Problem with applying LSM policies in k8s cluster

[anfedotoff]

What happened?

To verify if LSM BPF is enabled we need to check the contents of /sys/kernel/security/lsm

tetragon/pkg/bpf/detect.go

Line 234 in c713bf1

b, err := os.ReadFile("/sys/kernel/security/lsm")

This file is not mounted to the container so policy load is failing. Slack thread.

Tetragon Version

1.3.0

Kernel Version

5.15.0-130-generic

Kubernetes Version

v1.30.9

Bugtool

No response

Relevant log output

Anything else?

Hot Fix that worked:

helm upgrade tetragon cilium/tetragon -n kube-system --set=extraVolumes[0].name="security" --set extraVolumes[0].path="/sys/kernel/security" --set extraVolumes[0].type=Directory --set=extraHostPathMounts[0].mountPath="/sys/kernel/security" --set=extraHostPathMounts[0].name="security"

I see two options:

1. We can add this mount to helm chart. (I prefer this)
2. We can add the fix above to documentation. If use want to use LSM BPF in k8s just add this directory to mountPath