dashboard/config: enable BPF LSM configs #2035
Conversation
There was a problem hiding this comment.
Oh, I forgot about this. Unfortunately, this cannot be enabled:
https://github.com/google/syzkaller/blob/master/dashboard/config/bits-syzbot.config#L153
There was a problem hiding this comment.
Ok, that will be bad news because BPF LSM requires the existence of vmlinux. Even if we replace the hook id with some random integer, it will never pass the verification (see here).
Is it possible to update pahole somehow?
There was a problem hiding this comment.
The ideal way to update it would be update the distro-provided package. But I just tried, and it's still not there:
# apt-get upgrade dwarves
# pahole --version
v1.9
Updating images on all syzbot machines is not something I can take on right now.
I have not looked into compiling a fresh version of pahole from source.
There was a problem hiding this comment.
Saw this instruction of building pahole from source on the krsi dev page.
sudo apt install -y libdwarf-dev libdw-dev &&
git clone git://git.kernel.org/pub/scm/devel/pahole/pahole.git && \
cd pahole && \
mkdir build && \
cd build && \
cmake -DCMAKE_INSTALL_PREFIX=/usr -D__LIB=lib .. && \
make -j $(nproc) && \
sudo make install
Enable some kernel settings that is necessary for BPF LSM. This pull request is blocked before pahole is updated to 1.13, see https://github.com/google/syzkaller/blob/master/dashboard/config/bits-syzbot.config#L150 for more information.
|
So we will probably need to wait before we can update pahole to 1.13. |
|
We cannot merge this b/c it breaks kernel build: |
Pull request google#1971 add the resource bpf_lsm_btf_id and make that a required resource for bpf$BPF_LSM_PROG_LOAD. However, we need google#2035 merged to get a bpf_lsm_btf_id, and the pull request is currently blocked by a pahole issue. Thus, bpf$BPF_LSM_PROG_LOAD will be disabled for now. This pull request makes bpf_lsm_btf_id optional for bpf$BPF_LSM_PROG_LOAD, so we can test this syscall before the issue is resolved.
Pull request #1971 add the resource bpf_lsm_btf_id and make that a required resource for bpf$BPF_LSM_PROG_LOAD. However, we need #2035 merged to get a bpf_lsm_btf_id, and the pull request is currently blocked by a pahole issue. Thus, bpf$BPF_LSM_PROG_LOAD will be disabled for now. This pull request makes bpf_lsm_btf_id optional for bpf$BPF_LSM_PROG_LOAD, so we can test this syscall before the issue is resolved.
|
#2096 will allow to resolve this |
Enable some kernel settings that is necessary for BPF LSM. These configs are listed on the KRSI website.
Also update the config to match fc80c51f @ Linux kernel.