use checks.c for hook check

Author: Stringy

fact-ebpf/src/bpf/checks.c

@@ -13,3 +13,9 @@ int BPF_PROG(check_path_unlink_supports_bpf_d_path, struct path* dir, struct den
   bpf_printk("dir: %s", p->path);
   return 0;
 }
+
+SEC("lsm/inode_set_acl")
+int BPF_PROG(check_inode_set_acl, struct mnt_idmap* idmap, struct dentry* dentry, const char* acl_name,
+             struct posix_acl* kacl) {
+  return 0;
+}

fact/src/bpf/checks.rs

@@ -4,6 +4,7 @@ use log::debug;
 
 pub(super) struct Checks {
     pub(super) path_hooks_support_bpf_d_path: bool,
+    pub(super) supports_inode_set_acl: bool,
 }
 
 impl Checks {
@@ -12,15 +13,31 @@ impl Checks {
             .load(fact_ebpf::CHECKS_OBJ)
             .context("Failed to load checks.o")?;
 
-        let prog = obj
-            .program_mut("check_path_unlink_supports_bpf_d_path")
-            .context("Failed to find 'check_path_unlink_supports_bpf_d_path' program")?;
-        let prog: &mut Lsm = prog.try_into()?;
-        let path_hooks_support_bpf_d_path = prog.load("path_unlink", btf).is_ok();
-        debug!("path_unlink_supports_bpf_d_path: {path_hooks_support_bpf_d_path}");
+        let path_hooks_support_bpf_d_path = Self::probe_hook(
+            &mut obj,
+            "check_path_unlink_supports_bpf_d_path",
+            "path_unlink",
+            btf,
+        );
+        debug!("path_hooks_support_bpf_d_path: {path_hooks_support_bpf_d_path}");
+
+        let supports_inode_set_acl =
+            Self::probe_hook(&mut obj, "check_inode_set_acl", "inode_set_acl", btf);
+        debug!("supports_inode_set_acl: {supports_inode_set_acl}");
 
         Ok(Checks {
             path_hooks_support_bpf_d_path,
+            supports_inode_set_acl,
         })
     }
+
+    fn probe_hook(obj: &mut aya::Ebpf, prog_name: &str, hook: &str, btf: &Btf) -> bool {
+        let Some(prog) = obj.program_mut(prog_name) else {
+            return false;
+        };
+        let Ok(prog): Result<&mut Lsm, _> = prog.try_into() else {
+            return false;
+        };
+        prog.load(hook, btf).is_ok()
+    }
 }

fact/src/bpf/mod.rs

@@ -24,12 +24,9 @@ mod checks;
 
 const RINGBUFFER_NAME: &str = "rb";
 
-/// Hooks that may not be available on all supported kernels. If these
-/// fail to load, FACT will log a warning and continue without them.
-const OPTIONAL_HOOKS: &[&str] = &["inode_set_acl"];
-
 pub struct Bpf {
     obj: Ebpf,
+    checks: Checks,
 
     tx: mpsc::Sender<Event>,
 
@@ -68,6 +65,7 @@ impl Bpf {
         let paths = Vec::new();
         let mut bpf = Bpf {
             obj,
+            checks,
             tx,
             paths,
             paths_config,
@@ -182,17 +180,17 @@ impl Bpf {
             let Some(hook) = name.strip_prefix("trace_") else {
                 bail!("Invalid hook name: {name}");
             };
-            let result = match prog {
-                Program::Lsm(prog) => prog.load(hook, btf),
+
+            // Skip hooks that the kernel doesn't support
+            if hook == "inode_set_acl" && !self.checks.supports_inode_set_acl {
+                info!("Skipping {hook}: not supported on this kernel");
+                continue;
+            }
+
+            match prog {
+                Program::Lsm(prog) => prog.load(hook, btf)?,
                 u => unimplemented!("{u:?}"),
             };
-            if let Err(e) = result {
-                if OPTIONAL_HOOKS.contains(&hook) {
-                    warn!("Optional hook {hook} not available on this kernel, skipping: {e}");
-                    continue;
-                }
-                return Err(e.into());
-            }
         }
         Ok(())
     }