fix uninitialised r0 register in the bpf program#383
Conversation
Signed-off-by: Tariq Ibrahim <tibrahim@nvidia.com>
| var newProgs []*ebpf.Program | ||
| if len(oldProgs) == 0 { | ||
| oldInsts := asm.Instructions{asm.Return()} | ||
| oldInsts := asm.Instructions{asm.Mov.Imm32(asm.R0, 1), asm.Return()} |
There was a problem hiding this comment.
iiuc the return here is the no-match fallthrough (default rule).
Given we are doing a whitelist filter here, the default rule should be 0 (deny).
There was a problem hiding this comment.
I tried it with 0 initially. That led to a container create failed: open /dev/null: Operation not permitted
There was a problem hiding this comment.
that sounds incomplete whitelist. default with 1 essentially means no filter at all
There was a problem hiding this comment.
that makes me wonder if a race condition exists here since it's runc/crun who should have already whitelisted the common devices such as /dev/null. so in theory we shouldn't hit this code branch.
There was a problem hiding this comment.
Got it. Right now, I've been testing this on an environment that uses cri-o and crun. Let me restart this cluster with cri-o+ runc instead.
2 participants
No description provided.