feat: poc of bpf token delegation

[anryko]

A minimal implementation of privilege delegation via BPF token feature. I only implemented the functionality which was required to test my specific usecase. I'm not sure if this is a good idea to implement it as I did, via a fallback action to try on permission error. But I did not want to introduce API changes while testing basic functionality.

Please help out and advice on how to proceed with moving forward with this feature.

Relates to: #1921

[anryko]

Summary

• The FeatureTestFn signature was changed to support configurable NewFeatureTest(), required to setup BPF Token FD and MountPath.

• BPFFS token is created by Collection based on CollectionOptions configuration and added as obj.BpffsTokenFD to the Map and Program Specs. On Map and Program creation it is duplicated and stored in obj.tokenFd to make obj.Copy() work. The LoadPinOptions has BpffsTokenFd as well. Token has to be provided in unprivileged mode, to work with the objects loaded from FD.

• To the entities that make a copy and hold on to tokenFd it is passed as *sys.FD. To everything that just uses the token and doesn't manage its lifetime it's passed as int32. Usually the token is needed only for feature detections, as those are attempting to load the dummy program or create a dummy map and check the result. BPF token related documentation will have to inform the user that BPFFS delegate_progs list has to include the socket_filter and kprobe, otherwise feature detection will not work. Maybe we could consider allowing user to provide their own dummy BPF program to be used for feature detection to avoid mandatory allowing socket_filter and kprobe.

Please let me know if these changes make sense and I'm looking forward to your feedback.

[javiercardona-work]

Hi @anryko

It looks like we are both interested in getting ebpf to work with BPF token. I have #1948 out which I believe implements what you already have, plus a test program to confirm that probes and ebpf operations work with dropped privileges. I would really appreciate your comments on it and whether that would meet your needs.

Cheers,
Javier