SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core/bpf: avoid redundant BPF program loading (#43234)

Browse Source 
Replaces #43211 and #43213.
This commit is contained in:
Yu Watanabe
2026-08-04 08:10:00 +09:00
committed by GitHub
parent 05ea7e87b6 8bbbd71023
commit f4cb4596a3
7 changed files with 64 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/bpf-restrict-fs.c
+28 -75
View File
@@ -21,23 +21,31 @@
#define CGROUP_HASH_SIZE_MAX 2048
static struct restrict_fs_bpf *restrict_fs_bpf_free(struct restrict_fs_bpf *obj) {
/* restrict_fs_bpf__destroy handles object == NULL case */
restrict_fs_bpf__destroy(obj);
/* restrict_fs_bpf__destroy handles object == NULL case */
DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME(struct restrict_fs_bpf *, restrict_fs_bpf__destroy, restrict_fs_bpf_freep, NULL);
return NULL;
}
DEFINE_TRIVIAL_CLEANUP_FUNC(struct restrict_fs_bpf *, restrict_fs_bpf_free);
static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) {
_cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
_cleanup_close_ int inner_map_fd = -EBADF;
int bpf_restrict_fs_setup(Manager *m) {
int r;
assert(ret_obj);
assert(m);
obj = restrict_fs_bpf__open();
if (!MANAGER_IS_SYSTEM(m))
return 0;
r = dlopen_bpf(LOG_WARNING);
if (r < 0)
return r;
r = lsm_supported("bpf");
if (r == -ENOPKG)
return log_debug_errno(r, "bpf-restrict-fs: securityfs not mounted, BPF LSM support not available.");
if (r < 0)
return log_warning_errno(r, "bpf-restrict-fs: Can't determine whether the BPF LSM module is used: %m");
if (r == 0)
return log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported.");
_cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = restrict_fs_bpf__open();
if (!obj)
return log_error_errno(errno, "bpf-restrict-fs: Failed to open BPF object: %m");
@@ -49,7 +57,7 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) {
sym_bpf_map__name(obj->maps.cgroup_hash));
/* Dummy map to satisfy the verifier */
inner_map_fd = compat_bpf_map_create(BPF_MAP_TYPE_HASH, NULL, sizeof(uint32_t), sizeof(uint32_t), 128U, NULL);
_cleanup_close_ int inner_map_fd = compat_bpf_map_create(BPF_MAP_TYPE_HASH, NULL, sizeof(uint32_t), sizeof(uint32_t), 128U, NULL);
if (inner_map_fd < 0)
return log_error_errno(errno, "bpf-restrict-fs: Failed to create BPF map: %m");
@@ -63,59 +71,7 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) {
if (r < 0)
return log_error_errno(r, "bpf-restrict-fs: Failed to load BPF object: %m");
*ret_obj = TAKE_PTR(obj);
return 0;
}
bool bpf_restrict_fs_supported(bool initialize) {
static int supported = -1;
int r;
if (supported >= 0)
return supported;
if (!initialize)
return false;
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
r = lsm_supported("bpf");
if (r == -ENOPKG) {
log_debug_errno(r, "bpf-restrict-fs: securityfs not mounted, BPF LSM support not available.");
return (supported = false);
}
if (r < 0) {
log_warning_errno(r, "bpf-restrict-fs: Can't determine whether the BPF LSM module is used: %m");
return (supported = false);
}
if (r == 0) {
log_info("bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported.");
return (supported = false);
}
/* We don't try to open/load/attach the BPF program here: that's the expensive part (a real kernel
* verifier pass plus, on the real attach in bpf_restrict_fs_setup(), an LSM link), and doing it
* twice (once here just to throw the result away, once for real in bpf_restrict_fs_setup()) means
* paying that cost twice on every boot for no benefit. If BPF_LSM_MAC attach isn't actually usable
* (e.g. no BPF trampoline support on this architecture/kernel), bpf_restrict_fs_setup()'s own
* attach will fail when it is later called, and that failure is already logged and handled
* gracefully by its caller. */
return (supported = true);
}
int bpf_restrict_fs_setup(Manager *m) {
_cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
_cleanup_(bpf_link_freep) struct bpf_link *link = NULL;
int r;
assert(m);
r = prepare_restrict_fs_bpf(&obj);
if (r < 0)
return r;
link = sym_bpf_program__attach_lsm(obj->progs.restrict_filesystems);
_cleanup_(bpf_link_freep) struct bpf_link *link = sym_bpf_program__attach_lsm(obj->progs.restrict_filesystems);
r = bpf_get_error_translated(link);
if (r != 0)
return log_error_errno(r, "bpf-restrict-fs: Failed to link '%s' LSM BPF program: %m",
@@ -193,10 +149,6 @@ int bpf_restrict_fs_cleanup(Unit *u) {
assert(u);
assert(u->manager);
/* If we never successfully detected support, there is nothing to clean up. */
if (!bpf_restrict_fs_supported(/* initialize= */ false))
return 0;
if (!u->manager->restrict_fs)
return 0;
@@ -231,11 +183,12 @@ void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) {
restrict_fs_bpf__destroy(prog);
}
#else /* ! BPF_FRAMEWORK */
bool bpf_restrict_fs_supported(bool initialize) {
return false;
}
int bpf_restrict_fs_setup(Manager *m) {
assert(m);
if (!MANAGER_IS_SYSTEM(m))
return 0;
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: BPF framework is not supported.");
}
src/core/bpf-restrict-fs.h
-1
View File
@@ -9,7 +9,6 @@ typedef enum FilesystemParseFlags {
FILESYSTEM_PARSE_LOG = 1 << 2,
} FilesystemParseFlags;
bool bpf_restrict_fs_supported(bool initialize);
int bpf_restrict_fs_setup(Manager *m);
int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
int bpf_restrict_fs_cleanup(Unit *u);
src/core/bpf-restrict-fsaccess.c
+12 -44
View File
@@ -39,10 +39,9 @@ const char* const restrict_fsaccess_link_names[_RESTRICT_FILESYSTEM_ACCESS_LINK_
#if BPF_FRAMEWORK && HAVE_LSM_INTEGRITY_TYPE
#include "bpf-util.h"
#include "bpf-link.h"
#include "restrict-fsaccess-skel.h"
static struct restrict_fsaccess_bpf *restrict_fsaccess_bpf_free(struct restrict_fsaccess_bpf *obj) {
static struct restrict_fsaccess_bpf* restrict_fsaccess_bpf_free(struct restrict_fsaccess_bpf *obj) {
restrict_fsaccess_bpf__destroy(obj);
return NULL;
}
@@ -164,42 +163,6 @@ int bpf_restrict_fsaccess_prepare(struct restrict_fsaccess_bpf **ret) {
return 0;
}
bool bpf_restrict_fsaccess_supported(void) {
_cleanup_(restrict_fsaccess_bpf_freep) struct restrict_fsaccess_bpf *obj = NULL;
static int supported = -1;
int r;
if (supported >= 0)
return supported;
if (dlopen_bpf(LOG_WARNING) < 0)
return (supported = false);
r = lsm_supported("bpf");
if (r == -ENOPKG) {
log_debug_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
return (supported = false);
}
if (r < 0) {
log_warning_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is used: %m");
return (supported = false);
}
if (r == 0) {
log_info("bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
return (supported = false);
}
r = bpf_restrict_fsaccess_prepare(&obj);
if (r < 0)
return (supported = false);
if (!bpf_can_link_lsm_program(obj->progs.restrict_fsaccess_bprm_check)) {
log_warning("bpf-restrict-fsaccess: Failed to link program; assuming BPF LSM is not available.");
return (supported = false);
}
return (supported = true);
}
/* Partial deserialization (some FDs but not all) is fatal: continuing
* would leave enforcement incomplete. */
static int restrict_fsaccess_have_deserialized_fds(Manager *m) {
@@ -405,9 +368,18 @@ int bpf_restrict_fsaccess_setup(Manager *m) {
}
/* Fresh setup: verify BPF LSM is available */
if (!bpf_restrict_fsaccess_supported())
r = dlopen_bpf(LOG_WARNING);
if (r < 0)
return r;
r = lsm_supported("bpf");
if (r == -ENOPKG)
return log_warning_errno(r, "bpf-restrict-fsaccess: securityfs not mounted, BPF LSM not available.");
if (r < 0)
return log_warning_errno(r, "bpf-restrict-fsaccess: Can't determine whether the BPF LSM module is used: %m");
if (r == 0)
return log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-restrict-fsaccess: BPF LSM is not available.");
"bpf-restrict-fsaccess: BPF LSM hook not enabled in the kernel, not supported.");
/* Require dm-verity signature enforcement */
if (!dm_verity_require_signatures())
@@ -533,10 +505,6 @@ bool dm_verity_require_signatures(void) {
return false;
}
bool bpf_restrict_fsaccess_supported(void) {
return false;
}
int bpf_restrict_fsaccess_setup(Manager *m) {
if (!MANAGER_IS_SYSTEM(m) || m->restrict_filesystem_access <= RESTRICT_FILESYSTEM_ACCESS_NO)
return 0;
src/core/bpf-restrict-fsaccess.h
-1
View File
@@ -34,7 +34,6 @@ enum {
extern const char* const restrict_fsaccess_link_names[_RESTRICT_FILESYSTEM_ACCESS_LINK_MAX];
bool dm_verity_require_signatures(void);
bool bpf_restrict_fsaccess_supported(void);
int bpf_restrict_fsaccess_setup(Manager *m);
int bpf_restrict_fsaccess_prepare(struct restrict_fsaccess_bpf **ret);
int bpf_restrict_fsaccess_populate_guard(struct restrict_fsaccess_bpf *obj);
src/core/manager.c
+1 -7
View File
@@ -1056,13 +1056,7 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
return r;
}
#if HAVE_LIBBPF
if (MANAGER_IS_SYSTEM(m) && bpf_restrict_fs_supported(/* initialize= */ true)) {
r = bpf_restrict_fs_setup(m);
if (r < 0)
log_warning_errno(r, "Failed to setup LSM BPF, ignoring: %m");
}
#endif
(void) bpf_restrict_fs_setup(m);
}
if (test_run_flags == 0) {
src/test/test-bpf-restrict-fs.c
+1 -9
View File
@@ -1,6 +1,5 @@
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include "bpf-restrict-fs.h"
#include "load-fragment.h"
#include "manager.h"
#include "process-util.h"
@@ -75,9 +74,6 @@ int main(int argc, char *argv[]) {
if (!can_memlock())
return log_tests_skipped("Can't use mlock()");
if (!bpf_restrict_fs_supported(/* initialize= */ true))
return log_tests_skipped("LSM BPF hooks are not supported");
r = enter_cgroup_subroot(NULL);
if (r == -ENOMEDIUM)
return log_tests_skipped("cgroupfs not available");
@@ -96,12 +92,8 @@ int main(int argc, char *argv[]) {
return log_tests_skipped_errno(r, "manager_startup");
ASSERT_OK(r);
/* bpf_restrict_fs_supported() above only checks that the BPF LSM hook is enabled in the kernel; it
* doesn't verify that the LSM BPF program managed to actually attach (e.g. some architectures/older
* kernels lack BPF trampoline support). If it didn't, manager_startup() already logged a warning
* and continued without enforcement, so skip here rather than hard-failing the assertions below. */
if (!m->restrict_fs)
return log_tests_skipped("Failed to attach LSM BPF program");
return log_tests_skipped("LSM BPF hooks are not supported");
/* We need to enable access to the filesystem where the binary is so we
* add @common-block and @application */
src/test/test-bpf-restrict-fsaccess.c
+22 -8
View File
@@ -24,10 +24,12 @@
#include <sys/stat.h>
#include <unistd.h>
#include "bpf-link.h"
#include "bpf-restrict-fsaccess.h"
#include "devnum-util.h"
#include "fd-util.h"
#include "log.h"
#include "lsm-util.h"
#include "string-util.h"
#include "tests.h"
@@ -161,16 +163,28 @@ static int do_attach(void) {
}
static int do_check(void) {
if (!bpf_restrict_fsaccess_supported()) {
log_error("BPF LSM is not available");
return -EOPNOTSUPP;
}
int r;
r = dlopen_bpf(LOG_WARNING);
if (r < 0)
return r;
r = lsm_supported("bpf");
if (r <= 0)
return log_error_errno(r < 0 ? r : EOPNOTSUPP, "BPF LSM is not available: %m");
log_info("BPF LSM: supported");
if (!dm_verity_require_signatures()) {
log_error("dm-verity require_signatures is not enabled");
return -ENOKEY;
}
_cleanup_(restrict_fsaccess_bpf_freep) struct restrict_fsaccess_bpf *obj = NULL;
r = bpf_restrict_fsaccess_prepare(&obj);
if (r < 0)
return r;
if (!bpf_can_link_lsm_program(obj->progs.restrict_fsaccess_bprm_check))
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"bpf-restrict-fsaccess: Failed to link program.");
if (!dm_verity_require_signatures())
return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "dm-verity require_signatures is not enabled.");
log_info("dm-verity require_signatures: enabled");
return 0;