libbpf-bootstrap icon indicating copy to clipboard operation
libbpf-bootstrap copied to clipboard

LSM program crashes on Linux 5.15

Open kochia3 opened this issue 3 years ago • 0 comments

Program:

SEC("lsm/file_open")
int BPF_PROG(file_open_lsm, struct file *file, int ret)
{
	return ret;
}

OS: Linux 5.15.41-android

zcat /proc/config.gz

CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_JIT_DEFAULT_ON=y
# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
# CONFIG_BPF_PRELOAD is not set
CONFIG_BPF_LSM=y
# CONFIG_BPFILTER is not set
# CONFIG_BPF_STREAM_PARSER is not set
CONFIG_BPF_LIRC_MODE2=y
# CONFIG_FTRACE_SYSCALLS is not set
CONFIG_BPF_EVENTS=y
# CONFIG_BPF_KPROBE_OVERRIDE is not set

cat /sys/kernel/security/lsm

capability,selinux,bpf

Error:

libbpf: prog 'file_open_lsm': failed to attach: Device or resource busy
libbpf: prog 'file_open_lsm': failed to auto-attach: -16

strace:

openat(AT_FDCWD, "/sys/bus/event_source/devices/kprobe/format/retprobe", O_RDONLY) = 33
fstat(33, {st_mode=S_IFREG|0444, st_size=4096, ...}) = 0
read(33, "config:0\n", 4096)            = 9
read(33, "", 4096)                      = 0
close(33)                               = 0
perf_event_open({type=0x6 /* PERF_TYPE_??? */, size=0x80 /* PERF_ATTR_SIZE_??? */, config=0x1, ...}, -1, 0, -1, PERF_FLAG_FD_CLOEXEC) = 33
bpf(0x1c /* BPF_??? */, 0x7ffda49a7558, 144) = 34
ioctl(33, PERF_EVENT_IOC_ENABLE, 0)     = 0
bpf(0x1c /* BPF_??? */, 0x7ffda49a78b8, 144) = -1 EINVAL (Invalid argument)
bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name=NULL, prog_fd=20}}, 144) = -1 EBUSY (Device or resource busy)
write(2, "libbpf: prog 'file_open_lsm': fa"..., 72libbpf: prog 'file_open_lsm': failed to attach: Device or resource busy

There are others as well, kprobes - but it only crashes if I'm using the lsm hook

kochia3 avatar Oct 15 '22 08:10 kochia3