# Linux Kernel Lockdown for eBPF Applications

## Issue Description

eBPF applications may fail to load or run properly when the Linux kernel lockdown feature is enabled. This guide will help you diagnose and resolve issues related to kernel lockdown, particularly for Qpoint eBPF applications.

## Symptoms

1. eBPF programs fail to load with errors mentioning "invalid argument" or "unknown func".
2. Qpoint Tap fails to start with a panic message similar to:

   {% code overflow="wrap" %}

   ```
   panic: failed to load BPF programs and maps: field MonitorCertOpenEntry: program monitor_cert_open_entry: load program: invalid argument: unknown func bpf_probe_write_user#36
   ```

   {% endcode %}## Diagnosis Steps
3. Check current lockdown status:

   ```
   cat /sys/kernel/security/lockdown
   ```

   The output will show the current mode in square brackets, e.g., `none [integrity] confidentiality`.
4. Verify GRUB configuration:

   ```
   cat /etc/default/grub
   ```

   Look for the `GRUB_CMDLINE_LINUX` line and check if `lockdown=none` is present.
5. If lockdown is not set to "none" or the GRUB configuration doesn't match the current status, proceed to the fix.

## Fix

1. Edit the GRUB configuration:

   ```
   sudo nano /etc/default/grub
   ```
2. Modify the `GRUB_CMDLINE_LINUX` line to include `lockdown=none`:

   ```
   GRUB_CMDLINE_LINUX="console=ttyS0,19200n8 net.ifnames=0 lockdown=none"
   ```

   Ensure there's a space between parameters.
3. Save the file and exit the editor.
4. Update GRUB:

   ```
   sudo update-grub
   ```
5. Reboot the system:

   ```
   sudo reboot
   ```
6. After reboot, verify the lockdown status again:

   ```
   cat /sys/kernel/security/lockdown
   ```

   It should now show `[none] integrity confidentiality`.

## Additional Troubleshooting

If the issue persists after following these steps:

1. Check kernel version:

   ```
   uname -r
   ```

   Ensure you're running a kernel version that supports the eBPF features you're using.
2. Verify eBPF system requirements:

   ```
   sudo sysctl kernel.unprivileged_bpf_disabled
   ```

   If this returns 1, unprivileged eBPF is disabled and may need to be enabled.
3. Check for any security modules (e.g., SELinux, AppArmor) that might be interfering:

   ```
   sestatus
   aa-status
   ```
4. Review system logs for any related errors:

   ```
   sudo journalctl -b | grep -i bpf
   ```

## Further Assistance

If you continue to experience issues after following this guide, please contact Qpoint support with the following information:

* Output of the diagnosis steps
* Complete error message from Qpoint Tap
* Kernel version (`uname -r`)
* Any relevant entries from system logs


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.qpoint.io/troubleshooting/linux-kernel-lockdown-for-ebpf-applications.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.