mirror of
https://github.com/systemd/systemd.git
synced 2024-12-22 17:35:35 +03:00
6d9ef22acd
Monitor the sysctl set by networkd for writes, if a sysctl is overwritten with a different value than the one we set, emit a warning. Writes are detected with an eBPF program attached as BPF_CGROUP_SYSCTL which reports the sysctl writes only in net/. The eBPF program only reports sysctl writes from a different cgroup than networkd. To do this, it uses the `bpf_current_task_under_cgroup_proto()` helper, which will be available allowed in BPF_CGROUP_SYSCTL from kernel 6.12[1]. Loading a BPF_CGROUP_SYSCTL program requires the CAP_SYS_ADMIN capability, so drop it just after the program load, whether it loads successfully or not. Writes are logged but permitted, in future the functionality can be extended to also deny writes to managed sysctls. [1] https://lore.kernel.org/bpf/20240819162805.78235-3-technoboy85@gmail.com/ |
||
|---|---|---|
| .. | ||
| meson.build | ||
| systemd.be.catalog.in | ||
| systemd.be@latin.catalog.in | ||
| systemd.bg.catalog.in | ||
| systemd.catalog.in | ||
| systemd.da.catalog.in | ||
| systemd.de.catalog.in | ||
| systemd.fr.catalog.in | ||
| systemd.hr.catalog.in | ||
| systemd.hu.catalog.in | ||
| systemd.it.catalog.in | ||
| systemd.ko.catalog.in | ||
| systemd.pl.catalog.in | ||
| systemd.pt_BR.catalog.in | ||
| systemd.ru.catalog.in | ||
| systemd.sr.catalog.in | ||
| systemd.zh_CN.catalog.in | ||
| systemd.zh_TW.catalog.in | ||