Skip to content

fix(enforcer): fix bpflsm enforcer verifier issue on talos os#2572

Merged
rksharma95 merged 1 commit into
kubearmor:mainfrom
rksharma95:fix-bpflsm-verifier-issue
May 7, 2026
Merged

fix(enforcer): fix bpflsm enforcer verifier issue on talos os#2572
rksharma95 merged 1 commit into
kubearmor:mainfrom
rksharma95:fix-bpflsm-verifier-issue

Conversation

@rksharma95

Copy link
Copy Markdown
Collaborator

Purpose of PR?:
bpf-lsm enforcer was failing to load on talos os due to verifier issue, this PR fixes that issue.

Talos (v1.13.0)   6.18.24-talos (amd64)
Screenshot 2026-05-06 at 2 59 05 PM

Does this PR introduce a breaking change?
No
If the changes in this PR are manually verified, list down the scenarios covered::

tested on k8s cluster with talos os nodes.

2026-05-06 08:21:15.886231      ESC[34mINFOESC[0m       Node Name: talos-fua-gef
2026-05-06 08:21:15.886339      ESC[34mINFOESC[0m       Node IP: 192.168.100.106
2026-05-06 08:21:15.886364      ESC[34mINFOESC[0m       Node ID: talos-fua-gef
2026-05-06 08:21:15.886418      ESC[34mINFOESC[0m       Node Annotations: map[flannel.alpha.coreos.com/backend-data:{"VNI":1,"VtepMAC":"e2:8c:68:1a:92:e4"} flannel.alpha.coreos.com/backend-type:vxlan flannel.alpha.coreos.com/kube-subnet-manager:true flannel.alpha.coreos.com/public-ip:192.168.100.106 kubearmor-policy:enabled kubearmor-visibility:none node.alpha.kubernetes.io/ttl:0 talos.dev/owned-labels:["node-role.kubernetes.io/control-plane","node.kubernetes.io/exclude-from-external-load-balancers"] talos.dev/owned-taints:["node-role.kubernetes.io/control-plane"] volumes.kubernetes.io/controller-managed-attach-detach:true]
2026-05-06 08:21:15.886443      ESC[34mINFOESC[0m       OS Image: Talos (v1.13.0)
2026-05-06 08:21:15.886469      ESC[34mINFOESC[0m       Kernel Version: 6.18.24-talos
2026-05-06 08:21:15.886492      ESC[34mINFOESC[0m       Kubelet Version: v1.36.0
2026-05-06 08:21:15.886524      ESC[34mINFOESC[0m       Container Runtime: containerd://2.2.3
2026-05-06 08:21:15.896160      ESC[34mINFOESC[0m       Initialized KubeArmor Logger
2026-05-06 08:21:15.900766      ESC[34mINFOESC[0m       Mounting BPF Filesystem at /sys/fs/bpf
2026-05-06 08:21:15.905534      ESC[34mINFOESC[0m       Initializing eBPF system monitor
2026-05-06 08:21:15.924640      ESC[34mINFOESC[0m       Successfully added visibility map with key={PidNS:0 MntNS:0} to the kernel
2026-05-06 08:21:15.940577      ESC[34mINFOESC[0m       Successfully added visibility map with key={PidNS:12648430 MntNS:12648430} to the kernel
2026-05-06 08:21:15.940898      ESC[34mINFOESC[0m       Alert Throttling configured {alertThrottling:true, maxAlertPerSec:10, throttleSec:30}
2026-05-06 08:21:15.940942      ESC[34mINFOESC[0m       Argument matching configured {matchArgs:true}
2026-05-06 08:21:15.940960      ESC[34mINFOESC[0m       eBPF system monitor object file path: /opt/kubearmor/BPF/system_monitor.bpf.o
2026-05-06 08:21:18.256485      ESC[34mINFOESC[0m       Initialized the eBPF system monitor
2026-05-06 08:21:18.375704      ESC[33mWARNESC[0m       error:[syscalls sys_exit_openat]: neither debugfs nor tracefs are mounted
2026-05-06 08:21:18.375758      ESC[33mWARNESC[0m       error:[syscalls sys_enter_setns]: neither debugfs nor tracefs are mounted
2026-05-06 08:21:18.375766      ESC[33mWARNESC[0m       error:[syscalls sys_exit_setns]: neither debugfs nor tracefs are mounted
2026-05-06 08:21:18.375772      ESC[33mWARNESC[0m       error:[sched sched_process_fork]: neither debugfs nor tracefs are mounted
2026-05-06 08:21:18.430498      ESC[34mINFOESC[0m       Initialized KubeArmor Monitor
2026-05-06 08:21:18.430583      ESC[34mINFOESC[0m       Started to monitor system events
2026-05-06 08:21:18.433315      ESC[34mINFOESC[0m       Supported LSMs: lockdown,capability,yama,selinux,bpf,landlock
2026-05-06 08:21:25.814068      ESC[34mINFOESC[0m       Initialized BPF-LSM Enforcer
2026-05-06 08:21:25.814140      ESC[34mINFOESC[0m       Initialized KubeArmor Enforcer
2026-05-06 08:21:25.814149      ESC[34mINFOESC[0m       Started to protect containers
2026-05-06 08:21:25.814317      ESC[34mINFOESC[0m       Starting TraceEvents from BPF LSM Enforcer
2026-05-06 08:21:25.849621      ESC[34mINFOESC[0m       Starting TraceEvents from AnonMapExec Presets
2026-05-06 08:21:25.894155      ESC[34mINFOESC[0m       Starting TraceEvents from FilelessExec Presets

Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs

Checklist:

  • Bug fix.
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update
  • PR Title follows the convention of <type>(<scope>): <subject>
  • Commit has unit tests
  • Commit has integration tests

@rksharma95 rksharma95 merged commit 55fd158 into kubearmor:main May 7, 2026
20 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants