fix(ebpf): keep optional lsm programs non-fatal

Author: kylewanginchina

agent/src/ebpf/test/test_ai_agent_source_contracts.py

@@ -149,5 +149,15 @@ def read_source(path: Path) -> str:
     "lsm_programs_handle" in tracer_c_text,
     "tracer.c must include LSM programs in the attach lifecycle",
 )
+require(
+    "new_prog->type == BPF_PROG_TYPE_LSM" in load_text
+    and "Skip optional BPF LSM program" in load_text,
+    "load.c must keep unsupported BPF LSM programs non-fatal",
+)
+require(
+    "p->prog->prog_fd < 0" in tracer_c_text
+    and "skip unloaded lsm program" in tracer_c_text,
+    "tracer.c must skip unloaded optional LSM programs during attach",
+)
 
 print("[OK]")

agent/src/ebpf/user/load.c

@@ -988,6 +988,19 @@ static int load_obj__progs(struct ebpf_object *obj)
 				     new_prog->insns_cnt, BPF_MAXINSNS);
 			}
 
+			/*
+			 * BPF LSM is an optional enforcement mechanism. Kernels
+			 * without CONFIG_BPF_LSM or an active bpf LSM can reject
+			 * the program before attach, so keep the rest of the
+			 * socket tracer available and let userspace fall back.
+			 */
+			if (new_prog->type == BPF_PROG_TYPE_LSM) {
+				ebpf_warning
+				    ("Skip optional BPF LSM program '%s'; enforcement disabled for this hook.\n",
+				     new_prog->name);
+				continue;
+			}
+
 			if (memcmp(desc->name, "uprobe/", 7) &&
 			    memcmp(desc->name, "uretprobe/", 10)) {
 				return ETR_INVAL;

agent/src/ebpf/user/tracer.c

@@ -1143,8 +1143,19 @@ static int lsm_attach(struct lsm_prog *p)
 		return ETR_EXIST;
 	}
 
-	if (p->prog->prog_fd == 0)
+	if (p->prog->prog_fd < 0) {
+		ebpf_warning("skip unloaded lsm program, name:%s.\n", p->name);
+		return ETR_INVAL;
+	}
+
+	if (p->prog->prog_fd == 0) {
 		p->prog->prog_fd = load_ebpf_prog(p->prog);
+		if (p->prog->prog_fd < 0) {
+			ebpf_warning("load lsm program failed, name:%s.\n",
+				     p->name);
+			return ETR_INVAL;
+		}
+	}
 
 	struct ebpf_link *bl = program__attach_lsm(p->prog);
 	p->link = bl;