Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kernel: disable BPF preload and bpfilter helpers #261

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

bcressey
Copy link
Contributor

Issue number:
Related: bottlerocket-os/bottlerocket-sdk#222

Description of changes:
The kernel build will automatically enable these helpers if it finds that the target C compiler can build a userspace program that depends on the C library. However, the helpers require additional libraries such as libelf which are not guaranteed to be present.

Since we don't make use of precompiled BPF programs, disable these config options rather than leaving it up to auto-detect.

Testing done:
With the current SDK that does not include glibc, diff-kernel-config reports no differences in the config files.

With a custom SDK that does include glibc, diff-kernel-config reports these changes:

==> configs-4/config-aarch64-5.10-diff <==
+BPFILTER_UMH n
+BPF_PRELOAD_UMD n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

==> configs-4/config-aarch64-5.15-diff <==
+BPFILTER_UMH n
+BPF_PRELOAD_UMD n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

==> configs-4/config-aarch64-6.1-diff <==
+BPFILTER_UMH n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

==> configs-4/config-x86_64-5.10-diff <==
+BPFILTER_UMH n
+BPF_PRELOAD_UMD n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

==> configs-4/config-x86_64-5.15-diff <==
+BPFILTER_UMH n
+BPF_PRELOAD_UMD n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

==> configs-4/config-x86_64-6.1-diff <==
+BPFILTER_UMH n
+CC_CAN_LINK y
+CC_CAN_LINK_STATIC y

Note that CC_CAN_LINK and CC_CAN_LINK_STATIC will be set automatically because the more complete sys-roots allow the target C compiler to compile a test program.

The other values are newly added and are set to "no" to prevent the kernel build from failing when libelf is not found, since that library is not present in the SDK's sys-roots.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

The kernel build will automatically enable these helpers if it finds
that the target C compiler can build a userspace program that depends
on the C library. However, the helpers require additional libraries
such as libelf which are not guaranteed to be present.

Since we don't make use of precompiled BPF programs, disable these
config options rather than leaving it up to auto-detect.

Signed-off-by: Ben Cressey <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants