Open aither64 opened 2 years ago
So the issue here seems to be that the BPF program can be loaded, but the kernel disallows attach without CAP_NET_ADMIN:
https://elixir.bootlin.com/linux/v5.10.100/source/kernel/bpf/syscall.c#L2916
Although this returns EPERM, the caller ignores that and returns EINVAL:
https://elixir.bootlin.com/linux/v5.10.100/source/kernel/bpf/syscall.c#L3008
So it seems it's not even supposed to work.
systemd in containers reports
when starting services with BPF firewall.
strace shows this:
Notice
expected_attach_type=BPF_CGROUP_INET_INGRESS
inBPF_PROG_LOAD
andattach_type=BPF_CGROUP_INET_EGRESS
inBPF_PROG_ATTACH
, not sure if this can be a problem.