core/namespace: gracefully handle errors in mounting new bpffs instance

Then, fallback to remount /sys/fs/bpf read-only when ProtectKernelTunables=yes.

diff --git a/src/core/namespace.c b/src/core/namespace.c
index 4391c1275544255f7f0eb1ed0c8384e28c9d5a6b..644614a1845ec0c82be56c1cf16920ded6429e0c 100644 (file)
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -957,6 +957,7 @@ static int append_private_bpf(
                 *me = (MountEntry) {
                         .path_const = "/sys/fs/bpf",
                         .mode = MOUNT_BPFFS,
+                        .ignore = !protect_kernel_tunables, /* indicate whether we should fall back to MOUNT_READ_ONLY on failure. */
                 };
                 return 0;
         }
@@ -1832,6 +1833,23 @@ static int apply_one_mount(
 
         log_debug("Applying namespace mount on %s", mount_entry_path(m));
 
+        if (m->mode == MOUNT_BPFFS) {
+                r = mount_bpffs(m, p->bpffs_pidref, p->bpffs_socket_fd, p->bpffs_errno_pipe);
+                if (r >= 0 ||
+                    (!ERRNO_IS_NEG_NOT_SUPPORTED(r) && /* old kernel? */
+                     !ERRNO_IS_NEG_PRIVILEGE(r)))      /* ubuntu kernel bug? See issue #38225 */
+                        return r;
+
+                if (m->ignore) {
+                        log_debug_errno(r, "Failed to mount new bpffs instance, ignoring: %m");
+                        return 0;
+                }
+
+                log_debug_errno(r, "Failed to mount new bpffs instance, fallback to making %s read-only, ignoring: %m", mount_entry_path(m));
+                m->mode = MOUNT_READ_ONLY;
+                m->ignore = true;
+        }
+
         switch (m->mode) {
 
         case MOUNT_INACCESSIBLE: {
@@ -2034,9 +2052,6 @@ static int apply_one_mount(
         case MOUNT_OVERLAY:
                 return mount_overlay(m);
 
-        case MOUNT_BPFFS:
-                return mount_bpffs(m, p->bpffs_pidref, p->bpffs_socket_fd, p->bpffs_errno_pipe);
-
         default:
                 assert_not_reached();
         }