kernel: Enable CONFIG_BPF_LSM on Ubuntu

Bug #1905975 reported by KP Singh
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Groovy
Fix Released
Undecided
Unassigned
Hirsute
Fix Released
Undecided
Unassigned
linux-aws (Ubuntu)
New
Undecided
Unassigned
Groovy
Fix Released
Medium
Unassigned
Hirsute
New
Undecided
Unassigned

Bug Description

== Impact ==

Enabling CONFIG_BPF_LSM in the KConfig of Ubuntu Kernels, allowing users to use BPF LSM programs.

== Background ==

The BPF LSM was merged into the Linux kernel 5.7

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=641cd7b06c911c5935c34f24850ea18690649917

https://outflux.net/blog/archives/2020/09/21/security-things-in-linux-v5-7

It allows users to implement MAC and Audit Policies using BPF programs. As a follow-up from the interest generated by the LSM on BPF/Linux conferences and on request from users, we’d like to request the enabling of CONFIG_BPF_LSM on Ubuntu starting with H.

The LSM won't be added to the list of active LSMs by default (in CONFIG_LSM or lsm= on the boot parameters) yet, as it adds an indirect function call overhead by registering an empty LSM hook for all hooks. However enabling it in the kernel config will support users who wish to use BPF LSM programs without needing to replace their kernel image.

The LSM can be made "active" by default when our work on getting rid of this overhead is merged in the kernel:

https://<email address hidden>

== Regression Potential ==

None. The LSM is not active by default, so it does not have any performance or functional regression.

CVE References

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1905975

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
Kees Cook (kees) wrote :

(This is a feature request, so no log needed.)

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Changed in linux (Ubuntu Groovy):
status: New → Confirmed
Revision history for this message
KP Singh (sinkap) wrote :

Posted a patch for this on https://lists.ubuntu.com/archives/kernel-team/2020-November/115178.html targeting both G and H.

Revision history for this message
Luca Boccassi (bluca) wrote :

FYI, Debian 11 will ship with BPF_LSM built in, but disabled by default (by explicitly setting CONFIG_LSM to the desired list)

Revision history for this message
KP Singh (sinkap) wrote :

Thanks! I had also filed a feature request on Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983329

I will keep everyone posted on once make some progress on the static call work so that the LSM can be truly zero overhead and we can also add it back to CONFIG_LSM

Revision history for this message
Kelsey Steele (kelsey-steele) wrote :

This is already in Hirsute. marking as released

Changed in linux (Ubuntu Groovy):
status: Confirmed → Fix Committed
Changed in linux (Ubuntu Hirsute):
status: Confirmed → Fix Committed
status: Fix Committed → Fix Released
Tim Gardner (timg-tpi)
Changed in linux-aws (Ubuntu Groovy):
status: New → In Progress
importance: Undecided → Medium
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-groovy' to 'verification-done-groovy'. If the problem still exists, change the tag 'verification-needed-groovy' to 'verification-failed-groovy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-groovy
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (28.3 KiB)

This bug was fixed in the package linux - 5.8.0-49.55

---------------
linux (5.8.0-49.55) groovy; urgency=medium

  * groovy/linux: 5.8.0-49.55 -proposed tracker (LP: #1921053)

  * selftests: bpf verifier fails after sanitize_ptr_alu fixes (LP: #1920995)
    - bpf: Simplify alu_limit masking for pointer arithmetic
    - bpf: Add sanity check for upper ptr_limit
    - bpf, selftests: Fix up some test_verifier cases for unprivileged

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  * improper memcg accounting causes NULL pointer derefs (LP: #1918668)
    - SAUCE: Revert "mm: memcg/slab: optimize objcg stock draining"

  * kernel: Enable CONFIG_BPF_LSM on Ubuntu (LP: #1905975)
    - [Config] Enable CONFIG_BPF_LSM

  * Groovy update: upstream stable patchset 2021-03-10 (LP: #1918516)
    - gpio: mvebu: fix pwm .get_state period calculation
    - HID: wacom: Correct NULL dereference on AES pen proximity
    - media: v4l2-subdev.h: BIT() is not available in userspace
    - RDMA/vmw_pvrdma: Fix network_hdr_type reported in WC
    - kernel/io_uring: cancel io_uring before task works
    - io_uring: dont kill fasync under completion_lock
    - objtool: Don't fail on missing symbol table
    - mm/page_alloc: add a missing mm_page_alloc_zone_locked() tracepoint
    - mm: fix a race on nr_swap_pages
    - tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
    - iwlwifi: provide gso_type to GSO packets
    - tty: avoid using vfs_iocb_iter_write() for redirected console writes
    - ACPI: sysfs: Prefer "compatible" modalias
    - kernel: kexec: remove the lock operation of system_transition_mutex
    - ALSA: hda/realtek: Enable headset of ASUS B1400CEPE with ALC256
    - ALSA: hda/via: Apply the workaround generically for Clevo machines
    - parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES
    - media: cec: add stm32 driver
    - media: hantro: Fix reset_raw_fmt initialization
    - media: rc: fix timeout handling after switch to microsecond durations
    - media: rc: ite-cir: fix min_timeout calculation
    - media: rc: ensure that uevent can be read directly after rc device register
    - ARM: dts: tbs2910: rename MMC node aliases
    - ARM: dts: ux500: Reserve memory carveouts
    - ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming
    - wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
    - ASoC: AMD Renoir - refine DMI entries for some Lenovo products
    - drm/i915: Always flush the active worker before returning from the wait
    - drm/i915/gt: Always try to reserve GGTT address 0x0
    - drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes
    - net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family
    - s390: uv: Fix sysfs max number of VCPUs reporting
    - s390/vfio-ap: No need to disable IRQ after queue reset
    - PM: hibernate: flush swap writer after marking
    - x86/entry: Emit a symbol for register restoring thunk
    - efi/apple-properties: Reinstate support for boolean properties
    - drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs
    - drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[]
   ...

Changed in linux (Ubuntu Groovy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (30.7 KiB)

This bug was fixed in the package linux-aws - 5.8.0-1028.30

---------------
linux-aws (5.8.0-1028.30) groovy; urgency=medium

  * groovy/linux-aws: 5.8.0-1028.30 -proposed tracker (LP: #1921043)

  * kernel: Enable CONFIG_BPF_LSM on Ubuntu (LP: #1905975)
    - [Config][aws] Enable CONFIG_BPF_LSM

  * Groovy update: upstream stable patchset 2021-03-05 (LP: #1917964)
    - [Config][aws] updateconfigs for USB_BDC_PCI

  * Enforce CONFIG_DRM_BOCHS=m (LP: #1916290)
    - [Config][aws] Enforce CONFIG_DRM_BOCHS=m

  * Groovy update: upstream stable patchset 2021-02-25 (LP: #1916960)
    - [Config][aws] updateconfigs for KPROBE_EVENTS_ON_NOTRACE

  * aws: update Xen hibernation patch set (LP: #1913410)
    - Revert "UBUNTU: SAUCE: xen: Update sched clock offset to avoid system
      instability in hibernation"
    - Revert "UBUNTU: SAUCE: xen: Introduce wrapper for save/restore sched clock
      offset"
    - Revert "UBUNTU: SAUCE: x86/xen: save and restore steal clock"
    - Revert "UBUNTU: SAUCE: xen/time: introduce xen_{save,restore}_steal_clock"
    - Revert "UBUNTU: SAUCE: xen-netfront: add callbacks for PM suspend and
      hibernation"
    - Revert "UBUNTU: SAUCE: xen-blkfront: add callbacks for PM suspend and
      hibernation"
    - Revert "UBUNTU: SAUCE: x86/xen: add system core suspend and resume
      callbacks"
    - Revert "UBUNTU: SAUCE: x86/xen: Introduce new function to map
      HYPERVISOR_shared_info on Resume"
    - Revert "UBUNTU: SAUCE: xenbus: add freeze/thaw/restore callbacks support"
    - Revert "UBUNTU: SAUCE: xen/manage: keep track of the on-going suspend mode"
    - SAUCE: xen/manage: keep track of the on-going suspend mode
    - SAUCE: xenbus: add freeze/thaw/restore callbacks support
    - SAUCE: x86/xen: Introduce new function to map HYPERVISOR_shared_info on
      Resume
    - SAUCE: x86/xen: add system core suspend and resume callbacks
    - SAUCE: xen-netfront: add callbacks for PM suspend and hibernation support
    - SAUCE: xen-blkfront: add callbacks for PM suspend and hibernation
    - SAUCE: xen/time: introduce xen_{save,restore}_steal_clock
    - SAUCE: x86/xen: save and restore steal clock
    - SAUCE: xen: Introduce wrapper for save/restore sched clock offset
    - SAUCE: xen: Update sched clock offset to avoid system instability in
      hibernation
    - SAUCE: x86: tsc: avoid system instability in hibernation

  * aws: xen-netfront: prevent potential error on hibernate (LP: #1906850)
    - SAUCE: xen-netfront: prevent unnecessary close on hibernate

  [ Ubuntu: 5.8.0-49.55 ]

  * groovy/linux: 5.8.0-49.55 -proposed tracker (LP: #1921053)
  * selftests: bpf verifier fails after sanitize_ptr_alu fixes (LP: #1920995)
    - bpf: Simplify alu_limit masking for pointer arithmetic
    - bpf: Add sanity check for upper ptr_limit
    - bpf, selftests: Fix up some test_verifier cases for unprivileged
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * improper memcg accounting causes NULL pointer derefs (LP: #1918668)
    - SAUCE: Revert "mm: memcg/slab: optimize objcg stock draining"
  * kernel: Enable CONFIG_BPF_LSM on Ubuntu (LP: #1905975)
    - [Config] Enable CONFIG_BPF_LSM
  * Groovy u...

Changed in linux-aws (Ubuntu Groovy):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.