diff options
| author | Matteo Croce <teknoraver@meta.com> | 2024-07-01 21:58:30 +0200 |
|---|---|---|
| committer | Matteo Croce <teknoraver@meta.com> | 2024-09-11 23:07:00 +0200 |
| commit | 6d9ef22acdeac4b429efb75164341233955484af (patch) | |
| tree | 16e3452e31120d66a6da0f871cb6135e7198e1f4 /units | |
| parent | store the sysctls set by networkd (diff) | |
| download | systemd-6d9ef22acdeac4b429efb75164341233955484af.tar.xz systemd-6d9ef22acdeac4b429efb75164341233955484af.zip | |
emit a warning in networkd if managed sysctls are changed
Monitor the sysctl set by networkd for writes, if a sysctl is
overwritten with a different value than the one we set, emit a warning.
Writes are detected with an eBPF program attached as BPF_CGROUP_SYSCTL
which reports the sysctl writes only in net/.
The eBPF program only reports sysctl writes from a different cgroup than networkd.
To do this, it uses the `bpf_current_task_under_cgroup_proto()` helper,
which will be available allowed in BPF_CGROUP_SYSCTL from kernel 6.12[1].
Loading a BPF_CGROUP_SYSCTL program requires the CAP_SYS_ADMIN capability,
so drop it just after the program load, whether it loads successfully or not.
Writes are logged but permitted, in future the functionality can be
extended to also deny writes to managed sysctls.
[1] https://lore.kernel.org/bpf/20240819162805.78235-3-technoboy85@gmail.com/
Diffstat (limited to 'units')
| -rw-r--r-- | units/systemd-networkd.service.in | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 6141fdbb6d..cf81c7d841 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -20,9 +20,9 @@ Conflicts=shutdown.target initrd-switch-root.target Wants=systemd-networkd.socket network.target systemd-networkd-persistent-storage.service [Service] -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN BusName=org.freedesktop.network1 -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_BPF CAP_SYS_ADMIN DeviceAllow=char-* rw ExecStart=!!{{LIBEXECDIR}}/systemd-networkd FileDescriptorStoreMax=512 @@ -48,7 +48,7 @@ RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes SystemCallArchitectures=native SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service +SystemCallFilter=@system-service bpf Type=notify-reload User=systemd-network {{SERVICE_WATCHDOG}} |