Repository navigation
kernel: the console's lockdown lines are said, and compat.yml boots the lockdown check - #234
Merged
Merged
Conversation
…he lockdown check The README names both lines a guest's console prints at boot, `bpf-restrict-fs: Failed to load BPF object` and `use of bpf to read kernel RAM is restricted`: lockdown refusing bpf_probe_read_kernel to systemd, which costs the guest's units `RestrictFileSystems=`. Kept on purpose; integrity would let root read the kernel again. `task boot:lockdown` ran only by hand. compat.yml runs it after boot:compat, on this change's kernel, so it runs on every kernel change on main and before every release. boot:here kept only the binaries it replaces and dropped the release's e2fsprogs with them; it now removes only QEMU, so the test's debugfs is the release's, beside its image. Refs #231 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The spin-machine half of #231.
What changes
kernel/README.mdexplains both lines the console prints at boot.Lockdown: init: use of bpf to read kernel RAM is restrictedis lockdown refusingbpf_probe_read_kernelto systemd.bpf-restrict-fs: Failed to load BPF object: Invalid argumentis the consequence: systemd'sRestrictFileSystems=program needs that helper, so units in the guest cannot useRestrictFileSystems=. This is on purpose: integrity would bring it back, but root could read kernel memory again.compat.ymlrunstask boot:lockdownafterboot:compat, on this change's kernel, and also triggers onboot/lockdown_test.goand its script. The check now runs on every kernel change on main and before every release, not only by hand.boot:hereused to delete the release's wholebin/, which left out thedebugfsthe test needs to edit its copy of the base image. Now it removes onlyqemu-*, so the e2fsprogs tools are the release's, the same release the image comes from.Checked
task boot:hereagainst v20261109.01, thenSPIN_MACHINE_OUTPUT=_output/compat/here task boot:lockdown: PASS. The guest reportedlsm: lockdown,capability,bpfandlockdown: none integrity [confidentiality], and thebpf-restrict-fsline showed up on the console.task lint: OK, including actionlint and "every workflow step runs a task the Taskfile has".Not here
#231 also asks spin's e2e to assert
[confidentiality]on a running workspace. That belongs in the spin repo.🤖 Generated with Claude Code