From: Iago López Galeiras <iagol@microsoft.com>
Date: Tue, 22 Dec 2020 19:27:50 +0000 (+0100)
Subject: README: document LSM BPF requirements
X-Git-Tag: v250-rc1~561^2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ec31dd5a9865fccfa5fa295b5e17ddae61f19468;p=thirdparty%2Fsystemd.git

README: document LSM BPF requirements
---

diff --git a/README b/README
index 6a151a49e9e..3811abfe060 100644
--- a/README
+++ b/README
@@ -35,7 +35,7 @@ REQUIREMENTS:
         Linux kernel >= 4.17 for cgroup-bpf socket address hooks
         Linux kernel >= 5.3 for bounded-loops in BPF program
         Linux kernel >= 5.4 for signed Verity images support
-        Linux kernel >= 5.7 for BPF links
+        Linux kernel >= 5.7 for BPF links and the BPF LSM hook
 
         Kernel Config Options:
           CONFIG_DEVTMPFS
@@ -119,6 +119,13 @@ REQUIREMENTS:
         Required for signed Verity images support:
           CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG
 
+        Required for RestrictFileSystems= in service units:
+          CONFIG_BPF
+          CONFIG_BPF_SYSCALL
+          CONFIG_BPF_LSM
+          CONFIG_DEBUG_INFO_BTF
+          CONFIG_LSM="...,bpf" or kernel booted with lsm="...,bpf".
+
         We recommend to turn off Real-Time group scheduling in the
         kernel when using systemd. RT group scheduling effectively
         makes RT scheduling unavailable for most userspace, since it