++++++++++++++++++++++++++++
 3 files changed, 171 insertions(+), 4 deletions(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 3eb734c192e9..59137784e81d 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -47,6 +47,7 @@
 #include <linux/dax.h>
 #include <linux/uaccess.h>
 #include <uapi/linux/rseq.h>
+#include <linux/misc_cgroup.h>
 #include <asm/param.h>
 #include <asm/page.h>
 
@@ -182,6 +183,21 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
 	int ei_index;
 	const struct cred *cred = current_cred();
 	struct vm_area_struct *vma;
+	struct misc_cg *misc_cg;
+	u64 hwcap_mask[4] = {0, 0, 0, 0};
+
+	misc_cg = get_current_misc_cg();
+	misc_cg_get_mask(MISC_CG_MASK_HWCAP, misc_cg, &hwcap_mask[0]);
+#ifdef ELF_HWCAP2
+	misc_cg_get_mask(MISC_CG_MASK_HWCAP2, misc_cg, &hwcap_mask[1]);
+#endif
+#ifdef ELF_HWCAP3
+	misc_cg_get_mask(MISC_CG_MASK_HWCAP3, misc_cg, &hwcap_mask[2]);
+#endif
+#ifdef ELF_HWCAP4
+	misc_cg_get_mask(MISC_CG_MASK_HWCAP4, misc_cg, &hwcap_mask[3]);
+#endif
+	put_misc_cg(misc_cg);
 
 	/*
 	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
@@ -246,7 +262,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
 	 */
 	ARCH_DLINFO;
 #endif
-	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
+	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP & ~hwcap_mask[0]);
 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 	NEW_AUX_ENT(AT_PHDR, phdr_addr);
@@ -264,13 +280,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
 	NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
 	NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
 #ifdef ELF_HWCAP2
-	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
+	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2 & ~hwcap_mask[1]);
 #endif
 #ifdef ELF_HWCAP3
-	NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3);
+	NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3 & ~hwcap_mask[2]);
 #endif
 #ifdef ELF_HWCAP4
-	NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4);
+	NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4 & ~hwcap_mask[3]);
 #endif
 	NEW_AUX_ENT(AT_EXECFN, bprm->exec);
 	if (k_platform) {
diff --git a/include/linux/misc_cgroup.h b/include/linux/misc_cgroup.h
index 0cb36a3ffc47..cff830c238fb 100644
--- a/include/linux/misc_cgroup.h
+++ b/include/linux/misc_cgroup.h
@@ -8,6 +8,8 @@
 #ifndef _MISC_CGROUP_H_
 #define _MISC_CGROUP_H_
 
+#include <linux/elf.h>
+
 /**
  * enum misc_res_type - Types of misc cgroup entries supported by the host.
  */
@@ -26,6 +28,20 @@ enum misc_res_type {
 	MISC_CG_RES_TYPES
 };
 
+enum misc_mask_type {
+	MISC_CG_MASK_HWCAP,
+#ifdef ELF_HWCAP2
+	MISC_CG_MASK_HWCAP2,
+#endif
+#ifdef ELF_HWCAP3
+	MISC_CG_MASK_HWCAP3,
+#endif
+#ifdef ELF_HWCAP4
+	MISC_CG_MASK_HWCAP4,
+#endif
+	MISC_CG_MASK_TYPES
+};
+
 struct misc_cg;
 
 #ifdef CONFIG_CGROUP_MISC
@@ -62,12 +78,15 @@ struct misc_cg {
 	struct cgroup_file events_local_file;
 
 	struct misc_res res[MISC_CG_RES_TYPES];
+	u64 mask[MISC_CG_MASK_TYPES];
 };
 
 int misc_cg_set_capacity(enum misc_res_type type, u64 capacity);
 int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
 void misc_cg_uncharge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
 
+int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask);
+
 /**
  * css_misc() - Get misc cgroup from the css.
  * @css: cgroup subsys state object.
@@ -134,5 +153,11 @@ static inline void put_misc_cg(struct misc_cg *cg)
 {
 }
 
+static inline int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
+{
+	*pmask = 0;
+	return 0;
+}
+
 #endif /* CONFIG_CGROUP_MISC */
 #endif /* _MISC_CGROUP_H_ */
diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c
index 6a01d91ea4cb..d1386d86060f 100644
--- a/kernel/cgroup/misc.c
+++ b/kernel/cgroup/misc.c
@@ -30,6 +30,19 @@ static const char *const misc_res_name[] = {
 #endif
 };
 
+static const char *const misc_mask_name[] = {
+	"AT_HWCAP",
+#ifdef ELF_HWCAP2
+	"AT_HWCAP2",
+#endif
+#ifdef ELF_HWCAP3
+	"AT_HWCAP3",
+#endif
+#ifdef ELF_HWCAP4
+	"AT_HWCAP4",
+#endif
+};
+
 /* Root misc cgroup */
 static struct misc_cg root_cg;
 
@@ -71,6 +84,11 @@ static inline bool valid_type(enum misc_res_type type)
 	return type >= 0 && type < MISC_CG_RES_TYPES;
 }
 
+static inline bool valid_mask_type(enum misc_mask_type type)
+{
+	return type >= 0 && type < MISC_CG_MASK_TYPES;
+}
+
 /**
  * misc_cg_set_capacity() - Set the capacity of the misc cgroup res.
  * @type: Type of the misc res.
@@ -391,6 +409,109 @@ static int misc_events_local_show(struct seq_file *sf, void *v)
 	return __misc_events_show(sf, true);
 }
 
+/**
+ * misc_cg_get_mask() - Get the mask of the specified type.
+ * @type: The misc mask type.
+ * @cg: The misc cgroup.
+ * @pmask: Pointer to the resulting mask.
+ *
+ * This function calculates the effective mask for a given cgroup by walking up
+ * the hierarchy and ORing the masks from all parent cgroupfs. The final result
+ * is stored in the location pointed to by @pmask.
+ *
+ * Context: Any context.
+ * Return: 0 on success, -EINVAL if @type is invalid.
+ */
+int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
+{
+	struct misc_cg *i;
+	u64 mask = 0;
+
+	if (!(valid_mask_type(type)))
+		return -EINVAL;
+
+	for (i = cg; i; i = parent_misc(i))
+		mask |= READ_ONCE(i->mask[type]);
+
+	*pmask = mask;
+	return 0;
+}
+
+/**
+ * misc_cg_mask_show() - Show the misc cgroup masks.
+ * @sf: Interface file
+ * @v: Arguments passed
+ *
+ * Context: Any context.
+ * Return: 0 to denote successful print.
+ */
+static int misc_cg_mask_show(struct seq_file *sf, void *v)
+{
+	struct misc_cg *cg = css_misc(seq_css(sf));
+	int i;
+
+	for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
+		u64 rval, val = READ_ONCE(cg->mask[i]);
+
+		misc_cg_get_mask(i, cg, &rval);
+		seq_printf(sf, "%s\t%#016llx\t%#016llx\n", misc_mask_name[i], val, rval);
+	}
+
+	return 0;
+}
+
+/**
+ * misc_cg_mask_write() - Update the mask of the specified type.
+ * @of: Handler for the file.
+ * @buf: The buffer containing the user's input.
+ * @nbytes: The number of bytes in @buf.
+ * @off: The offset in the file.
+ *
+ * This function parses a user-provided string to update a mask.
+ * The expected format is "<mask_name> <value>", for example:
+ *
+ * echo "AT_HWCAP 0xf00" > misc.mask
+ *
+ * Context: Process context.
+ * Return: The number of bytes processed on success, or a negative error code
+ * on failure.
+ */
+static ssize_t misc_cg_mask_write(struct kernfs_open_file *of, char *buf,
+				 size_t nbytes, loff_t off)
+{
+	struct misc_cg *cg;
+	u64 max;
+	int ret = 0, i;
+	enum misc_mask_type type = MISC_CG_MASK_TYPES;
+	char *token;
+
+	buf = strstrip(buf);
+	token = strsep(&buf, " ");
+
+	if (!token || !buf)
+		return -EINVAL;
+
+	for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
+		if (!strcmp(misc_mask_name[i], token)) {
+			type = i;
+			break;
+		}
+	}
+
+	if (type == MISC_CG_MASK_TYPES)
+		return -EINVAL;
+
+	ret = kstrtou64(buf, 0, &max);
+	if (ret)
+		return ret;
+
+	cg = css_misc(of_css(of));
+
+	WRITE_ONCE(cg->mask[type], max);
+
+	return nbytes;
+}
+
 /* Misc cgroup interface files */
 static struct cftype misc_cg_files[] = {
 	{
@@ -424,6 +545,11 @@ static struct cftype misc_cg_files[] = {
 		.file_offset = offsetof(struct misc_cg, events_local_file),
 		.seq_show = misc_events_local_show,
 	},
+	{
+		.name = "mask",
+		.write = misc_cg_mask_write,
+		.seq_show = misc_cg_mask_show,
+	},
 	{}
 };
 
-- 
2.52.0.223.gf5cc29aaa4-goog

On 2025/12/5 8:58, Andrei Vagin wrote:
> Add an interface to the misc cgroup controller that allows masking out
> hardware capabilities (AT_HWCAP) reported to user-space processes. This
> provides a mechanism to restrict the features a containerized
> application can see.
> 
> The new "misc.mask" cgroup file allows users to specify masks for
> AT_HWCAP, AT_HWCAP2, AT_HWCAP3, and AT_HWCAP4.
> 
> The output of "misc.mask" is extended to display the effective mask,
> which is a combination of the masks from the current cgroup and all its
> ancestors.
> 
> Signed-off-by: Andrei Vagin <avagin@google.com>
> ---
>  fs/binfmt_elf.c             |  24 +++++--
>  include/linux/misc_cgroup.h |  25 +++++++
>  kernel/cgroup/misc.c        | 126 ++++++++++++++++++++++++++++++++++++
>  3 files changed, 171 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 3eb734c192e9..59137784e81d 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -47,6 +47,7 @@
>  #include <linux/dax.h>
>  #include <linux/uaccess.h>
>  #include <uapi/linux/rseq.h>
> +#include <linux/misc_cgroup.h>
>  #include <asm/param.h>
>  #include <asm/page.h>
>  
> @@ -182,6 +183,21 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
>  	int ei_index;
>  	const struct cred *cred = current_cred();
>  	struct vm_area_struct *vma;
> +	struct misc_cg *misc_cg;
> +	u64 hwcap_mask[4] = {0, 0, 0, 0};
> +
> +	misc_cg = get_current_misc_cg();
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP, misc_cg, &hwcap_mask[0]);
> +#ifdef ELF_HWCAP2
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP2, misc_cg, &hwcap_mask[1]);
> +#endif
> +#ifdef ELF_HWCAP3
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP3, misc_cg, &hwcap_mask[2]);
> +#endif
> +#ifdef ELF_HWCAP4
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP4, misc_cg, &hwcap_mask[3]);
> +#endif
> +	put_misc_cg(misc_cg);
>  
>  	/*
>  	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
> @@ -246,7 +262,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
>  	 */
>  	ARCH_DLINFO;
>  #endif
> -	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
> +	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP & ~hwcap_mask[0]);
>  	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
>  	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
>  	NEW_AUX_ENT(AT_PHDR, phdr_addr);
> @@ -264,13 +280,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
>  	NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
>  	NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
>  #ifdef ELF_HWCAP2
> -	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
> +	NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2 & ~hwcap_mask[1]);
>  #endif
>  #ifdef ELF_HWCAP3
> -	NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3);
> +	NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3 & ~hwcap_mask[2]);
>  #endif
>  #ifdef ELF_HWCAP4
> -	NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4);
> +	NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4 & ~hwcap_mask[3]);
>  #endif
>  	NEW_AUX_ENT(AT_EXECFN, bprm->exec);
>  	if (k_platform) {
> diff --git a/include/linux/misc_cgroup.h b/include/linux/misc_cgroup.h
> index 0cb36a3ffc47..cff830c238fb 100644
> --- a/include/linux/misc_cgroup.h
> +++ b/include/linux/misc_cgroup.h
> @@ -8,6 +8,8 @@
>  #ifndef _MISC_CGROUP_H_
>  #define _MISC_CGROUP_H_
>  
> +#include <linux/elf.h>
> +
>  /**
>   * enum misc_res_type - Types of misc cgroup entries supported by the host.
>   */
> @@ -26,6 +28,20 @@ enum misc_res_type {
>  	MISC_CG_RES_TYPES
>  };
>  
> +enum misc_mask_type {
> +	MISC_CG_MASK_HWCAP,
> +#ifdef ELF_HWCAP2
> +	MISC_CG_MASK_HWCAP2,
> +#endif
> +#ifdef ELF_HWCAP3
> +	MISC_CG_MASK_HWCAP3,
> +#endif
> +#ifdef ELF_HWCAP4
> +	MISC_CG_MASK_HWCAP4,
> +#endif
> +	MISC_CG_MASK_TYPES
> +};
> +
>  struct misc_cg;
>  
>  #ifdef CONFIG_CGROUP_MISC
> @@ -62,12 +78,15 @@ struct misc_cg {
>  	struct cgroup_file events_local_file;
>  
>  	struct misc_res res[MISC_CG_RES_TYPES];
> +	u64 mask[MISC_CG_MASK_TYPES];
>  };
>  
>  int misc_cg_set_capacity(enum misc_res_type type, u64 capacity);
>  int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
>  void misc_cg_uncharge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
>  
> +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask);
> +
>  /**
>   * css_misc() - Get misc cgroup from the css.
>   * @css: cgroup subsys state object.
> @@ -134,5 +153,11 @@ static inline void put_misc_cg(struct misc_cg *cg)
>  {
>  }
>  
> +static inline int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> +{
> +	*pmask = 0;
> +	return 0;
> +}
> +
>  #endif /* CONFIG_CGROUP_MISC */
>  #endif /* _MISC_CGROUP_H_ */
> diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c
> index 6a01d91ea4cb..d1386d86060f 100644
> --- a/kernel/cgroup/misc.c
> +++ b/kernel/cgroup/misc.c
> @@ -30,6 +30,19 @@ static const char *const misc_res_name[] = {
>  #endif
>  };
>  
> +static const char *const misc_mask_name[] = {
> +	"AT_HWCAP",
> +#ifdef ELF_HWCAP2
> +	"AT_HWCAP2",
> +#endif
> +#ifdef ELF_HWCAP3
> +	"AT_HWCAP3",
> +#endif
> +#ifdef ELF_HWCAP4
> +	"AT_HWCAP4",
> +#endif
> +};
> +
>  /* Root misc cgroup */
>  static struct misc_cg root_cg;
>  
> @@ -71,6 +84,11 @@ static inline bool valid_type(enum misc_res_type type)
>  	return type >= 0 && type < MISC_CG_RES_TYPES;
>  }
>  
> +static inline bool valid_mask_type(enum misc_mask_type type)
> +{
> +	return type >= 0 && type < MISC_CG_MASK_TYPES;
> +}
> +
>  /**
>   * misc_cg_set_capacity() - Set the capacity of the misc cgroup res.
>   * @type: Type of the misc res.
> @@ -391,6 +409,109 @@ static int misc_events_local_show(struct seq_file *sf, void *v)
>  	return __misc_events_show(sf, true);
>  }
>  
> +/**
> + * misc_cg_get_mask() - Get the mask of the specified type.
> + * @type: The misc mask type.
> + * @cg: The misc cgroup.
> + * @pmask: Pointer to the resulting mask.
> + *
> + * This function calculates the effective mask for a given cgroup by walking up
> + * the hierarchy and ORing the masks from all parent cgroupfs. The final result
> + * is stored in the location pointed to by @pmask.
> + *
> + * Context: Any context.
> + * Return: 0 on success, -EINVAL if @type is invalid.
> + */
> +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> +{
> +	struct misc_cg *i;
> +	u64 mask = 0;
> +
> +	if (!(valid_mask_type(type)))
> +		return -EINVAL;
> +
> +	for (i = cg; i; i = parent_misc(i))
> +		mask |= READ_ONCE(i->mask[type]);
> +
> +	*pmask = mask;
> +	return 0;
> +}
> +
> +/**
> + * misc_cg_mask_show() - Show the misc cgroup masks.
> + * @sf: Interface file
> + * @v: Arguments passed
> + *
> + * Context: Any context.
> + * Return: 0 to denote successful print.
> + */
> +static int misc_cg_mask_show(struct seq_file *sf, void *v)
> +{
> +	struct misc_cg *cg = css_misc(seq_css(sf));
> +	int i;
> +
> +	for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
> +		u64 rval, val = READ_ONCE(cg->mask[i]);
> +
> +		misc_cg_get_mask(i, cg, &rval);
> +		seq_printf(sf, "%s\t%#016llx\t%#016llx\n", misc_mask_name[i], val, rval);
> +	}
> +
> +	return 0;
> +}
> +

I'm concerned about the performance impact of the bottom-up traversal in deeply nested cgroup
hierarchies. Could this approach introduce noticeable latency in such scenarios?

> +/**
> + * misc_cg_mask_write() - Update the mask of the specified type.
> + * @of: Handler for the file.
> + * @buf: The buffer containing the user's input.
> + * @nbytes: The number of bytes in @buf.
> + * @off: The offset in the file.
> + *
> + * This function parses a user-provided string to update a mask.
> + * The expected format is "<mask_name> <value>", for example:
> + *
> + * echo "AT_HWCAP 0xf00" > misc.mask
> + *
> + * Context: Process context.
> + * Return: The number of bytes processed on success, or a negative error code
> + * on failure.
> + */
> +static ssize_t misc_cg_mask_write(struct kernfs_open_file *of, char *buf,
> +				 size_t nbytes, loff_t off)
> +{
> +	struct misc_cg *cg;
> +	u64 max;
> +	int ret = 0, i;
> +	enum misc_mask_type type = MISC_CG_MASK_TYPES;
> +	char *token;
> +
> +	buf = strstrip(buf);
> +	token = strsep(&buf, " ");
> +
> +	if (!token || !buf)
> +		return -EINVAL;
> +
> +	for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
> +		if (!strcmp(misc_mask_name[i], token)) {
> +			type = i;
> +			break;
> +		}
> +	}
> +
> +	if (type == MISC_CG_MASK_TYPES)
> +		return -EINVAL;
> +
> +	ret = kstrtou64(buf, 0, &max);
> +	if (ret)
> +		return ret;
> +
> +	cg = css_misc(of_css(of));
> +
> +	WRITE_ONCE(cg->mask[type], max);
> +
> +	return nbytes;
> +}
> +
>  /* Misc cgroup interface files */
>  static struct cftype misc_cg_files[] = {
>  	{
> @@ -424,6 +545,11 @@ static struct cftype misc_cg_files[] = {
>  		.file_offset = offsetof(struct misc_cg, events_local_file),
>  		.seq_show = misc_events_local_show,
>  	},
> +	{
> +		.name = "mask",
> +		.write = misc_cg_mask_write,
> +		.seq_show = misc_cg_mask_show,
> +	},
>  	{}
>  };
>  

-- 
Best regards,
Ridong

On Fri, Dec 5, 2025 at 2:11 AM Chen Ridong <chenridong@huaweicloud.com> wrote:
>
>
>
> On 2025/12/5 8:58, Andrei Vagin wrote:
> > Add an interface to the misc cgroup controller that allows masking out
> > hardware capabilities (AT_HWCAP) reported to user-space processes. This
> > provides a mechanism to restrict the features a containerized
> > application can see.
> >
> > The new "misc.mask" cgroup file allows users to specify masks for
> > AT_HWCAP, AT_HWCAP2, AT_HWCAP3, and AT_HWCAP4.
> >
> > The output of "misc.mask" is extended to display the effective mask,
> > which is a combination of the masks from the current cgroup and all its
> > ancestors.
> >
> > Signed-off-by: Andrei Vagin <avagin@google.com>
> > ---
> >  fs/binfmt_elf.c             |  24 +++++--
> >  include/linux/misc_cgroup.h |  25 +++++++
> >  kernel/cgroup/misc.c        | 126 ++++++++++++++++++++++++++++++++++++
> >  3 files changed, 171 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > index 3eb734c192e9..59137784e81d 100644
> > --- a/fs/binfmt_elf.c
> > +++ b/fs/binfmt_elf.c
> > @@ -47,6 +47,7 @@
> >  #include <linux/dax.h>
> >  #include <linux/uaccess.h>
> >  #include <uapi/linux/rseq.h>
> > +#include <linux/misc_cgroup.h>
> >  #include <asm/param.h>
> >  #include <asm/page.h>
> >
> > @@ -182,6 +183,21 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >       int ei_index;
> >       const struct cred *cred = current_cred();
> >       struct vm_area_struct *vma;
> > +     struct misc_cg *misc_cg;
> > +     u64 hwcap_mask[4] = {0, 0, 0, 0};
> > +
> > +     misc_cg = get_current_misc_cg();
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP, misc_cg, &hwcap_mask[0]);
> > +#ifdef ELF_HWCAP2
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP2, misc_cg, &hwcap_mask[1]);
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP3, misc_cg, &hwcap_mask[2]);
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     misc_cg_get_mask(MISC_CG_MASK_HWCAP4, misc_cg, &hwcap_mask[3]);
> > +#endif
> > +     put_misc_cg(misc_cg);
> >
> >       /*
> >        * In some cases (e.g. Hyper-Threading), we want to avoid L1
> > @@ -246,7 +262,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >        */
> >       ARCH_DLINFO;
> >  #endif
> > -     NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
> > +     NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP & ~hwcap_mask[0]);
> >       NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
> >       NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
> >       NEW_AUX_ENT(AT_PHDR, phdr_addr);
> > @@ -264,13 +280,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
> >       NEW_AUX_ENT(AT_SECURE, bprm->secureexec);
> >       NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
> >  #ifdef ELF_HWCAP2
> > -     NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2);
> > +     NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2 & ~hwcap_mask[1]);
> >  #endif
> >  #ifdef ELF_HWCAP3
> > -     NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3);
> > +     NEW_AUX_ENT(AT_HWCAP3, ELF_HWCAP3 & ~hwcap_mask[2]);
> >  #endif
> >  #ifdef ELF_HWCAP4
> > -     NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4);
> > +     NEW_AUX_ENT(AT_HWCAP4, ELF_HWCAP4 & ~hwcap_mask[3]);
> >  #endif
> >       NEW_AUX_ENT(AT_EXECFN, bprm->exec);
> >       if (k_platform) {
> > diff --git a/include/linux/misc_cgroup.h b/include/linux/misc_cgroup.h
> > index 0cb36a3ffc47..cff830c238fb 100644
> > --- a/include/linux/misc_cgroup.h
> > +++ b/include/linux/misc_cgroup.h
> > @@ -8,6 +8,8 @@
> >  #ifndef _MISC_CGROUP_H_
> >  #define _MISC_CGROUP_H_
> >
> > +#include <linux/elf.h>
> > +
> >  /**
> >   * enum misc_res_type - Types of misc cgroup entries supported by the host.
> >   */
> > @@ -26,6 +28,20 @@ enum misc_res_type {
> >       MISC_CG_RES_TYPES
> >  };
> >
> > +enum misc_mask_type {
> > +     MISC_CG_MASK_HWCAP,
> > +#ifdef ELF_HWCAP2
> > +     MISC_CG_MASK_HWCAP2,
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     MISC_CG_MASK_HWCAP3,
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     MISC_CG_MASK_HWCAP4,
> > +#endif
> > +     MISC_CG_MASK_TYPES
> > +};
> > +
> >  struct misc_cg;
> >
> >  #ifdef CONFIG_CGROUP_MISC
> > @@ -62,12 +78,15 @@ struct misc_cg {
> >       struct cgroup_file events_local_file;
> >
> >       struct misc_res res[MISC_CG_RES_TYPES];
> > +     u64 mask[MISC_CG_MASK_TYPES];
> >  };
> >
> >  int misc_cg_set_capacity(enum misc_res_type type, u64 capacity);
> >  int misc_cg_try_charge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
> >  void misc_cg_uncharge(enum misc_res_type type, struct misc_cg *cg, u64 amount);
> >
> > +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask);
> > +
> >  /**
> >   * css_misc() - Get misc cgroup from the css.
> >   * @css: cgroup subsys state object.
> > @@ -134,5 +153,11 @@ static inline void put_misc_cg(struct misc_cg *cg)
> >  {
> >  }
> >
> > +static inline int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> > +{
> > +     *pmask = 0;
> > +     return 0;
> > +}
> > +
> >  #endif /* CONFIG_CGROUP_MISC */
> >  #endif /* _MISC_CGROUP_H_ */
> > diff --git a/kernel/cgroup/misc.c b/kernel/cgroup/misc.c
> > index 6a01d91ea4cb..d1386d86060f 100644
> > --- a/kernel/cgroup/misc.c
> > +++ b/kernel/cgroup/misc.c
> > @@ -30,6 +30,19 @@ static const char *const misc_res_name[] = {
> >  #endif
> >  };
> >
> > +static const char *const misc_mask_name[] = {
> > +     "AT_HWCAP",
> > +#ifdef ELF_HWCAP2
> > +     "AT_HWCAP2",
> > +#endif
> > +#ifdef ELF_HWCAP3
> > +     "AT_HWCAP3",
> > +#endif
> > +#ifdef ELF_HWCAP4
> > +     "AT_HWCAP4",
> > +#endif
> > +};
> > +
> >  /* Root misc cgroup */
> >  static struct misc_cg root_cg;
> >
> > @@ -71,6 +84,11 @@ static inline bool valid_type(enum misc_res_type type)
> >       return type >= 0 && type < MISC_CG_RES_TYPES;
> >  }
> >
> > +static inline bool valid_mask_type(enum misc_mask_type type)
> > +{
> > +     return type >= 0 && type < MISC_CG_MASK_TYPES;
> > +}
> > +
> >  /**
> >   * misc_cg_set_capacity() - Set the capacity of the misc cgroup res.
> >   * @type: Type of the misc res.
> > @@ -391,6 +409,109 @@ static int misc_events_local_show(struct seq_file *sf, void *v)
> >       return __misc_events_show(sf, true);
> >  }
> >
> > +/**
> > + * misc_cg_get_mask() - Get the mask of the specified type.
> > + * @type: The misc mask type.
> > + * @cg: The misc cgroup.
> > + * @pmask: Pointer to the resulting mask.
> > + *
> > + * This function calculates the effective mask for a given cgroup by walking up
> > + * the hierarchy and ORing the masks from all parent cgroupfs. The final result
> > + * is stored in the location pointed to by @pmask.
> > + *
> > + * Context: Any context.
> > + * Return: 0 on success, -EINVAL if @type is invalid.
> > + */
> > +int misc_cg_get_mask(enum misc_mask_type type, struct misc_cg *cg, u64 *pmask)
> > +{
> > +     struct misc_cg *i;
> > +     u64 mask = 0;
> > +
> > +     if (!(valid_mask_type(type)))
> > +             return -EINVAL;
> > +
> > +     for (i = cg; i; i = parent_misc(i))
> > +             mask |= READ_ONCE(i->mask[type]);
> > +
> > +     *pmask = mask;
> > +     return 0;
> > +}
> > +
> > +/**
> > + * misc_cg_mask_show() - Show the misc cgroup masks.
> > + * @sf: Interface file
> > + * @v: Arguments passed
> > + *
> > + * Context: Any context.
> > + * Return: 0 to denote successful print.
> > + */
> > +static int misc_cg_mask_show(struct seq_file *sf, void *v)
> > +{
> > +     struct misc_cg *cg = css_misc(seq_css(sf));
> > +     int i;
> > +
> > +     for (i = 0; i < MISC_CG_MASK_TYPES; i++) {
> > +             u64 rval, val = READ_ONCE(cg->mask[i]);
> > +
> > +             misc_cg_get_mask(i, cg, &rval);
> > +             seq_printf(sf, "%s\t%#016llx\t%#016llx\n", misc_mask_name[i], val, rval);
> > +     }
> > +
> > +     return 0;
> > +}
> > +
>
> I'm concerned about the performance impact of the bottom-up traversal in deeply nested cgroup
> hierarchies. Could this approach introduce noticeable latency in such scenarios?
>

I wrote an execve benchmark to measure the impact of this change
(https://github.com/avagin/execve_vs_misccg).

The benchmark results are as follows:

depth | before (ops/sec)| after (ops/sec)| ratio %| perf
------------------------------------------------------
0     | 4813.06 ± 11.01 | 4826.78 ± 19.33| 100.28 |
2     | 4752.75 ± 11.28 | 4754.38 ± 21.93| 100.03 |
4     | 4767.41 ± 8.35  | 4729.81 ± 29.56|  99.21 |
8     | 4768.01 ± 10.42 | 4745.23 ± 27.68|  99.52 |
16    | 4749.34 ± 21.03 | 4723.63 ± 23.57|  99.45 |
32    | 4758.67 ± 10.94 | 4728.49 ± 13.9 |  99.36 |
64    | 4749.85 ± 12.33 | 4686.3  ± 13.06|  98.66 | 0.11%
128   | 4707.22 ± 12.01 | 4668.22 ± 16.9 |  99.17 | 0.33%
256   | 4725.75 ± 6.07  | 4629.09 ± 27.02|  97.95 | 1.61%

Columns:
* depth: The nesting level of the cgroup.
* before: without this patch.
* after: with this patch applied.
* ratio: performance of after relative to before.
* perf: profiling data from perf showing execution time spent in the
        misc_cg_get_mask function.

The performance impact is almost negligible for cgroup depths up to 64.
Even at a depth of 128, the overhead is less than 1%.

Thanks,
Andrei

On Fri, Dec 05, 2025 at 12:58:29AM +0000, Andrei Vagin wrote:
> Add an interface to the misc cgroup controller that allows masking out
> hardware capabilities (AT_HWCAP) reported to user-space processes. This
> provides a mechanism to restrict the features a containerized
> application can see.
> 
> The new "misc.mask" cgroup file allows users to specify masks for
> AT_HWCAP, AT_HWCAP2, AT_HWCAP3, and AT_HWCAP4.
> 
> The output of "misc.mask" is extended to display the effective mask,
> which is a combination of the masks from the current cgroup and all its
> ancestors.
> 
> Signed-off-by: Andrei Vagin <avagin@google.com>
> ---
>  fs/binfmt_elf.c             |  24 +++++--
>  include/linux/misc_cgroup.h |  25 +++++++
>  kernel/cgroup/misc.c        | 126 ++++++++++++++++++++++++++++++++++++
>  3 files changed, 171 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index 3eb734c192e9..59137784e81d 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -47,6 +47,7 @@
>  #include <linux/dax.h>
>  #include <linux/uaccess.h>
>  #include <uapi/linux/rseq.h>
> +#include <linux/misc_cgroup.h>
>  #include <asm/param.h>
>  #include <asm/page.h>
>  
> @@ -182,6 +183,21 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec,
>  	int ei_index;
>  	const struct cred *cred = current_cred();
>  	struct vm_area_struct *vma;
> +	struct misc_cg *misc_cg;
> +	u64 hwcap_mask[4] = {0, 0, 0, 0};
> +
> +	misc_cg = get_current_misc_cg();
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP, misc_cg, &hwcap_mask[0]);
> +#ifdef ELF_HWCAP2
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP2, misc_cg, &hwcap_mask[1]);
> +#endif
> +#ifdef ELF_HWCAP3
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP3, misc_cg, &hwcap_mask[2]);
> +#endif
> +#ifdef ELF_HWCAP4
> +	misc_cg_get_mask(MISC_CG_MASK_HWCAP4, misc_cg, &hwcap_mask[3]);
> +#endif

Can we avoid having the open-coded 4, 0, 1, 2, 3 where these are used?
I imagine it also doesn't need to be a 4 element array if ELF_HWCAP4
isn't defined, etc?

-- 
Kees Cook