Talos 1.12.6 bpf verifier permission errors
bug
## Bug Report
On latest Talos, operator-deployed kubearmor bpf daemonset comes up, but karmor probe lists no active LSMs and daemonset pod logs indicate bpf verifier permission errors
**Environment**
* Talos 1.12.6 (kernel 6.18.18-talos), K8s 1.35.3
* kubearmor 1.6.16 via kubearmor-operator helm chart, with default sample configuration, deployed in pre-created `kubearmor` ns with `pod-security.kubernetes.io/enforce=privileged`
**Additional notes**
* Similar results with earlier kubearmor versions
* I'm new to kubearmor so not sure if this is user error. Currently unable to test elsewhere and/or with earlier Talos versions.
**Relevant info/logs**
* log snippet from `kubectl -n kubearmor logs daemonsets/kubearmor-bpf-containerd-....`:
```
....
2026-04-12 23:42:55.132404 INFO Supported LSMs: lockdown,capability,yama,selinux,bpf,landlock
2026-04-12 23:42:55.174173 ERROR Verifier error: load program: permission denied:
0: R1=ctx() R10=fp0
; int BPF_PROG(enforce_cap, const struct cred *cred, struct user_namespace *ns, @ enforcer.bpf.c:623
0: (79) r1 = *(u64 *)(r1 +16) ; R1=scalar()
; struct task_struct *t = (struct task_struct *)bpf_get_current_task(); @ enforcer.bpf.c:630
1: (7b) *(u64 *)(r10 -104) = r1 ; R1=scalar(id=1) R10=fp0 fp-104=scalar(id=1)
2: (85) call bpf_get_current_task#35 ; R0=scalar()
3: (bf) r8 = r0 ; R0=scalar(id=2) R8=scalar(id=2)
4: (b7) r1 = 3040 ; R1=3040
5: (bf) r6 = r8 ; R6=scalar(id=2) R8=scalar(id=2)
6: (0f) r6 += r1 ; R1=3040 R6=scalar(id=2+3040)
7: (bf) r7 = r10 ; R7=fp0 R10=fp0
8: (07) r7 += -56 ; R7=fp-56
; return BPF_CORE_READ(task, nsproxy, pid_ns_for_children, ns).inum; @ shared.h:441
9: (bf) r1 = r7 ; R1=fp-56 R7=fp-56
10: (b7) r2 = 8 ; R2=8
11: (bf) r3 = r6 ; R3=scalar(id=3) R6=scalar(id=3)
12: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-56=mmmmmmmm
13: (b7) r1 = 32 ; R1=32
14: (79) r3 = *(u64 *)(r10 -56) ; R3=scalar() R10=fp0 fp-56=mmmmmmmm
15: (0f) r3 += r1 ; R1=32 R3=scalar()
16: (bf) r1 = r7 ; R1=fp-56 R7=fp-56
17: (b7) r2 = 8 ; R2=8
18: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-56=mmmmmmmm
19: (b7) r1 = 112 ; R1=112
20: (79) r3 = *(u64 *)(r10 -56) ; R3=scalar() R10=fp0 fp-56=mmmmmmmm
21: (0f) r3 += r1 ; R1=112 R3=scalar()
22: (bf) r7 = r10 ; R7=fp0 R10=fp0
23: (07) r7 += -24 ; R7=fp-24
24: (bf) r1 = r7 ; R1=fp-24 R7=fp-24
25: (b7) r2 = 24 ; R2=24
26: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-8=mmmmmmmm fp-16=mmmmmmmm fp-24=mmmmmmmm
27: (61) r9 = *(u32 *)(r7 +24)
invalid read from stack R7 off=0 size=4
processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 0
github.com/kubearmor/KubeArmor/KubeArmor/log.Err
/usr/src/KubeArmor/KubeArmor/log/logger.go:103
github.com/kubearmor/KubeArmor/KubeArmor/feeder.(*Feeder).Errf
/usr/src/KubeArmor/KubeArmor/feeder/feeder.go:501
github.com/kubearmor/KubeArmor/KubeArmor/enforcer/bpflsm.NewBPFEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/bpflsm/enforcer.go:142
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.selectLsm
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:106
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.NewRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:175
github.com/kubearmor/KubeArmor/KubeArmor/core.(*KubeArmorDaemon).InitRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:342
github.com/kubearmor/KubeArmor/KubeArmor/core.KubeArmor
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:696
main.main
/usr/src/KubeArmor/KubeArmor/main.go:74
runtime.main
/usr/local/go/src/runtime/proc.go:285
2026-04-12 23:42:55.174252 ERROR error loading BPF LSM objects: field EnforceCap: program enforce_cap: load program: permission denied: invalid read from stack R7 off=0 size=4 (33 line(s) omitted)
github.com/kubearmor/KubeArmor/KubeArmor/log.Err
/usr/src/KubeArmor/KubeArmor/log/logger.go:103
github.com/kubearmor/KubeArmor/KubeArmor/feeder.(*Feeder).Errf
/usr/src/KubeArmor/KubeArmor/feeder/feeder.go:501
github.com/kubearmor/KubeArmor/KubeArmor/enforcer/bpflsm.NewBPFEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/bpflsm/enforcer.go:144
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.selectLsm
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:106
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.NewRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:175
github.com/kubearmor/KubeArmor/KubeArmor/core.(*KubeArmorDaemon).InitRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:342
github.com/kubearmor/KubeArmor/KubeArmor/core.KubeArmor
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:696
main.main
/usr/src/KubeArmor/KubeArmor/main.go:74
runtime.main
/usr/local/go/src/runtime/proc.go:285
2026-04-12 23:42:55.174278 INFO Error Initialising BPF-LSM Enforcer, Cleaning Up
2026-04-12 23:42:55.174383 INFO Destroyed BPF-LSM Enforcer
2026-04-12 23:42:55.206718 ERROR Verifier error: load program: permission denied:
0: R1=ctx() R10=fp0
; int BPF_PROG(enforce_cap, const struct cred *cred, struct user_namespace *ns, @ enforcer.bpf.c:623
0: (79) r1 = *(u64 *)(r1 +16) ; R1=scalar()
; struct task_struct *t = (struct task_struct *)bpf_get_current_task(); @ enforcer.bpf.c:630
1: (7b) *(u64 *)(r10 -104) = r1 ; R1=scalar(id=1) R10=fp0 fp-104=scalar(id=1)
2: (85) call bpf_get_current_task#35 ; R0=scalar()
3: (bf) r8 = r0 ; R0=scalar(id=2) R8=scalar(id=2)
4: (b7) r1 = 3040 ; R1=3040
5: (bf) r6 = r8 ; R6=scalar(id=2) R8=scalar(id=2)
6: (0f) r6 += r1 ; R1=3040 R6=scalar(id=2+3040)
7: (bf) r7 = r10 ; R7=fp0 R10=fp0
8: (07) r7 += -56 ; R7=fp-56
; return BPF_CORE_READ(task, nsproxy, pid_ns_for_children, ns).inum; @ shared.h:441
9: (bf) r1 = r7 ; R1=fp-56 R7=fp-56
10: (b7) r2 = 8 ; R2=8
11: (bf) r3 = r6 ; R3=scalar(id=3) R6=scalar(id=3)
12: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-56=mmmmmmmm
13: (b7) r1 = 32 ; R1=32
14: (79) r3 = *(u64 *)(r10 -56) ; R3=scalar() R10=fp0 fp-56=mmmmmmmm
15: (0f) r3 += r1 ; R1=32 R3=scalar()
16: (bf) r1 = r7 ; R1=fp-56 R7=fp-56
17: (b7) r2 = 8 ; R2=8
18: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-56=mmmmmmmm
19: (b7) r1 = 112 ; R1=112
20: (79) r3 = *(u64 *)(r10 -56) ; R3=scalar() R10=fp0 fp-56=mmmmmmmm
21: (0f) r3 += r1 ; R1=112 R3=scalar()
22: (bf) r7 = r10 ; R7=fp0 R10=fp0
23: (07) r7 += -24 ; R7=fp-24
24: (bf) r1 = r7 ; R1=fp-24 R7=fp-24
25: (b7) r2 = 24 ; R2=24
26: (85) call bpf_probe_read_kernel#113 ; R0=scalar() fp-8=mmmmmmmm fp-16=mmmmmmmm fp-24=mmmmmmmm
27: (61) r9 = *(u32 *)(r7 +24)
invalid read from stack R7 off=0 size=4
processed 28 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 0
github.com/kubearmor/KubeArmor/KubeArmor/log.Err
/usr/src/KubeArmor/KubeArmor/log/logger.go:103
github.com/kubearmor/KubeArmor/KubeArmor/feeder.(*Feeder).Errf
/usr/src/KubeArmor/KubeArmor/feeder/feeder.go:501
github.com/kubearmor/KubeArmor/KubeArmor/enforcer/bpflsm.NewBPFEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/bpflsm/enforcer.go:142
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.selectLsm
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:106
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.NewRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:175
github.com/kubearmor/KubeArmor/KubeArmor/core.(*KubeArmorDaemon).InitRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:342
github.com/kubearmor/KubeArmor/KubeArmor/core.KubeArmor
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:696
main.main
/usr/src/KubeArmor/KubeArmor/main.go:74
runtime.main
/usr/local/go/src/runtime/proc.go:285
2026-04-12 23:42:55.206800 ERROR error loading BPF LSM objects: field EnforceCap: program enforce_cap: load program: permission denied: invalid read from stack R7 off=0 size=4 (33 line(s) omitted)
github.com/kubearmor/KubeArmor/KubeArmor/log.Err
/usr/src/KubeArmor/KubeArmor/log/logger.go:103
github.com/kubearmor/KubeArmor/KubeArmor/feeder.(*Feeder).Errf
/usr/src/KubeArmor/KubeArmor/feeder/feeder.go:501
github.com/kubearmor/KubeArmor/KubeArmor/enforcer/bpflsm.NewBPFEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/bpflsm/enforcer.go:144
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.selectLsm
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:106
github.com/kubearmor/KubeArmor/KubeArmor/enforcer.NewRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:175
github.com/kubearmor/KubeArmor/KubeArmor/core.(*KubeArmorDaemon).InitRuntimeEnforcer
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:342
github.com/kubearmor/KubeArmor/KubeArmor/core.KubeArmor
/usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:696
main.main
/usr/src/KubeArmor/KubeArmor/main.go:74
runtime.main
/usr/local/go/src/runtime/proc.go:285
2026-04-12 23:42:55.206818 INFO Error Initialising BPF-LSM Enforcer, Cleaning Up
2026-04-12 23:42:55.206925 INFO Destroyed BPF-LSM Enforcer
2026-04-12 23:42:55.206946 INFO Disabled KubeArmor Enforcer: failed to create runtime enforcer
....
```
* capabilities
```
kubectl -n kubearmor get pod kubearmor-bpf-containerd-...... -o json | jq '.spec.containers[0].securityContext.capabilities'
{
"add": [
"SETUID",
"SETGID",
"SETPCAP",
"SYS_ADMIN",
"SYS_PTRACE",
"MAC_ADMIN",
"NET_ADMIN",
"SYS_RESOURCE",
"IPC_LOCK",
"CAP_DAC_OVERRIDE",
"CAP_DAC_READ_SEARCH"
],
"drop": [
"ALL"
]
}
```
* karmor probe:
```
...
Node 1 :
OS Image: Talos (v1.12.6)
Kernel Version: 6.18.18-talos
Kubelet Version: v1.35.3
Container Runtime: containerd://2.1.6
Active LSM:
Host Security: false
Container Security: false
Container Default Posture: audit(File) audit(Capabilities) audit(Network)
Host Default Posture: audit(File) audit(Capabilities) audit(Network)
Host Visibility: none
...
```
0 条评论