Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf-restrict-fs: preserve cgroup_hash map during PID1 reexecution #32659

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

bpf-restrict-fs: preserve cgroup_hash map during PID1 reexecution #32659

wants to merge 1 commit into from

Commits on May 14, 2024

  1. bpf-restrict-fs: preserve cgroup_hash map during PID1 reexecution 

    When PID1 is re-executed, "cgroup_hash" map was destroyed and the "restrict_fs"
eBPF program was restarted with a new and empty map, loosing all entries for
the registered services (those with RestrictFileSystem= set):

   $ systemctl start test-restrict-fs.service

   $ bpftool map dump name cgroup_hash
   key: dd 0e 00 00 00 00 00 00  inner_map_id: 21
   Found 1 element

   $ systemctl daemon-reexec

   $ bpftool map dump name cgroup_hash
   Found 0 elements

The fix consists in keeping the fds of the eBPF prog/link/map opened in order
to make sure that the eBPF keeps running properly while PID1 is being
re-executed. When the new instance of PID1 is started, the old instance of the
eBPF program is replaced by a new version and the old eBPF map containing all
the registered services is reused by the new prog instance.
    @fbuihuu
    fbuihuu committed May 14, 2024
    Configuration menu
    Copy the full SHA
    2dc98f5 View commit details
    Browse the repository at this point in the history