core/bpf-firewall: make failures in loading custom BPF program not critical

All other resource control features work as 'best-effort', and failures
in applying them are handled gracefully. However, unlike the other features,
we tested if the BPF programs can be loaded and refuse execution on failure.

Moreover, the previous behavior of testing loading BPF programs had
inconsistency: the test was silently skipped if the cgroup for the unit does
not exist yet, but tested when the cgroup already exists.

Let's not handle failures in loading custom BPF programs as critical, but
gracefully ignore them, like we do for the other resource control features.

Follow-up for fab347489fcfafbc8367c86afc637ce1b81ae59e.

diff --git a/man/systemd.resource-control.xml b/man/systemd.resource-control.xml
index 73b6734ddd634409522e2a0baea7840d6b955808..16de3caf5f6afa1a357fad609821cfc2e6d3c584 100644 (file)
--- a/man/systemd.resource-control.xml
+++ b/man/systemd.resource-control.xml
@@ -1149,7 +1149,7 @@ NFTSet=cgroup:inet:filter:my_service user:inet:filter:serviceuser
           one more restricted, depending on the use case.</para>
 
           <para>Note that these settings might not be supported on some systems (for example if eBPF control group
-          support is not enabled in the underlying kernel or container manager). These settings will fail the service in
+          support is not enabled in the underlying kernel or container manager). These settings will have no effect in
           that case. If compatibility with such systems is desired it is hence recommended to attach your filter manually
           (requires <varname>Delegate=</varname><constant>yes</constant>) instead of using this setting.</para>
 

diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 6d37c031274d759dd053467930b670baef160177..64bbcadd8fc31a7b630fe633f5383d262caf537f 100644 (file)
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -2204,12 +2204,6 @@ int unit_attach_pids_to_cgroup(Unit *u, Set *pids, const char *suffix_path) {
         if (set_isempty(pids))
                 return 0;
 
-        /* Load any custom firewall BPF programs here once to test if they are existing and actually loadable.
-         * Fail here early since later errors in the call chain unit_realize_cgroup to cgroup_context_apply are ignored. */
-        r = bpf_firewall_load_custom(u);
-        if (r < 0)
-                return r;
-
         r = unit_realize_cgroup(u);
         if (r < 0)
                 return r;

diff --git a/src/core/unit.c b/src/core/unit.c
index 147bc8f5f29a7175819066817b13d85d7486c50a..a4ddf4d91e948c4eaf18791725b46b2632e9b22a 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -6005,12 +6005,6 @@ int unit_prepare_exec(Unit *u) {
 
         assert(u);
 
-        /* Load any custom firewall BPF programs here once to test if they are existing and actually loadable.
-         * Fail here early since later errors in the call chain unit_realize_cgroup to cgroup_context_apply are ignored. */
-        r = bpf_firewall_load_custom(u);
-        if (r < 0)
-                return r;
-
         /* Prepares everything so that we can fork of a process for this unit */
 
         r = unit_realize_cgroup(u);