File 0051-Move-warning-about-unsupported-BPF-firewal... of Package systemd

Overview Repositories Revisions Requests Users Attributes Meta

File 0051-Move-warning-about-unsupported-BPF-firewall-right-be.patch of Package systemd (Revision a47769d8fb254159c07462a5675e1695)

Currently displaying revision a47769d8fb254159c07462a5675e1695 , Show latest

From 8229a61f5ffdba17be3988ae3258bc451cef2c08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Tue, 4 Jun 2019 15:01:27 +0200
Subject: [PATCH 51/51] Move warning about unsupported BPF firewall right
 before the firewall would be created

There's no need to warn about the firewall when parsing, because the unit might
not be started at all. Let's warn only when we're actually preparing to start
the firewall.

This changes behaviour:
- the warning is printed just once for all unit types, and not once
  for normal units and once for transient units.
- on repeat warnings, the message is not printed at all. There's already
  detailed debug info from bpf_firewall_compile(), so we don't need to repeat
  ourselves.
- when we are not root, let's say precisely that, not "lack of necessary privileges"
  and "the local system does not support BPF/cgroup firewalling".

Fixes #12673.

(cherry picked from commit 84d2744bc56a1876af90fba9c16df953f9c2cb84)

[fbui: adjust context]
---
 src/core/bpf-firewall.c      | 12 ++++++++++++
 src/core/bpf-firewall.h      |  2 ++
 src/core/cgroup.c            |  4 ++++
 src/core/dbus-cgroup.c       | 15 ---------------
 src/core/ip-address-access.c | 15 ---------------
 5 files changed, 18 insertions(+), 30 deletions(-)

diff --git a/src/core/bpf-firewall.c b/src/core/bpf-firewall.c
index 98f8bc4d8c..dd56d5f16c 100644
--- a/src/core/bpf-firewall.c
+++ b/src/core/bpf-firewall.c
@@ -782,3 +782,15 @@ int bpf_firewall_supported(void) {
                 return supported = BPF_FIREWALL_UNSUPPORTED;
         }
 }
+
+void emit_bpf_firewall_warning(Unit *u) {
+        static bool warned = false;
+
+        if (!warned) {
+                log_unit_warning(u, "unit configures an IP firewall, but %s.\n"
+                                    "(This warning is only shown for the first unit using IP firewalling.)",
+                                 getuid() != 0 ? "not running as root" :
+                                                 "the local system does not support BPF/cgroup firewalling");
+                warned = true;
+        }
+}
diff --git a/src/core/bpf-firewall.h b/src/core/bpf-firewall.h
index 3b0e00928f..e395f9ad7a 100644
--- a/src/core/bpf-firewall.h
+++ b/src/core/bpf-firewall.h
@@ -36,3 +36,5 @@ int bpf_firewall_install(Unit *u);
 
 int bpf_firewall_read_accounting(int map_fd, uint64_t *ret_bytes, uint64_t *ret_packets);
 int bpf_firewall_reset_accounting(int map_fd);
+
+void emit_bpf_firewall_warning(Unit *u);
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 0ed25e70d1..4394e24c6d 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -1152,6 +1152,10 @@ CGroupMask unit_get_target_mask(Unit *u) {
          * hierarchy that shall be enabled for it. */
 
         mask = unit_get_own_mask(u) | unit_get_members_mask(u) | unit_get_siblings_mask(u);
+
+        if (mask & CGROUP_MASK_BPF_FIREWALL & ~u->manager->cgroup_supported)
+                emit_bpf_firewall_warning(u);
+
         mask &= u->manager->cgroup_supported;
 
         return mask;
diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index a9d141dfdb..f299eab49e 100644
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -1322,21 +1322,6 @@ int bus_cgroup_set_property(
                         if (r < 0)
                                 return r;
                         unit_write_drop_in_private(u, mode, name, buf);
-
-                        if (*list) {
-                                r = bpf_firewall_supported();
-                                if (r < 0)
-                                        return r;
-                                if (r == BPF_FIREWALL_UNSUPPORTED) {
-                                        static bool warned = false;
-
-                                        log_full(warned ? LOG_DEBUG : LOG_WARNING,
-                                                 "Transient unit %s configures an IP firewall, but the local system does not support BPF/cgroup firewalling.\n"
-                                                 "Proceeding WITHOUT firewalling in effect! (This warning is only shown for the first started transient unit using IP firewalling.)", u->id);
-
-                                        warned = true;
-                                }
-                        }
                 }
 
                 return 1;
diff --git a/src/core/ip-address-access.c b/src/core/ip-address-access.c
index 99516ea7d5..41b5eb2ead 100644
--- a/src/core/ip-address-access.c
+++ b/src/core/ip-address-access.c
@@ -151,21 +151,6 @@ int config_parse_ip_address_access(
 
         *list = ip_address_access_reduce(*list);
 
-        if (*list) {
-                r = bpf_firewall_supported();
-                if (r < 0)
-                        return r;
-                if (r == BPF_FIREWALL_UNSUPPORTED) {
-                        static bool warned = false;
-
-                        log_full(warned ? LOG_DEBUG : LOG_WARNING,
-                                 "File %s:%u configures an IP firewall (%s=%s), but the local system does not support BPF/cgroup based firewalling.\n"
-                                 "Proceeding WITHOUT firewalling in effect! (This warning is only shown for the first loaded unit using IP firewalling.)", filename, line, lvalue, rvalue);
-
-                        warned = true;
-                }
-        }
-
         return 0;
 }
 
-- 
2.16.4

Places

File 0051-Move-warning-about-unsupported-BPF-firewall-right-be.patch of Package systemd (Revision a47769d8fb254159c07462a5675e1695)

Places