SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/namespace: gracefully handle errors in mounting new bpffs instance

Browse Source 
Then, fallback to remount /sys/fs/bpf read-only when ProtectKernelTunables=yes.
This commit is contained in:
Yu Watanabe
2025-07-18 20:25:35 +09:00
parent 9eabf82750
commit 0e8e655c52
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/namespace.c
+18 -3
View File
@@ -957,6 +957,7 @@ static int append_private_bpf(
*me = (MountEntry) {
.path_const = "/sys/fs/bpf",
.mode = MOUNT_BPFFS,
.ignore = !protect_kernel_tunables, /* indicate whether we should fall back to MOUNT_READ_ONLY on failure. */
};
return 0;
}
@@ -1832,6 +1833,23 @@ static int apply_one_mount(
log_debug("Applying namespace mount on %s", mount_entry_path(m));
if (m->mode == MOUNT_BPFFS) {
r = mount_bpffs(m, p->bpffs_pidref, p->bpffs_socket_fd, p->bpffs_errno_pipe);
if (r >= 0 ||
(!ERRNO_IS_NEG_NOT_SUPPORTED(r) && /* old kernel? */
!ERRNO_IS_NEG_PRIVILEGE(r))) /* ubuntu kernel bug? See issue #38225 */
return r;
if (m->ignore) {
log_debug_errno(r, "Failed to mount new bpffs instance, ignoring: %m");
return 0;
}
log_debug_errno(r, "Failed to mount new bpffs instance, fallback to making %s read-only, ignoring: %m", mount_entry_path(m));
m->mode = MOUNT_READ_ONLY;
m->ignore = true;
}
switch (m->mode) {
case MOUNT_INACCESSIBLE: {
@@ -2034,9 +2052,6 @@ static int apply_one_mount(
case MOUNT_OVERLAY:
return mount_overlay(m);
case MOUNT_BPFFS:
return mount_bpffs(m, p->bpffs_pidref, p->bpffs_socket_fd, p->bpffs_errno_pipe);
default:
assert_not_reached();
}