binary changes to enable userns in shiv

Summary:
For enabling userns for shiv in twshared we need a few changes.
- In the spec we add the required flag and enable userns + use bpf token capability gated by feature rollout (D82478708)
- In the binary we need to retrieve the bpf token and use it for all map operations, if not passed operations fail (P1948903648).
- For bpf program names have a limit of 15 chars + null termination (https://www.kernel.org/doc/html/v5.14/bpf/libbpf/libbpf_naming_convention.html?utm_source=chatgpt.com) due to how it's accessed now, the name is truncated when we retrieve it and try to validate it so it fails with: P1948906354. For this now we check if the full name is correct for backwards compatibility, if not we truncate to 15 chars and check again.

Reviewed By: avasylev

Differential Revision: D77978567

fbshipit-source-id: 1d4f8fb4e5410b3df67fb1ad57c46c89f930a4e6

Author: Ivan Morett

katran/lib/BaseBpfAdapter.cpp

@@ -240,6 +240,11 @@ int BaseBpfAdapter::createNamedBpfMap(
       .map_flags = map_flags | (numa_node >= 0 ? BPF_F_NUMA_NODE : 0),
       .numa_node = (__u32)numa_node);
 
+  if (bpfTokenFd_ >= 0) {
+    opts.token_fd = bpfTokenFd_;
+    opts.map_flags |= BPF_F_TOKEN_FD;
+  }
+
   return bpf_map_create(
       static_cast<enum bpf_map_type>(type),
       name_ptr,
@@ -597,7 +602,7 @@ int BaseBpfAdapter::addClsActQD(const unsigned int ifindex) {
 }
 
 int BaseBpfAdapter::getDirFd(const std::string& path) {
-  return ::open(path.c_str(), O_DIRECTORY, O_RDONLY);
+  return ::open(path.c_str(), O_DIRECTORY | O_RDONLY);
 }
 
 int BaseBpfAdapter::attachCgroupProg(
@@ -921,4 +926,26 @@ bool BaseBpfAdapter::isBatchOpsEnabled() const {
   return batchOpsEnabled_;
 }
 
+int BaseBpfAdapter::setBpfTokenFromFilePath(const char* path) {
+  LOG(INFO) << "bpf token path: " << path;
+  auto bpfFsFd = getDirFd(path);
+  if (bpfFsFd < 0) {
+    LOG(ERROR) << "failed to open bpf token path: " << path
+               << " error: " << folly::errnoStr(errno);
+    return -1;
+  }
+  auto tokenFd = bpf_token_create(bpfFsFd, nullptr);
+  close(bpfFsFd);
+  if (tokenFd < 0) {
+    LOG(ERROR) << "failed to create bpf token from path: " << path
+               << " error: " << folly::errnoStr(errno);
+    return -1;
+  }
+  bpfTokenFd_ = tokenFd;
+  LOG(INFO) << "Successfully created BPF token with fd: " << tokenFd;
+  return 0;
+}
+
+int64_t BaseBpfAdapter::bpfTokenFd_ = -1;
+
 } // namespace katran

katran/lib/BaseBpfAdapter.h

@@ -50,6 +50,8 @@ constexpr unsigned int kBpfMapTypeHashOfMaps = 13;
 
 class BaseBpfAdapter {
  public:
+  static constexpr const char* kBpfTokenPathEnvVar = "LIBBPF_BPF_TOKEN_PATH";
+
   BaseBpfAdapter(bool set_limits, bool enableBatchOpsIfSupported);
 
   virtual ~BaseBpfAdapter() {}
@@ -672,6 +674,20 @@ class BaseBpfAdapter {
 
   bool isBatchOpsEnabled() const;
 
+  /**
+   * @param const char* path Path to the BPF filesystem directory
+   * @return int 0 on success, -1 on failure
+   *
+   * Creates a BPF token from the specified filesystem path and sets it
+   * for use with BPF operations. The BPF token enables unprivileged access
+   * to BPF functionality when running in restricted environments like
+   * user namespaces or containers.
+   *
+   * Once set, the token will be automatically used when creating BPF maps
+   * and other BPF objects to enable operations in restricted contexts.
+   */
+  int setBpfTokenFromFilePath(const char* path);
+
  protected:
   /**
    * helper function to modify (add/delete/replace) tc's bpf prog.
@@ -729,6 +745,8 @@ class BaseBpfAdapter {
    * enabled and supported.
    */
   bool batchOpsEnabled_{false};
+
+  static int64_t bpfTokenFd_;
 };
 
 } // namespace katran

katran/lib/KatranLb.cpp

@@ -487,10 +487,8 @@ void KatranLb::initLrus(bool flowDebug, bool globalLru) {
       int lru_fd =
           createLruMap(per_core_lru_size, lru_map_flags, numa_node, core);
       if (lru_fd < 0) {
-        LOG(FATAL) << "can't creat lru for core: " << core;
-        throw std::runtime_error(fmt::format(
-            "can't create LRU for forwarding core, error: {}",
-            folly::errnoStr(errno)));
+        LOG(FATAL) << "can't creat lru for core: " << core
+                   << ", error: " << folly::errnoStr(errno);
       }
       lruMapsFd_[core] = lru_fd;
       if (flowDebug) {