Include bpftrace by src part2 pkg bpftrace

[christoph-zededa]

has to be changed once #3915 is merged

[eriknordmark]

It would be good to have a security review with @shjala once he is back - to make sure we are aware of how to handle arbitrary ebpf code or whether we will instead somehow provide approved and signed ebpf programs.

[shjala]

@eriknordmark we had a discussion with Christoph, the main concerns are two helper functions 1) bpf_override_return which can be disabled via CONFIG_BPF_KPROBE_OVERRIDE kernel config and 2) bpf_probe_write_user which can be disabled by setting kernel lockdown mode to confidentiality but that might cause some problems as it comes with a bunch more restrictions like blocking direct PCI access or blocking raw io port access which might cause problem for Qemu, so a small patch for kernel to disable those helper functions unconditionally might be more appropriate.

The proposed changes will unblock the PR for now...

[christoph-zededa]

Moved to draft state until I have done the security changes for the kernel.

[christoph-zededa]

@eriknordmark we had a discussion with Christoph, the main concerns are two helper functions 1) bpf_override_return which can be disabled via CONFIG_BPF_KPROBE_OVERRIDE kernel config and 2) bpf_probe_write_user which can be disabled by setting kernel lockdown mode to confidentiality but that might cause some problems as it comes with a bunch more restrictions like blocking direct PCI access or blocking raw io port access which might cause problem for Qemu, so a small patch for kernel to disable those helper functions unconditionally might be more appropriate.

The proposed changes will unblock the PR for now...

PRs for the kernel created here: https://github.com/lf-edge/eve-kernel/pulls?q=is%3Apr+is%3Aopen+Restrict+BPF+usage

[eriknordmark]

Please have build.yml with network disabled.

[eriknordmark]

LGTM