[1.0] cgroupv2: ebpf: ignore inaccessible existing programs

go.mod

@@ -5,7 +5,7 @@ go 1.13
 require (
  github.com/bits-and-blooms/bitset v1.2.0
  github.com/checkpoint-restore/go-criu/v5 v5.0.0
- github.com/cilium/ebpf v0.6.1
+ github.com/cilium/ebpf v0.6.2
  github.com/containerd/console v1.0.2
  github.com/coreos/go-systemd/v22 v22.3.2
  github.com/cyphar/filepath-securejoin v0.2.2

go.sum

@@ -3,8 +3,8 @@ github.com/bits-and-blooms/bitset v1.2.0 h1:Kn4yilvwNtMACtf1eYDlG8H77R07mZSPbMjL
 github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/checkpoint-restore/go-criu/v5 v5.0.0 h1:TW8f/UvntYoVDMN1K2HlT82qH1rb0sOjpGw3m6Ym+i4=
 github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
-github.com/cilium/ebpf v0.6.1 h1:n6ZUOkSFi6OwcMeTCFaDQx2Onx2rEikQo69315MNbdc=
-github.com/cilium/ebpf v0.6.1/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.6.2 h1:iHsfF/t4aW4heW2YKfeHrVPGdtYTL4C4KocpM8KTSnI=
+github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
 github.com/containerd/console v1.0.2 h1:Pi6D+aZXM+oUw1czuKgH5IJ+y0jhYcwBJfx5/Ghn9dE=
 github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
 github.com/coreos/go-systemd/v22 v22.3.2 h1:D9/bQk5vlXQFZ6Kwuu6zaiXJ9oTPe68++AzAJc1DzSI=

libcontainer/cgroups/ebpf/ebpf_linux.go

@@ -59,13 +59,26 @@ func findAttachedCgroupDeviceFilters(dirFd int) ([]*ebpf.Program, error) {
 
  // Convert the ids to program handles.
  progIds = progIds[:size]
- programs := make([]*ebpf.Program, len(progIds))
- for idx, progId := range progIds {
+ programs := make([]*ebpf.Program, 0, len(progIds))
+ for _, progId := range progIds {
  program, err := ebpf.NewProgramFromID(ebpf.ProgramID(progId))
  if err != nil {
+ // We skip over programs that give us -EACCES or -EPERM. This
+ // is necessary because there may be BPF programs that have
+ // been attached (such as with --systemd-cgroup) which have an
+ // LSM label that blocks us from interacting with the program.
+ //
+ // Because additional BPF_CGROUP_DEVICE programs only can add
+ // restrictions, there's no real issue with just ignoring these
+ // programs (and stops runc from breaking on distributions with
+ // very strict SELinux policies).
+ if errors.Is(err, os.ErrPermission) {
+ logrus.Debugf("ignoring existing CGROUP_DEVICE program (prog_id=%v) which cannot be accessed by runc -- likely due to LSM policy: %v", progId, err)
+ continue
+ }
  return nil, fmt.Errorf("cannot fetch program from id: %w", err)
  }
- programs[idx] = program
+ programs = append(programs, program)
  }
  runtime.KeepAlive(progIds)
  return programs, nil