Giters

cilium / tetragon

eBPF-based Security Observability and Runtime Enforcement

Home Page:https://tetragon.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

doc: document why Tetragon will fail to load its BPF programs with operation not permitted

tixxdz opened this issue · comments

commented

We should add in our https://tetragon.io/docs/faq/ some documentation why Tetragon will fail with operation not permitted when loading BPF programs on some machines.

Users have been reporting this #2263 and it is due to lockdown in confidentiality mode, or could be to some other LSM context.

The PR #2149 prints the security context of Tetragon at startup, so having an example of output in the FAQ will help.

We can use @kkourt text:
"lockdown mode seems to be set to 'confidentiality', which does not allow Tetragon to operate because it prohibits loading BPF programs. See iovisor/bcc#2565 for more details".