From 389db516df2106bf50d7c83192a05f033baa4c2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 17 May 2022 10:11:05 +0200 Subject: [PATCH 1/2] core/bpf: lsm_bpf_supported() returns a boolean The code was corret, but confusing, because it was treating the int as a boolean. --- src/core/bpf-lsm.c | 22 +++++++++++----------- src/core/bpf-lsm.h | 2 +- src/test/test-bpf-lsm.c | 3 +-- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/src/core/bpf-lsm.c b/src/core/bpf-lsm.c index 83f3199349..174aa259c0 100644 --- a/src/core/bpf-lsm.c +++ b/src/core/bpf-lsm.c @@ -125,7 +125,7 @@ static int mac_bpf_use(void) { } } -int lsm_bpf_supported(void) { +bool lsm_bpf_supported(void) { _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL; static int supported = -1; int r; @@ -136,44 +136,44 @@ int lsm_bpf_supported(void) { r = dlopen_bpf(); if (r < 0) { log_info_errno(r, "Failed to open libbpf, LSM BPF is not supported: %m"); - return supported = 0; + return (supported = false); } r = cg_unified_controller(SYSTEMD_CGROUP_CONTROLLER); if (r < 0) { log_warning_errno(r, "Can't determine whether the unified hierarchy is used: %m"); - return supported = 0; + return (supported = false); } if (r == 0) { log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Not running with unified cgroup hierarchy, LSM BPF is not supported"); - return supported = 0; + return (supported = false); } r = mac_bpf_use(); if (r < 0) { log_warning_errno(r, "Can't determine whether the BPF LSM module is used: %m"); - return supported = 0; + return (supported = false); } if (r == 0) { log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "BPF LSM hook not enabled in the kernel, LSM BPF not supported"); - return supported = 0; + return (supported = false); } r = prepare_restrict_fs_bpf(&obj); if (r < 0) - return supported = 0; + return (supported = false); if (!bpf_can_link_lsm_program(obj->progs.restrict_filesystems)) { log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Failed to link BPF program. Assuming BPF is not available"); - return supported = 0; + return (supported = false); } - return supported = 1; + return (supported = true); } int lsm_bpf_setup(Manager *m) { @@ -297,8 +297,8 @@ void lsm_bpf_destroy(struct restrict_fs_bpf *prog) { restrict_fs_bpf__destroy(prog); } #else /* ! BPF_FRAMEWORK */ -int lsm_bpf_supported(void) { - return 0; +bool lsm_bpf_supported(void) { + return false; } int lsm_bpf_setup(Manager *m) { diff --git a/src/core/bpf-lsm.h b/src/core/bpf-lsm.h index 8bd58a29e5..e609d99330 100644 --- a/src/core/bpf-lsm.h +++ b/src/core/bpf-lsm.h @@ -14,7 +14,7 @@ typedef struct Manager Manager; typedef struct restrict_fs_bpf restrict_fs_bpf; -int lsm_bpf_supported(void); +bool lsm_bpf_supported(void); int lsm_bpf_setup(Manager *m); int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, bool allow_list); int lsm_bpf_cleanup(const Unit *u); diff --git a/src/test/test-bpf-lsm.c b/src/test/test-bpf-lsm.c index e0e1b7f38f..d2b5c96624 100644 --- a/src/test/test-bpf-lsm.c +++ b/src/test/test-bpf-lsm.c @@ -78,8 +78,7 @@ int main(int argc, char *argv[]) { if (!can_memlock()) return log_tests_skipped("Can't use mlock()"); - r = lsm_bpf_supported(); - if (r <= 0) + if (!lsm_bpf_supported()) return log_tests_skipped("LSM BPF hooks are not supported"); r = enter_cgroup_subroot(NULL); From ba187c9c9ce9c0d16e09aca8c3d3c38975ce05a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 17 May 2022 10:13:49 +0200 Subject: [PATCH 2/2] manager: skip BPF cleanup if we never initialized This fixes a spurious warning from the manager running in user mode: systemd[1668]: Reached target sockets.target. systemd[1669]: Failed to create BPF map: Operation not permitted systemd[1669]: Finished systemd-tmpfiles-setup.service. systemd[1669]: Listening on dbus.socket. systemd[1669]: Reached target sockets.target. systemd[1669]: Reached target basic.target. systemd[1]: Started user@6.service. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2084955. --- src/core/bpf-lsm.c | 9 ++++++--- src/core/bpf-lsm.h | 2 +- src/core/manager.c | 2 +- src/test/test-bpf-lsm.c | 2 +- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/src/core/bpf-lsm.c b/src/core/bpf-lsm.c index 174aa259c0..d3e92b98a6 100644 --- a/src/core/bpf-lsm.c +++ b/src/core/bpf-lsm.c @@ -125,13 +125,15 @@ static int mac_bpf_use(void) { } } -bool lsm_bpf_supported(void) { +bool lsm_bpf_supported(bool initialize) { _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL; static int supported = -1; int r; if (supported >= 0) return supported; + if (!initialize) + return false; r = dlopen_bpf(); if (r < 0) { @@ -267,7 +269,8 @@ int lsm_bpf_cleanup(const Unit *u) { assert(u); assert(u->manager); - if (!lsm_bpf_supported()) + /* If we never successfully detected support, there is nothing to clean up. */ + if (!lsm_bpf_supported(/* initialize = */ false)) return 0; if (!u->manager->restrict_fs) @@ -297,7 +300,7 @@ void lsm_bpf_destroy(struct restrict_fs_bpf *prog) { restrict_fs_bpf__destroy(prog); } #else /* ! BPF_FRAMEWORK */ -bool lsm_bpf_supported(void) { +bool lsm_bpf_supported(bool initialize) { return false; } diff --git a/src/core/bpf-lsm.h b/src/core/bpf-lsm.h index e609d99330..dff581279d 100644 --- a/src/core/bpf-lsm.h +++ b/src/core/bpf-lsm.h @@ -14,7 +14,7 @@ typedef struct Manager Manager; typedef struct restrict_fs_bpf restrict_fs_bpf; -bool lsm_bpf_supported(void); +bool lsm_bpf_supported(bool initialize); int lsm_bpf_setup(Manager *m); int lsm_bpf_unit_restrict_filesystems(Unit *u, const Set *filesystems, bool allow_list); int lsm_bpf_cleanup(const Unit *u); diff --git a/src/core/manager.c b/src/core/manager.c index 98daa764eb..296b759959 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -951,7 +951,7 @@ int manager_new(LookupScope scope, ManagerTestRunFlags test_run_flags, Manager * return r; #if HAVE_LIBBPF - if (MANAGER_IS_SYSTEM(m) && lsm_bpf_supported()) { + if (MANAGER_IS_SYSTEM(m) && lsm_bpf_supported(/* initialize = */ true)) { r = lsm_bpf_setup(m); if (r < 0) log_warning_errno(r, "Failed to setup LSM BPF, ignoring: %m"); diff --git a/src/test/test-bpf-lsm.c b/src/test/test-bpf-lsm.c index d2b5c96624..630d60dbf5 100644 --- a/src/test/test-bpf-lsm.c +++ b/src/test/test-bpf-lsm.c @@ -78,7 +78,7 @@ int main(int argc, char *argv[]) { if (!can_memlock()) return log_tests_skipped("Can't use mlock()"); - if (!lsm_bpf_supported()) + if (!lsm_bpf_supported(/* initialize = */ true)) return log_tests_skipped("LSM BPF hooks are not supported"); r = enter_cgroup_subroot(NULL);