Merge pull request #1856 from Aryan-sharma11/fix--bpflsm

fix: BPFLSM enforcer fails to load on newer kernels (6.8+)
kubearmor · Sep 3, 2024 · 15d146b · 15d146b
2 parents 8525ec6 + d164813
commit 15d146b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/KubeArmor/BPF/enforcer.bpf.c b/KubeArmor/BPF/enforcer.bpf.c
@@ -428,9 +428,11 @@ int BPF_PROG(enforce_net_create, int family, int type, int protocol) {
 
 #define LSM_NET(name, ID)                                                      \
   int BPF_PROG(name, struct socket *sock) {                                    \
-    int type = sock->type;                                                     \
-    int protocol = sock->sk->sk_protocol;                                      \
-    return match_net_rules(type, protocol, ID);                                \
+    int sock_type = BPF_CORE_READ(sock, type);                                 \
+    struct sock *sk;                                                           \
+    sk = BPF_CORE_READ(sock, sk);                                              \
+    int protocol = BPF_CORE_READ(sk, sk_protocol);                             \
+    return match_net_rules(sock_type, protocol, ID);                           \
   }
 
 SEC("lsm/socket_connect")

diff --git a/KubeArmor/enforcer/bpflsm/enforcer_bpfeb.o b/KubeArmor/enforcer/bpflsm/enforcer_bpfeb.o
diff --git a/KubeArmor/enforcer/bpflsm/enforcer_bpfel.o b/KubeArmor/enforcer/bpflsm/enforcer_bpfel.o