bpf, cgroup: implement eBPF-based device controller for cgroup v2

bpf, cgroup: implement eBPF-based device controller for cgroup v2

Cgroup v2 lacks the device controller, provided by cgroup v1.
This patch adds a new eBPF program type, which in combination
of previously added ability to attach multiple eBPF programs
to a cgroup, will provide a similar functionality, but with some
additional flexibility.

This patch introduces a BPF_PROG_TYPE_CGROUP_DEVICE program type.
A program takes major and minor device numbers, device type
(block/character) and access type (mknod/read/write) as parameters
and returns an integer which defines if the operation should be
allowed or terminated with -EPERM.

Signed-off-by: Roman Gushchin <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Acked-by: Tejun Heo <[email protected]>
Cc: Daniel Borkmann <[email protected]>
Signed-off-by: David S. Miller <[email protected]>