From: Jiri Olsa on gitlab.com Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162 NOTE: Truncated patchset since committer email 'jolsa@kernel.org' does not match the submitter's GitLab public email address 'jolsa@redhat.com'. There's recent change [1] that adds new config option and sets unprivileged_bpf_disabled to 2 if the option is enabled (CONFIG_BPF_UNPRIV_DEFAULT_OFF).
The current RHEL specific behaviour is to set unprivileged_bpf_disabled to 1 by default and add boot command line argument to enable unpriv bpf.
The config option is enabled in previous patch, adding the taint for proc/sysctl unprivileged_bpf_disabled setup.
# sysctl kernel.unprivileged_bpf_disabled kernel.unprivileged_bpf_disabled = 2 # cat /proc/sys/kernel/tainted 0 # sysctl kernel.unprivileged_bpf_disabled=0 [ 45.751085] Unprivileged BPF has been enabled, tainting the kernel kernel.unprivileged_bpf_disabled = 0 # sysctl kernel.unprivileged_bpf_disabled=1 kernel.unprivileged_bpf_disabled = 1 # sysctl kernel.unprivileged_bpf_disabled=0 sysctl: setting key "kernel.unprivileged_bpf_disabled": Operation not permitted # sysctl kernel.unprivileged_bpf_disabled=2 sysctl: setting key "kernel.unprivileged_bpf_disabled": Operation not permitted # cat /proc/sys/kernel/tainted 2147483648
[1] 08389d888287 ("bpf: Add kconfig knob for disabling unpriv bpf by default") [2] 607f0e89af7e ("bpf: set unprivileged_bpf_disabled to 1 by default, add a boot parameter")
Fixes: 607f0e89af7e ("bpf: set unprivileged_bpf_disabled to 1 by default, add a boot parameter") Signed-off-by: Jiri Olsa jolsa@redhat.com
Signed-off-by: Jiri Olsa jolsa@redhat.com
--- Documentation/admin-guide/kernel-parameters.txt | 7 ++- kernel/bpf/syscall.c | 3 - kernel/sysctl.c | 5 ++ redhat/configs/common/generic/CONFIG_BPF_UNPRIV_DEFAULT_OFF | 1 + redhat/configs/pending-common/generic/CONFIG_BPF_UNPRIV_DEFAULT_OFF | 20 ---------- redhat/configs/pending-fedora/generic/CONFIG_BPF_UNPRIV_DEFAULT_OFF | 20 ---------- 6 files changed, 10 insertions(+), 46 deletions(-)
From: Justin Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162#note_5903501...
Added "include in releases" as the kernel will not build without it. I added it to dist-git for rc4 in Fedora, which is building with this patch now successfully.
From: Herton R. Krzesinski on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162#note_5904861...
Acked-by: Herton R. Krzesinski herton@redhat.com (via approve button)
From: Jiri Olsa on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162#note_5913362...
Acked-by: Jiri Olsa jolsa@redhat.com (via approve button)
From: Yauheni Kaliuta on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162#note_5914043...
The button is not available to me
Acked-by: Yauheni Kaliuta ykaliuta@redhat.com
From: Justin Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1162#note_5914107...
Acked-by: Justin Forbes jforbes@fedoraproject.org (via approve button)
kernel@lists.fedoraproject.org