summaryrefslogtreecommitdiff
path: root/src/core/bpf-lsm.h
Commit message (Collapse)AuthorAgeFilesLines
* manager: skip BPF cleanup if we never initializedZbigniew Jędrzejewski-Szmek2022-05-171-1/+1
| | | | | | | | | | | | | | This fixes a spurious warning from the manager running in user mode: systemd[1668]: Reached target sockets.target. systemd[1669]: Failed to create BPF map: Operation not permitted systemd[1669]: Finished systemd-tmpfiles-setup.service. systemd[1669]: Listening on dbus.socket. systemd[1669]: Reached target sockets.target. systemd[1669]: Reached target basic.target. systemd[1]: Started user@6.service. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2084955.
* core/bpf: lsm_bpf_supported() returns a booleanZbigniew Jędrzejewski-Szmek2022-05-171-1/+1
| | | | | The code was corret, but confusing, because it was treating the int as a boolean.
* core: add RestrictFileSystems= fragment parserIago López Galeiras2021-10-061-0/+12
| | | | | It takes an allow or deny list of filesystems services should have access to.
* core: add BPF LSM functionsIago Lopez Galeiras2021-10-061-0/+16
This adds 6 functions to implement RestrictFileSystems= * lsm_bpf_supported() checks if LSM BPF is supported. It checks that cgroupv2 is used, that BPF LSM is enabled, and tries to load the BPF LSM program which makes sure BTF and hash of maps are supported, and BPF LSM programs can be loaded. * lsm_bpf_setup() loads and attaches the LSM BPF program. * lsm_bpf_unit_restrict_filesystems() populates the hash of maps BPF map with the cgroupID and the set of allowed or denied filesystems. * lsm_bpf_cleanup() removes a cgroupID entry from the hash of maps. * lsm_bpf_map_restrict_fs_fd() is a helper function to get the file descriptor of the BPF map. * lsm_bpf_destroy() is a wrapper around the destroy function of the BPF skeleton file.
View Lorry Controller Status