nsresourced: fix BPF loading when using kernel compiled with Clang
This fixes an issue where nsresourced fails to load BPF on kernels
compiled with Clang (this output was from v259):
$ sudo env SYSTEMD_LOG_LEVEL=debug /usr/lib/systemd/systemd-nsresourced
; int BPF_PROG(userns_restrict_path_chown, struct path *path, void* uid, void *gid, int ret) { @ userns-restrict.bpf.c:134
...
; return validate_path(path, ret); @ userns-restrict.bpf.c:135
...
; static int validate_path(const struct path *path, int ret) { @ userns-restrict.bpf.c:120
...
; task = (struct task_struct*) bpf_get_current_task_btf(); @ userns-restrict.bpf.c:84
...
; task_userns = task->cred->user_ns; @ userns-restrict.bpf.c:85
...
R2 invalid mem access 'rcu_ptr_or_null_'
When Clang is used (which sets CONFIG_PAHOLE_HAS_BTF_TAG), btf_type_tag
support is enabled. As a result, an rcu type tag is added to
task_struct::cred:
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "STRUCT 'task_struct'"
[459] STRUCT 'task_struct' size=4672 vlen=242
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep -A200 "^\[459\] STRUCT 'task_struct'" | grep cred
'ptracer_cred' type_id=802 bits_offset=14528
'real_cred' type_id=802 bits_offset=14592
'cred' type_id=802 bits_offset=14656
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep '^\[802\]'
[802] PTR '(anon)' type_id=801
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep '^\[801\]'
[801] TYPE_TAG 'rcu' type_id=803
Since the struct ptr *could* be null, we have to add a null pointer
check to satisfy the bpf verifier.
Clayton Craft
bc6380ae07