Bug 917228 – sys-apps/systemd: wire up USE=bpf

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Sam James 2023-11-12 07:18:40 UTC]

systemd supports BPF (this came up in bug 890004 but I completely forgot about it) via dev-util/bpftool for network filters like restricting services to specific interfaces.

There's two relevant meson options (https://github.com/systemd/systemd/blob/620788da173d354994eeae8211d276bcf9af602c/meson_options.txt#L513):
* bpf-compiler
* bpf-framework

I dunno if we're going to need a BPF compiler when building with GCC, I assume we will. Arsen and I may be working on something which will need a dev-util/mingw64-toolchain-style drop-in package for bpf so that might work out.

Both Fedora (https://src.fedoraproject.org/rpms/systemd/blob/rawhide/f/systemd.spec#_593) and opensuse (https://build.opensuse.org/package/view_file/openSUSE:Factory/systemd/systemd.spec?expand=1) seem to be enabling these bits.

We probably shouldn't do it unconditionally given it may have heavy dependencies wrt toolchain and I don't think all arches even have BPF yet.

[Comment 1 Sam James 2024-05-11 01:12:01 UTC]

Arsen or I will likely handle this. The first step is getting bpf-toolchain into ::gentoo which I've put up a PR for. Then we need to speak to the folks handling BPF integration into the GNU toolchain to find out if it's ready for systemd.

[Comment 2 tithom 2024-07-25 12:14:11 UTC]

I hope I'm not out of my depth here and that it's useful for possible implentation of it all. 

I'm having some fun compiling kernels and it seems to me that including BPF in systemd (used for RestrictFileSystems), is not fully compatible with some kernel options, also relating to security/hardening:

- For systemd BPF_FRAMEWORK, CONFIG_DEBUG_INFO_BTF is needed for filesystem restriction: https://github.com/systemd/systemd/issues/32968
- CONFIG_DEBUG_INFO_BTF has the following dependencies: ( ! CONFIG_GCC_PLUGIN_RANDSTRUCT || CONFIG_COMPILE_TEST ) which may be linked to this discussion https://lore.kernel.org/bpf/202003301016.D0E239A0@keescook/T/

Moving ahead without CONFIG_DEBUG_INFO_BTF, I have the following errors on similar systems:
systemd[1]: bpf-restrict-fs: Failed to load BPF object: No such process (libbpf 1.4.3)
systemd[1]: bpf-lsm: Failed to load BPF object: No such process (libbpf 1.2.0)

So it seems that it's not possible to have both the DEBUG_INFO_NONE (and the KSPP option of Gentoo) + BPF_FRAMEWORK with systemd, or well, maybe some options will not work (RestrictFileSystems).

[Comment 3 Larry the Git Cow 2024-08-07 02:53:21 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e802488062f680f9a5ffe2a2ccb3bbefc3a8adb5

commit e802488062f680f9a5ffe2a2ccb3bbefc3a8adb5
Author:     Sam James <[e-mail]>
AuthorDate: 2024-05-06 17:30:21 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-08-07 02:52:39 +0000

    sys-devel/bpf-toolchain: new package, add 14.2.0
    
    Heavily inspired by, and based on, dev-util/mingw64-toolchain. This provides
    the bpf-unknown-none toolchain for use with DTrace (to be packaged) and
    systemd.
    
    Users may wish to use crossdev if they want to customise their toolchain -
    this is "just" a convenience option for e.g. aforementioned ebuilds to depend
    on and have things Just Work.
    
    Bug: https://bugs.gentoo.org/917228
    Signed-off-by: Sam James <[e-mail]>

 sys-devel/bpf-toolchain/Manifest                   |   2 +
 .../bpf-toolchain/bpf-toolchain-14.2.0.ebuild      | 201 +++++++++++++++++++++
 sys-devel/bpf-toolchain/metadata.xml               |  12 ++
 3 files changed, 215 insertions(+)

[Comment 4 Sam James 2024-08-07 04:55:52 UTC]

(In reply to Thomas from comment #2)
> I hope I'm not out of my depth here and that it's useful for possible
> implentation of it all. 
> 

Thomas, I think this is an important point - could you file a new bug specifically about the kconfig meta option being problematic? It's going to cause issues for dtrace too.

[Comment 5 Larry the Git Cow 2024-08-25 13:56:47 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=de67dbf4abdef923ca8f7af0e48d4fcc5b220a96

commit de67dbf4abdef923ca8f7af0e48d4fcc5b220a96
Author:     Sam James <[e-mail]>
AuthorDate: 2024-08-23 16:08:10 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-08-25 13:56:09 +0000

    sys-apps/systemd: wire up BPF support
    
    Clang support is not yet done.
    
    Bug: https://bugs.gentoo.org/917228
    Signed-off-by: Sam James <[e-mail]>

 profiles/arch/alpha/package.use.mask     |  4 ++++
 profiles/arch/hppa/package.use.mask      |  4 ++++
 profiles/arch/ia64/package.use.mask      |  4 ++++
 profiles/arch/loong/package.use.mask     |  4 ++++
 profiles/arch/s390/package.use.mask      |  4 ++++
 profiles/arch/sparc/package.use.mask     |  4 ++++
 sys-apps/systemd/files/256-bpf-gcc.patch | 26 ++++++++++++++++++++++++++
 sys-apps/systemd/metadata.xml            |  1 +
 sys-apps/systemd/systemd-256.5.ebuild    | 10 +++++++++-
 sys-apps/systemd/systemd-9999.ebuild     |  9 ++++++++-
 10 files changed, 68 insertions(+), 2 deletions(-)

[Comment 6 Sam James 2024-08-25 14:00:02 UTC]

All done. I'm having discussions with misc. people about the randstruct problem.

[Comment 7 Larry the Git Cow 2024-09-26 22:16:23 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cabb52b81ae9e040b57148085fd436ca1708695d

commit cabb52b81ae9e040b57148085fd436ca1708695d
Author:     Haochen Tong <[e-mail]>
AuthorDate: 2024-09-23 16:00:04 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-09-26 22:14:55 +0000

    sys-apps/systemd: add missing dependency libbpf
    
    Bug: https://bugs.gentoo.org/917228
    Signed-off-by: Haochen Tong <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/38745
    Signed-off-by: Sam James <[e-mail]>

 sys-apps/systemd/systemd-256.6.ebuild | 1 +
 sys-apps/systemd/systemd-9999.ebuild  | 1 +
 2 files changed, 2 insertions(+)