Package: systemd
Version: 256.5-1
Severity: normal
X-Debbugs-Cc: debian-kernel@lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
I build a custom (arm64) kernel based on Debian's config and in that I
disabled debug info, which in turn disabled ``CONFIG_DEBUG_INFO_BTF``.
Build was successful and I tried it out on my Rock64 and what I always
do when testing kernels is check dmesg for errors/warnings etc:
```sh
root@rock64-test:~# dmesg --level 0,1,2
root@rock64-test:~# dmesg --level 0,1,2,3
[ 9.807992] rockchip-pm-domain ff100000.syscon:power-controller: failed to
get ack on domain 'hevc', val=0x88220
[ 16.014046] systemd[1]: bpf-restrict-fs: Failed to load BPF object: No such
process
```
Former is known (and in the works of being fixed), the latter is new.
Looking for that error message led me to upstream issue 32968 [1] which
led me to the upstream README with the following:
```
Required for RestrictFileSystems= in service units:
CONFIG_BPF
CONFIG_BPF_SYSCALL
CONFIG_BPF_LSM
CONFIG_DEBUG_INFO_BTF
CONFIG_LSM="...,bpf" or kernel booted with lsm="...,bpf".
```
I (actually) do have most of those, but not CONFIG_DEBUG_INFO_BTF and
that appears to be why systemd throws an error.
Looking further I found another issue [2] which says that using
``lockdown=confidentiality`` will also be problematic.
I think/assume it's great that systemd would use kernel features like
BPF *if* they're available. But if not, it should not throw an ERROR.
An informational message is fine and possibly a warning* if it's really
important. But it should detect so at *runtime* and not assume what
happens to be enabled in the (Debian) kernel at a certain point in time.
I did grep my system for ``bpf-restrict-fs`` to see if I could disable
that feature, but it only found ``libsystemd-core-256.so``.
Cheers,
Diederik
*) Preferably not as I'm also trying to fix those as much as possible
[1] https://github.com/systemd/systemd/issues/32968
[2] https://github.com/anthraxx/linux-hardened/issues/93#issuecomment-1974260571
- -- Package-specific info:
- -- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing'), (101, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 6.10.6-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages systemd depends on:
ii libacl1 2.3.2-2
ii libapparmor1 3.1.7-1+b1
ii libaudit1 1:4.0.1-1
ii libblkid1 2.40.2-7
ii libc6 2.39-7
ii libcap2 1:2.66-5
ii libmount1 2.40.2-7
ii libpam0g 1.5.3-7
ii libseccomp2 2.5.5-1+b1
ii libselinux1 3.7-1+b1
ii libssl3t64 3.3.1-7
ii libsystemd-shared 256.5-1
ii libsystemd0 256.5-1
ii mount 2.40.2-7
Versions of packages systemd recommends:
ii dbus [default-dbus-system-bus] 1.14.10-4+b1
ii libzstd1 1.5.6+dfsg-1
pn linux-sysctl-defaults <none>
ii ntpsec [time-daemon] 1.2.3+dfsg1-3
pn systemd-cryptsetup <none>
Versions of packages systemd suggests:
ii libcryptsetup12 2:2.7.4-1
ii libgcrypt20 1.11.0-6
ii libidn2-0 2.3.7-2
ii liblz4-1 1.9.4-3
ii liblzma5 5.6.2-2
pn libtss2-rc0t64 <none>
ii libtss2-tcti-device0t64 [libtss2-tcti-device0] 4.1.3-1
ii polkitd 125-2
pn systemd-boot <none>
ii systemd-container 256.5-1
pn systemd-homed <none>
pn systemd-repart <none>
pn systemd-resolved <none>
pn systemd-userdbd <none>
Versions of packages systemd is related to:
ii dbus-user-session 1.14.10-4+b1
pn dracut <none>
ii initramfs-tools 0.145
pn libnss-systemd <none>
ii libpam-systemd 256.5-1
ii udev 256.5-1
- -- no debconf information
-----BEGIN PGP SIGNATURE-----
iHUEARYIAB0WIQT1sUPBYsyGmi4usy/XblvOeH7bbgUCZsoI3QAKCRDXblvOeH7b
bpA2AQDrLI0m5V/IkTepJVF4NyIlRbnFEjdvRIqjAyWliyCBJAEAorba1BU9D3p4
u9nOA3NGJyY1qPzQbS2Guc1niBbImAg=
=m50o
-----END PGP SIGNATURE-----
