SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
58,943 Commits 2 Branches 1 Tag
fdf38c0f1fe8b68e2425e4e98a571bdf788f6aeb
Commit Graph
4 Commits
Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek ba187c9c9c manager: skip BPF cleanup if we never initialized 
This fixes a spurious warning from the manager running in user mode:

systemd[1668]: Reached target sockets.target.
systemd[1669]: Failed to create BPF map: Operation not permitted
systemd[1669]: Finished systemd-tmpfiles-setup.service.
systemd[1669]: Listening on dbus.socket.
systemd[1669]: Reached target sockets.target.
systemd[1669]: Reached target basic.target.
systemd[1]: Started user@6.service.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2084955.
 2022-05-17 10:55:40 +02:00
Zbigniew Jędrzejewski-Szmek 389db516df core/bpf: lsm_bpf_supported() returns a boolean 
The code was corret, but confusing, because it was treating the int
as a boolean.
 2022-05-17 10:16:27 +02:00
Iago López Galeiras e59ccd035c core: add RestrictFileSystems= fragment parser 
It takes an allow or deny list of filesystems services should have
access to.
 2021-10-06 10:52:14 +02:00
Iago Lopez Galeiras 184b4f78cf core: add BPF LSM functions 
This adds 6 functions to implement RestrictFileSystems=

* lsm_bpf_supported() checks if LSM BPF is supported. It checks that
  cgroupv2 is used, that BPF LSM is enabled, and tries to load the BPF
  LSM program which makes sure BTF and hash of maps are supported, and
  BPF LSM programs can be loaded.
* lsm_bpf_setup() loads and attaches the LSM BPF program.
* lsm_bpf_unit_restrict_filesystems() populates the hash of maps BPF map with the
  cgroupID and the set of allowed or denied filesystems.
* lsm_bpf_cleanup() removes a cgroupID entry from the hash of maps.
* lsm_bpf_map_restrict_fs_fd() is a helper function to get the file
  descriptor of the BPF map.
* lsm_bpf_destroy() is a wrapper around the destroy function of the BPF
  skeleton file.
 2021-10-06 10:52:14 +02:00