Bug 1622986 - Lockdown kernel patch completely disables BPF syscall
Summary: Lockdown kernel patch completely disables BPF syscall
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 29
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks: IoT
TreeView+ depends on / blocked
 
Reported: 2018-08-28 10:32 UTC by Timothée Ravier
Modified: 2019-02-21 21:06 UTC (History)
19 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-02-21 21:06:23 UTC


Attachments (Terms of Use)

Description Timothée Ravier 2018-08-28 10:32:13 UTC
Description of problem:

Booting Fedora with Secure Boot enabled will result in Lockdown being enabled at boot time. This will completly disable the BPF system call for all users [1][2].

Unfortunately, this breaks the IPAddressAllow & IPAddressDeny systemd feature
[3][4][5].

I don't have a solution for this, but as far as I understand, this will also prevent other BPF use-cases (for example: Cilium on Fedora CoreOS).

[1] https://src.fedoraproject.org/rpms/kernel/blob/master/f/efi-lockdown.patch#_1525
[2]
https://git.kernel.org/pub/scm/linux/kernel/git/jforbes/linux.git/commit/?h=lockdown&id=0eb0d0851747787f7182b3e9d0d38edb5925a678
[3] https://github.com/systemd/systemd/blob/master/src/core/bpf-firewall.c
[4] https://github.com/systemd/systemd/blob/master/NEWS#L1192
[5]
https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html#IPAddressAllow=ADDRESS[/PREFIXLENGTH]%E2%80%A6

How reproducible:

Always

Steps to Reproduce:
1. Boot Fedora with lockdown enabled (for example: use Secure Boot)

Actual results:

systemd complains that it can not use the IPAddressAllow & IPAddressDeny features.

Expected results:

IPAddressAllow & IPAddressDeny features are available.

Comment 2 Justin M. Forbes 2018-08-28 20:38:23 UTC
This is a problematic one, but I don't know the real solution just yet. As it stands, I will drop the BPF restriction for the 4.18 rebases, but leave this bug open while I come up with something better.

Comment 3 Justin M. Forbes 2019-01-29 16:13:59 UTC
*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There are a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 29 kernel bugs.

Fedora 29 has now been rebased to 4.20.5-200.fc29.  Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you experience different issues, please open a new bug report for those.

Comment 4 Justin M. Forbes 2019-02-21 21:06:23 UTC
*********** MASS BUG UPDATE **************
This bug is being closed with INSUFFICIENT_DATA as there has not been a response in 3 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.


Note You need to log in before you can comment on or make changes to this bug.