SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: centralize RestrictFileSystemAccess= checks

Browse Source 
Centralize the checks for RestrictFileSystemAccess= requirements.

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-08-31 23:33:39 +02:00
parent c35f061634
commit 73e093d16d
4 changed files with 41 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/bpf-restrict-fsaccess.c
+33 -21
View File
@@ -81,7 +81,7 @@ assert_cc(sizeof_field(typeof_field(struct restrict_fsaccess_bpf, bss[0]), initr
[RESTRICT_FILESYSTEM_ACCESS_LINK_BPF_GUARD] = (obj)->links.restrict_fsaccess_bpf_guard, \
}
bool dm_verity_require_signatures(void) {
static bool dm_verity_require_signatures(void) {
int r;
r = read_boolean_file("/sys/module/dm_verity/parameters/require_signatures");
@@ -94,6 +94,35 @@ bool dm_verity_require_signatures(void) {
return r > 0;
}
/* The kernel-side prerequisites of the policy, shared with test-bpf-restrict-fsaccess. */
int bpf_restrict_fsaccess_check_prerequisites(void) {
int r;
r = dlopen_bpf(LOG_ERR);
if (r < 0)
return r;
r = lsm_supported("bpf");
if (r == -ENOPKG)
return log_error_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
if (r < 0)
return log_error_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is "
"used: %m");
if (r == 0)
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
log_debug("bpf-restrict-fsaccess: BPF LSM: supported.");
if (!dm_verity_require_signatures())
return log_error_errno(SYNTHETIC_ERRNO(ENOKEY),
"bpf-restrict-fsaccess: dm-verity require_signatures is not enabled. "
"RestrictFileSystemAccess= requires the kernel to enforce dm-verity signatures. "
"Set dm_verity.require_signatures=1 on the kernel command line.");
log_debug("bpf-restrict-fsaccess: dm-verity require_signatures: enabled.");
return 0;
}
static int get_root_s_dev(uint32_t *ret) {
struct stat st;
@@ -416,27 +445,10 @@ int bpf_restrict_fsaccess_setup(Manager *m) {
return 0;
}
/* Fresh setup: verify BPF LSM is available */
r = dlopen_bpf(LOG_WARNING);
r = bpf_restrict_fsaccess_check_prerequisites();
if (r < 0)
return r;
r = lsm_supported("bpf");
if (r == -ENOPKG)
return log_warning_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
if (r < 0)
return log_warning_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is used: %m");
if (r == 0)
return log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
/* Require dm-verity signature enforcement */
if (!dm_verity_require_signatures())
return log_error_errno(SYNTHETIC_ERRNO(ENOKEY),
"bpf-restrict-fsaccess: dm-verity require_signatures is not enabled. "
"RestrictFileSystemAccess= requires the kernel to enforce dm-verity signatures. "
"Set dm_verity.require_signatures=1 on the kernel command line.");
r = bpf_restrict_fsaccess_prepare(&obj);
if (r < 0)
return r;
@@ -554,8 +566,8 @@ int bpf_restrict_fsaccess_serialize(Manager *m, FILE *f, FDSet *fds) {
#else /* ! BPF_FRAMEWORK || ! HAVE_LSM_INTEGRITY_TYPE */
bool dm_verity_require_signatures(void) {
return false;
int bpf_restrict_fsaccess_check_prerequisites(void) {
return -EOPNOTSUPP;
}
int bpf_restrict_fsaccess_setup(Manager *m) {
src/core/bpf-restrict-fsaccess.h
+1 -1
View File
@@ -33,7 +33,7 @@ enum {
extern const char* const restrict_fsaccess_link_names[_RESTRICT_FILESYSTEM_ACCESS_LINK_MAX];
bool dm_verity_require_signatures(void);
int bpf_restrict_fsaccess_check_prerequisites(void);
int bpf_restrict_fsaccess_setup(Manager *m);
int bpf_restrict_fsaccess_prepare(struct restrict_fsaccess_bpf **ret);
int bpf_restrict_fsaccess_populate_guard(struct restrict_fsaccess_bpf *obj);