Linux Kernel Lockdown for eBPF Applications

Issue Description

eBPF applications may fail to load or run properly when the Linux kernel lockdown feature is enabled. This guide will help you diagnose and resolve issues related to kernel lockdown, particularly for Qpoint eBPF applications.

Symptoms

1. eBPF programs fail to load with errors mentioning "invalid argument" or "unknown func".

2. Qpoint Tap fails to start with a panic message similar to:

   panic: failed to load BPF programs and maps: field MonitorCertOpenEntry: program monitor_cert_open_entry: load program: invalid argument: unknown func bpf_probe_write_user#36

Diagnosis Steps

1. Check current lockdown status:

   cat /sys/kernel/security/lockdown

   The output will show the current mode in square brackets, e.g., none [integrity] confidentiality.

2. Verify GRUB configuration:

   cat /etc/default/grub

   Look for the GRUB_CMDLINE_LINUX line and check if lockdown=none is present.

3. If lockdown is not set to "none" or the GRUB configuration doesn't match the current status, proceed to the fix.

Fix

1. Edit the GRUB configuration:

   sudo nano /etc/default/grub

2. Modify the GRUB_CMDLINE_LINUX line to include lockdown=none:

   GRUB_CMDLINE_LINUX="console=ttyS0,19200n8 net.ifnames=0 lockdown=none"

   Ensure there's a space between parameters.

3. Save the file and exit the editor.

4. Update GRUB:

   sudo update-grub

5. Reboot the system:

   sudo reboot

6. After reboot, verify the lockdown status again:

   cat /sys/kernel/security/lockdown

   It should now show [none] integrity confidentiality.

Additional Troubleshooting

If the issue persists after following these steps:

1. Check kernel version:

   uname -r

   Ensure you're running a kernel version that supports the eBPF features you're using.

2. Verify eBPF system requirements:

   sudo sysctl kernel.unprivileged_bpf_disabled

   If this returns 1, unprivileged eBPF is disabled and may need to be enabled.

3. Check for any security modules (e.g., SELinux, AppArmor) that might be interfering:

   sestatus
   aa-status

4. Review system logs for any related errors:

   sudo journalctl -b | grep -i bpf

Further Assistance

If you continue to experience issues after following this guide, please contact Qpoint support with the following information:

• Output of the diagnosis steps

• Complete error message from Qpoint Tap

• Kernel version (uname -r)

• Any relevant entries from system logs