Uncertain permissions needed to enable use of BPF (a... | rr-debugger/rr

Nobody has claimed this yet.

Trying to prepare reporting another issue, I found in Debian is now a BPF enabled rr version.
Unfortunately I receive with my payload the below bpf failures on replay, while the replay itself succeeds.

When I manipulate /proc/sys/kernel/unprivileged_bpf_disabled the error changes slightly, but still shows up.

The failure does not show up when replaying as root (which I guess is the least desired method security-wise).

Is it known which permissions my user or the rr executable is missing and how they can be granted?

Would it be an improvement to make rr's use of BPF runtime selectable via command line or environment?

Details

benutzer@debian:~$ ulimit -a | grep locked
max locked memory           (kbytes, -l) 8192
benutzer@debian:~$ rr --version
rr version 5.9.0 
benutzer@debian:~$ dpkg -l | grep " rr "
ii  rr                                   5.9.0-2                         amd64        application execution recorder, player and debugger
benutzer@debian:~$ which rr
/usr/bin/rr
benutzer@debian:~$ 


benutzer@debian:~$ export PATH=/opt/wine-devel/bin:$PATH_ORIG
benutzer@debian:~$ xterm &
[1] 97364
benutzer@debian:~$ debian_chroot=rr rr record bash
rr: Saving execution to trace directory `/home/benutzer/.local/share/rr/bash-16'.
(rr)benutzer@debian:~$ wineserver -p60
                                                                # start in the xterm above `wine winemine` to have most wine processes started up outside of the recording
(rr)benutzer@debian:~$ wine timeout /T 3
waiting since 2 sec. press a key to continue...
(rr)benutzer@debian:~$ wineserver -k
(rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ stty sane
(rr)benutzer@debian:~$ exit
exit
benutzer@debian:~$ 


benutzer@debian:~$ rr replay -a bash-16
(rr)benutzer@debian:~$ wineserver -p60
(rr)benutzer@debian:~$ wine timeout /T 3
libbpf: Failed to bump RLIMIT_MEMLOCK (err = -1), you might need to do it explicitly!
libbpf: Error in bpf_object__probe_loading():Operation not permitted(1). Couldn't load trivial BPF program. Make sure your kernel supports BPF (CONFIG_BPF_SYSCALL=y) and/or that RLIMIT_MEMLOCK is set to big enough value.
libbpf: failed to load object '/usr/bin/../share/rr/async_event_filter.o'
[ERROR ./src/PerfCounters.cc:1207:get_or_create() errno: EPERM] Failed to load bpf at /usr/bin/../share/rr/async_event_filter.o into the kernel. Do we have permissions?
waiting since 2 sec. press a key to continue...
(rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ stty sane
(rr)benutzer@debian:~$ exit
exit
benutzer@debian:~$ 


root@debian:~# echo 0 > /proc/sys/kernel/unprivileged_bpf_disabled
benutzer@debian:~$ rr replay -a bash-16
(rr)benutzer@debian:~$ wineserver -p60
(rr)benutzer@debian:~$ wine timeout /T 3
libbpf: prog 'match_registers': BPF program load failed: Operation not permitted
libbpf: prog 'match_registers': failed to load: -1
libbpf: failed to load object '/usr/bin/../share/rr/async_event_filter.o'
[ERROR ./src/PerfCounters.cc:1207:get_or_create() errno: EPERM] Failed to load bpf at /usr/bin/../share/rr/async_event_filter.o into the kernel. Do we have permissions?
waiting since 2 sec. press a key to continue...
(rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ stty sane
(rr)benutzer@debian:~$ exit
exit
benutzer@debian:~$ 


root@debian:~# which rr
/usr/bin/rr
root@debian:~# rr replay -a /home/benutzer/.local/share/rr/bash-16
(rr)benutzer@debian:~$ wineserver -p60
(rr)benutzer@debian:~$ wine timeout /T 3
waiting since 2 sec. press a key to continue...
(rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ (rr)benutzer@debian:~$ stty sane
(rr)benutzer@debian:~$ exit
exit
root@debian:~#

CC: @skitt

Reproduce the replay failure using the Debian rr 5.9.0 setup and the shown BPF and RLIMIT_MEMLOCK settings. Start at src/PerfCounters.cc:1207 and the packaged share/rr/async_event_filter.o, then determine the required permissions and whether a runtime switch is needed. Done means replay handles the non-root configuration without the reported EPERM failure, or clearly documents the required setup.

Written by the indexing model from the issue text.

Uncertain permissions needed to enable use of BPF (async_event_filter.o).

Description

Contributor guide

First steps

Research direction

Assessment