Description of problem: Booting Fedora with Secure Boot enabled will result in Lockdown being enabled at boot time. This will completly disable the BPF system call for all users [1][2]. Unfortunately, this breaks the IPAddressAllow & IPAddressDeny systemd feature [3][4][5]. I don't have a solution for this, but as far as I understand, this will also prevent other BPF use-cases (for example: Cilium on Fedora CoreOS). [1] https://src.fedoraproject.org/rpms/kernel/blob/master/f/efi-lockdown.patch#_1525 [2] https://git.kernel.org/pub/scm/linux/kernel/git/jforbes/linux.git/commit/?h=lockdown&id=0eb0d0851747787f7182b3e9d0d38edb5925a678 [3] https://github.com/systemd/systemd/blob/master/src/core/bpf-firewall.c [4] https://github.com/systemd/systemd/blob/master/NEWS#L1192 [5] https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html#IPAddressAllow=ADDRESS[/PREFIXLENGTH]%E2%80%A6 How reproducible: Always Steps to Reproduce: 1. Boot Fedora with lockdown enabled (for example: use Secure Boot) Actual results: systemd complains that it can not use the IPAddressAllow & IPAddressDeny features. Expected results: IPAddressAllow & IPAddressDeny features are available.
From: https://lists.fedoraproject.org/archives/list/kernel@lists.fedoraproject.org/thread/TDNMHIVEAKJHCYD4ZTDLRA6LW42CATGQ/
This is a problematic one, but I don't know the real solution just yet. As it stands, I will drop the BPF restriction for the 4.18 rebases, but leave this bug open while I come up with something better.
*********** MASS BUG UPDATE ************** We apologize for the inconvenience. There are a large number of bugs to go through and several of them have gone stale. Due to this, we are doing a mass bug update across all of the Fedora 29 kernel bugs. Fedora 29 has now been rebased to 4.20.5-200.fc29. Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel. If you experience different issues, please open a new bug report for those.
*********** MASS BUG UPDATE ************** This bug is being closed with INSUFFICIENT_DATA as there has not been a response in 3 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.