core/bpf-restrict-fsaccess: merge bpf_restrict_fsaccess_supported() into bpf_restrict_fsaccess_setup()

Previously, bpf_restrict_fsaccess_prepare() is called twice in
bpf_restrict_fsaccess_setup(). One by through
bpf_restrict_fsaccess_supported() and one by itself directly.

In PID1, bpf_restrict_fsaccess_prepare() was only called by
bpf_restrict_fsaccess_setup(), hence it is not necessary to exist as a
separated function.

bpf_restrict_fsaccess_prepare() loads BPF program(s), hence it is
slightly slow operation.

Let's avoid redundant loading of BPF programs by merging
bpf_restrict_fsaccess_supported() into bpf_restrict_fsaccess_setup().

Co-authored-by: Eric Curtin <eric.curtin@docker.com>

src/core/bpf-restrict-fsaccess.c

@@ -39,7 +39,6 @@ const char* const restrict_fsaccess_link_names[_RESTRICT_FILESYSTEM_ACCESS_LINK_
 
 #if BPF_FRAMEWORK && HAVE_LSM_INTEGRITY_TYPE
 #include "bpf-util.h"
-#include "bpf-link.h"
 #include "restrict-fsaccess-skel.h"
 
 static struct restrict_fsaccess_bpf *restrict_fsaccess_bpf_free(struct restrict_fsaccess_bpf *obj) {
@@ -164,42 +163,6 @@ int bpf_restrict_fsaccess_prepare(struct restrict_fsaccess_bpf **ret) {
         return 0;
 }
 
-bool bpf_restrict_fsaccess_supported(void) {
-        _cleanup_(restrict_fsaccess_bpf_freep) struct restrict_fsaccess_bpf *obj = NULL;
-        static int supported = -1;
-        int r;
-
-        if (supported >= 0)
-                return supported;
-        if (dlopen_bpf(LOG_WARNING) < 0)
-                return (supported = false);
-
-        r = lsm_supported("bpf");
-        if (r == -ENOPKG) {
-                log_debug_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
-                return (supported = false);
-        }
-        if (r < 0) {
-                log_warning_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is used: %m");
-                return (supported = false);
-        }
-        if (r == 0) {
-                log_info("bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
-                return (supported = false);
-        }
-
-        r = bpf_restrict_fsaccess_prepare(&obj);
-        if (r < 0)
-                return (supported = false);
-
-        if (!bpf_can_link_lsm_program(obj->progs.restrict_fsaccess_bprm_check)) {
-                log_warning("bpf-restrict-fsaccess: Failed to link program; assuming BPF LSM is not available.");
-                return (supported = false);
-        }
-
-        return (supported = true);
-}
-
 /* Partial deserialization (some FDs but not all) is fatal: continuing
  * would leave enforcement incomplete. */
 static int restrict_fsaccess_have_deserialized_fds(Manager *m) {
@@ -405,9 +368,18 @@ int bpf_restrict_fsaccess_setup(Manager *m) {
         }
 
         /* Fresh setup: verify BPF LSM is available */
-        if (!bpf_restrict_fsaccess_supported())
+        r = dlopen_bpf(LOG_WARNING);
+        if (r < 0)
+                return r;
+
+        r = lsm_supported("bpf");
+        if (r == -ENOPKG)
+                return log_warning_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
+        if (r < 0)
+                return log_warning_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is used: %m");
+        if (r == 0)
                 return log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
-                                         "bpf-restrict-fsaccess: BPF LSM is not available.");
+                                         "bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
 
         /* Require dm-verity signature enforcement */
         if (!dm_verity_require_signatures())
@@ -533,10 +505,6 @@ bool dm_verity_require_signatures(void) {
         return false;
 }
 
-bool bpf_restrict_fsaccess_supported(void) {
-        return false;
-}
-
 int bpf_restrict_fsaccess_setup(Manager *m) {
         if (!MANAGER_IS_SYSTEM(m) || m->restrict_filesystem_access <= RESTRICT_FILESYSTEM_ACCESS_NO)
                 return 0;

src/core/bpf-restrict-fsaccess.h

@@ -34,7 +34,6 @@ enum {
 extern const char* const restrict_fsaccess_link_names[_RESTRICT_FILESYSTEM_ACCESS_LINK_MAX];
 
 bool dm_verity_require_signatures(void);
-bool bpf_restrict_fsaccess_supported(void);
 int bpf_restrict_fsaccess_setup(Manager *m);
 int bpf_restrict_fsaccess_prepare(struct restrict_fsaccess_bpf **ret);
 int bpf_restrict_fsaccess_populate_guard(struct restrict_fsaccess_bpf *obj);

src/test/test-bpf-restrict-fsaccess.c

@@ -24,10 +24,12 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+#include "bpf-link.h"
 #include "bpf-restrict-fsaccess.h"
 #include "devnum-util.h"
 #include "fd-util.h"
 #include "log.h"
+#include "lsm-util.h"
 #include "string-util.h"
 #include "tests.h"
 
@@ -161,16 +163,28 @@ static int do_attach(void) {
 }
 
 static int do_check(void) {
-        if (!bpf_restrict_fsaccess_supported()) {
-                log_error("BPF LSM is not available");
-                return -EOPNOTSUPP;
-        }
+        int r;
+
+        r = dlopen_bpf(LOG_WARNING);
+        if (r < 0)
+                return r;
+
+        r = lsm_supported("bpf");
+        if (r <= 0)
+                return log_error_errno(r < 0 ? r : EOPNOTSUPP, "BPF LSM is not available: %m");
         log_info("BPF LSM: supported");
 
-        if (!dm_verity_require_signatures()) {
-                log_error("dm-verity require_signatures is not enabled");
-                return -ENOKEY;
-        }
+        _cleanup_(restrict_fsaccess_bpf_freep) struct restrict_fsaccess_bpf *obj = NULL;
+        r = bpf_restrict_fsaccess_prepare(&obj);
+        if (r < 0)
+                return r;
+
+        if (!bpf_can_link_lsm_program(obj->progs.restrict_fsaccess_bprm_check))
+                return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
+                                       "bpf-restrict-fsaccess: Failed to link program.");
+
+        if (!dm_verity_require_signatures())
+                return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "dm-verity require_signatures is not enabled.");
         log_info("dm-verity require_signatures: enabled");
 
         return 0;