kernel lockdown impact on bpf
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Starting from kernel 5.4, lockdown is actually merged in the kernel.
This issue is created to track its impact on bcc and tracing. We can add to proper documentation once 5.4 is released.
The bcc/tracing will be impacted when lockdown confidentiality mode is turned on.
The following is kernel source code for different lockdown subcategories for confidentiality mode:
https://github.com/torvalds/linux/blob/master/include/linux/security.h#L104-L126
The following three modes will have impact on bcc:
```
LOCKDOWN_DEBUGFS
LOCKDOWN_KPROBES
LOCKDOWN_BPF_READ
LOCKDOWN_PERF
```
kprobe will be disabled, debugfs most part will be disabled unless it is unprivileged. bpf_probe_read() and bpf_probe_read_str() will be disabled. perf_event_open() cannot open an event to get kernel data (others are fine).
Things could change as the 5.4 still has some way to go.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the referenced Linux security.h lockdown categories and compare them with the bcc/tracing behavior described in the issue. Check which effects remain accurate for kernel 5.4, then document the confirmed impact of LOCKDOWN_DEBUGFS, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ, and LOCKDOWN_PERF; the issue provides no bcc file or test to run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability, operating-systems, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100