WSL kernel should enable CONFIG_BPF_LSM=y for latest eBPF applications

[rafaeldtinoco]

Windows Version

Microsoft Windows [Version 10.0.22621.1413]

WSL Version

WSL version: 1.1.3.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

5,15,90

Distro Version

Ubuntu 22.04

Other Software

https://github.com/aquasecurity/tracee/

Repro Steps

1. Clone https://github.com/aquasecurity/tracee/
2. make -f builder/Makefile.tracee-make ubuntu-prepare
3. make -f builder/Makefile.tracee-make ubuntu-make ARG="all"
4. sudo ./dist/tracee and watch loading error due to LSM eBPF kprobes.

Watch an eBPF object loading error.

Expected Behavior

After cloning https://github.com/microsoft/WSL2-Linux-Kernel and adding the following kconfig option:

CONFIG_BPF_LSM=y

We're able to have kprobes in LSM hooks. Note that this is needed to avoid TOCTOU kprobes under regular kernel entries (so the hooks using LSM functions are safer and should be enabled).

Thank you!

Actual Behavior

The LSM hooks don't exist and the eBPF loading (through libbpf) fails.

Diagnostic Logs

No response

[microsoft-github-policy-service]

This issue has been automatically closed since it has not had any activity for the past year. If you're still experiencing this issue please re-file this as a new issue or feature request.

Thank you!