verify.sh: Handle when bpf_verride_return is unavailable #2838
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
While taking a look at tetragon, I tried running verify.sh and observed bpf_enforce and bpf_generic_kprobe* all fail because bpf_override_return is not available. I also observed that this seems be handled conditionally in tetragon via the pkg.bpf.HasOverrideHelper() function. This change updates verify.sh to check for bpf_override_return before trying to load these programs. If it's not present, it will be skipped cleanly since it's not expected to work. A cleaner solution is to reuse the same check from the Go code. Rewriting this script in Go is tracked in issue cilium#229. Signed-off-by: Russell Bryant <[email protected]>
mtardy
approved these changes
Aug 29, 2024
There was a problem hiding this comment.
Hey thanks for that, looks like a good patch for this script! FYI we have the same check exposed from tetra, the CLI, you can use:
$ sudo ./tetra probe
override_return: true
buildid: true
kprobe_multi: false
uprobe_multi false
fmodret: true
fmodret_syscall: true
signal: true
large: true
link_pin: true
lsm: false
missed_stats_kprobe_multi: false
missed_stats_kprobe: false
but that's perfectly reasonable (better?) to use bpftool here directly
|
Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
While taking a look at tetragon, I tried running verify.sh and
observed bpf_enforce and bpf_generic_kprobe* all fail because
bpf_override_return is not available. I also observed that this seems
be handled conditionally in tetragon via the
pkg.bpf.HasOverrideHelper() function.
This change updates verify.sh to check for bpf_override_return before
trying to load these programs. If it's not present, it will be skipped
cleanly since it's not expected to work.
A cleaner solution is to reuse the same check from the Go code.
Rewriting this script in Go is tracked in issue #229.
Signed-off-by: Russell Bryant [email protected]