search

lockc-project / lockc

Making containers more secure with eBPF and Linux Security Modules (LSM)
https://lockc-project.github.io/
Apache License 2.0
218 stars 19 forks source link

Trying to delete a non-existent BPF map entry about container #189

Closed vadorovsky closed 2 years ago

vadorovsky commented 2 years ago

Sometimes fresh lockc deployments have the following error:

2022-03-14T10:20:26.899644Z DEBUG lockcd: allowed paths initialized
2022-03-14T10:20:27.333873Z DEBUG lockcd: attached programs
2022-03-14T10:20:27.333965Z DEBUG lockc::runc: starting work loop
2022-03-14T10:21:42.615809Z DEBUG lockc::runc: received fanotify event path="/usr/local/sbin/runc" pid=3676
2022-03-14T10:21:42.616364Z DEBUG lockc::runc: containerd-shim argument="/usr/local/bin/containerd-shim-runc-v2"
2022-03-14T10:21:42.616780Z DEBUG lockc::runc: containerd-shim argument="-namespace"
2022-03-14T10:21:42.617081Z DEBUG lockc::runc: containerd-shim argument="k8s.io"
2022-03-14T10:21:42.617329Z DEBUG lockc::runc: containerd-shim argument="-id"
2022-03-14T10:21:42.617491Z DEBUG lockc::runc: containerd-shim argument="339efddea17bb1a88a2ee46d434a13bab134855688496bbbc35ef398ef4418c4"
2022-03-14T10:21:42.617517Z DEBUG lockc::runc: containerd-shim argument="-address"
2022-03-14T10:21:42.617536Z DEBUG lockc::runc: containerd-shim argument="/run/containerd/containerd.sock"
2022-03-14T10:21:42.669248Z DEBUG lockc::runc: received fanotify event path="/usr/local/sbin/runc" pid=3684
2022-03-14T10:21:42.670391Z DEBUG lockc::runc: containerd-shim argument="/usr/local/bin/containerd-shim-runc-v2"
2022-03-14T10:21:42.670480Z DEBUG lockc::runc: containerd-shim argument="-namespace"
2022-03-14T10:21:42.670491Z DEBUG lockc::runc: containerd-shim argument="k8s.io"
2022-03-14T10:21:42.670514Z DEBUG lockc::runc: containerd-shim argument="-id"
2022-03-14T10:21:42.670524Z DEBUG lockc::runc: containerd-shim argument="339efddea17bb1a88a2ee46d434a13bab134855688496bbbc35ef398ef4418c4"
2022-03-14T10:21:42.670534Z DEBUG lockc::runc: containerd-shim argument="-address"
2022-03-14T10:21:42.670542Z DEBUG lockc::runc: containerd-shim argument="/run/containerd/containerd.sock"
2022-03-14T10:21:42.693958Z DEBUG lockc::runc: received fanotify event path="/usr/local/sbin/runc" pid=3700
2022-03-14T10:21:42.695700Z DEBUG lockc::runc: containerd-shim argument="/usr/local/bin/containerd-shim-runc-v2"
2022-03-14T10:21:42.696360Z DEBUG lockc::runc: containerd-shim argument="-namespace"
2022-03-14T10:21:42.696655Z DEBUG lockc::runc: containerd-shim argument="k8s.io"
2022-03-14T10:21:42.696712Z DEBUG lockc::runc: containerd-shim argument="-address"
2022-03-14T10:21:42.696718Z DEBUG lockc::runc: containerd-shim argument="/run/containerd/containerd.sock"
2022-03-14T10:21:42.696732Z DEBUG lockc::runc: containerd-shim argument="-publish-binary"
2022-03-14T10:21:42.696739Z DEBUG lockc::runc: containerd-shim argument="/usr/local/bin/containerd"
2022-03-14T10:21:42.696755Z DEBUG lockc::runc: containerd-shim argument="-id"
2022-03-14T10:21:42.696763Z DEBUG lockc::runc: containerd-shim argument="95b4d844fd9d7d203bf00a77586346ced59b9eb8a7bbd0e91651a98b7d0f94b4"
2022-03-14T10:21:42.696776Z DEBUG lockc::runc: containerd-shim argument="-bundle"
2022-03-14T10:21:42.696782Z DEBUG lockc::runc: containerd-shim argument="/run/containerd/io.containerd.runtime.v2.task/k8s.io/95b4d844fd9d7d203bf00a77586346ced59b9eb8a7bbd0e91651a98b7d0f94b4"
2022-03-14T10:21:42.696790Z DEBUG lockc::runc: containerd-shim argument="delete"
2022-03-14T10:21:42.696800Z DEBUG lockc::runc: deleting container container="95b4d844fd9d7d203bf00a77586346ced59b9eb8a7bbd0e91651a98b7d0f94b4"
2022-03-14T10:21:42.697024Z DEBUG lockc::runc: deleting container container_id="95b4d844fd9d7d203bf00a77586346ced59b9eb8a7bbd0e91651a98b7d0f94b4"
2022-03-14T10:21:42.697132Z DEBUG lockc::maps: deleting container from eBPF map container="95b4d844fd9d7d203bf00a77586346ced59b9eb8a7bbd0e91651a98b7d0f94b4" map="containers"
2022-03-14T10:21:42.697425Z ERROR lockc::runc: failed to handle event error="the `bpf_map_delete_elem` syscall failed with code -1"

That's most likely because Kubernetes is deleting some container which wasn't registered by lockc before. Probably the best solution would be not returning any error, maybe a warning.