systemd supports BPF (this came up in bug 890004 but I completely forgot about it) via dev-util/bpftool for network filters like restricting services to specific interfaces. There's two relevant meson options (https://github.com/systemd/systemd/blob/620788da173d354994eeae8211d276bcf9af602c/meson_options.txt#L513): * bpf-compiler * bpf-framework I dunno if we're going to need a BPF compiler when building with GCC, I assume we will. Arsen and I may be working on something which will need a dev-util/mingw64-toolchain-style drop-in package for bpf so that might work out. Both Fedora (https://src.fedoraproject.org/rpms/systemd/blob/rawhide/f/systemd.spec#_593) and opensuse (https://build.opensuse.org/package/view_file/openSUSE:Factory/systemd/systemd.spec?expand=1) seem to be enabling these bits. We probably shouldn't do it unconditionally given it may have heavy dependencies wrt toolchain and I don't think all arches even have BPF yet.
Arsen or I will likely handle this. The first step is getting bpf-toolchain into ::gentoo which I've put up a PR for. Then we need to speak to the folks handling BPF integration into the GNU toolchain to find out if it's ready for systemd.
I hope I'm not out of my depth here and that it's useful for possible implentation of it all. I'm having some fun compiling kernels and it seems to me that including BPF in systemd (used for RestrictFileSystems), is not fully compatible with some kernel options, also relating to security/hardening: - For systemd BPF_FRAMEWORK, CONFIG_DEBUG_INFO_BTF is needed for filesystem restriction: https://github.com/systemd/systemd/issues/32968 - CONFIG_DEBUG_INFO_BTF has the following dependencies: ( ! CONFIG_GCC_PLUGIN_RANDSTRUCT || CONFIG_COMPILE_TEST ) which may be linked to this discussion https://lore.kernel.org/bpf/202003301016.D0E239A0@keescook/T/ Moving ahead without CONFIG_DEBUG_INFO_BTF, I have the following errors on similar systems: systemd[1]: bpf-restrict-fs: Failed to load BPF object: No such process (libbpf 1.4.3) systemd[1]: bpf-lsm: Failed to load BPF object: No such process (libbpf 1.2.0) So it seems that it's not possible to have both the DEBUG_INFO_NONE (and the KSPP option of Gentoo) + BPF_FRAMEWORK with systemd, or well, maybe some options will not work (RestrictFileSystems).
