Clayton Craft
bc6380ae07
This fixes an issue where nsresourced fails to load BPF on kernels
compiled with Clang (this output was from v259):
$ sudo env SYSTEMD_LOG_LEVEL=debug /usr/lib/systemd/systemd-nsresourced
; int BPF_PROG(userns_restrict_path_chown, struct path *path, void* uid, void *gid, int ret) { @ userns-restrict.bpf.c:134
...
; return validate_path(path, ret); @ userns-restrict.bpf.c:135
...
; static int validate_path(const struct path *path, int ret) { @ userns-restrict.bpf.c:120
...
; task = (struct task_struct*) bpf_get_current_task_btf(); @ userns-restrict.bpf.c:84
...
; task_userns = task->cred->user_ns; @ userns-restrict.bpf.c:85
...
R2 invalid mem access 'rcu_ptr_or_null_'
When Clang is used (which sets CONFIG_PAHOLE_HAS_BTF_TAG), btf_type_tag
support is enabled. As a result, an rcu type tag is added to
task_struct::cred:
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "STRUCT 'task_struct'"
[459] STRUCT 'task_struct' size=4672 vlen=242
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep -A200 "^\[459\] STRUCT 'task_struct'" | grep cred
'ptracer_cred' type_id=802 bits_offset=14528
'real_cred' type_id=802 bits_offset=14592
'cred' type_id=802 bits_offset=14656
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep '^\[802\]'
[802] PTR '(anon)' type_id=801
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep '^\[801\]'
[801] TYPE_TAG 'rcu' type_id=803
Since the struct ptr *could* be null, we have to add a null pointer
check to satisfy the bpf verifier.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release