feat(cardwire-ebpf): fallback to weakened state if sys_dents fails

[luytan]

Description

Cardwired can fail on system with kernel_lockdown enabled. This is due to the sys_exit_dents64 hook that re-write userspace memory, it gets rejected on secure booted system with CONFIG_SECURITY_LOCKDOWN_LSM_EARLY_INITIALIZATION_ON_SECURE_BOOT=y

TODO

• Copy-Paste this line

Checklist:

• My code follows the style guidelines of this project (cargo fmt)
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the mdBook documentation
• My changes generate no new warnings (clippy/clang)
• New and existing unit tests pass locally with my changes (either use nix flake check or wait for the ci)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f2f801c4-5c2d-4a3e-9a36-9f086f86db88

📥 Commits

Reviewing files that changed from the base of the PR and between 4563468 and 26ca08c.

📒 Files selected for processing (1)

• crates/cardwire-ebpf-userspace/src/lib.rs

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added detection for kernel lockdown status.
  • Improved filesystem monitoring startup with staged attachment of system event handlers.

• Bug Fixes

  • The application now continues starting when monitoring handlers cannot be attached, while recording warnings and operating with reduced protection.

Walkthrough

EbpfBlocker::new now performs ordered, conditional getdents tracepoint setup. Load failures emit warnings and allow weakened startup. A private helper detects enabled kernel lockdown modes.

Changes

Getdents startup handling

Layer / File(s)	Summary
Conditional tracepoint setup crates/cardwire-ebpf-userspace/src/lib.rs	EbpfBlocker::new loads and attaches sys_exit_getdents64 before sys_enter_getdents64. Failures produce warnings without stopping startup. The LSM list is renamed to lsm_load_list. is_lockdown_enabled reads /sys/kernel/security/lockdown and detects integrity or confidentiality modes. Logging and filesystem imports support this flow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant EbpfBlocker_new
  participant is_lockdown_enabled
  participant sys_exit_getdents64
  participant sys_enter_getdents64
  EbpfBlocker_new->>sys_exit_getdents64: load and attach
  sys_exit_getdents64-->>EbpfBlocker_new: success or failure
  EbpfBlocker_new->>is_lockdown_enabled: read lockdown status on failure
  EbpfBlocker_new->>sys_enter_getdents64: load and attach after exit success

Loading

Possibly related PRs

• OpenGamingCollective/cardwire#137: Introduced the userspace eBPF program setup modified by this change.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the fallback behavior when the getdents hook fails.
Description check	✅ Passed	The description explains the failure cause, includes the requested checklist, and identifies the motivation for the change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/cardwire-ebpf-userspace/src/lib.rs`:
- Around line 67-132: Make attach failures non-fatal in the getdents tracepoint
setup: replace the `?` propagation on `cardwire_sys_exit_getdents64.attach` and
`cardwire_sys_enter_getdents64.attach` with warn-and-continue handling matching
their existing load failure branches. Preserve the weakened-state fallback and
include the attach error details in the warnings without aborting startup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 090cf648-7878-4a73-bfbd-f78e209950f4

📥 Commits

Reviewing files that changed from the base of the PR and between 7ebc6e2 and 4563468.

📒 Files selected for processing (1)

• crates/cardwire-ebpf-userspace/src/lib.rs