fix(bpf): use BPF_CORE_READ for ns.inum to fix verifier stack boundary error on kernel 6.18+

[Athang69]

Purpose of PR?:

On kernel 6.18 (Talos 1.12.6), the BPF LSM enforcer fails to load with a verifier error: invalid read from stack R7 off=0 size=4. get_task_pid_ns_id and get_task_mnt_ns_id in shared.h used BPF_CORE_READ(..., ns).inum which reads the entire ns_common struct (24 bytes) onto the stack at fp-24, then accesses .inum at offset +24 from that base, landing at fp+0 - past the stack frame boundary. Kernel 6.18 is stricter about this than earlier kernels, causing the verifier to reject the program and the enforcer to fail to initialize, leaving no active LSMs. Fix moves .inum inside the BPF_CORE_READ macro so it is read as a scalar directly from kernel memory instead of staging ns_common on the stack first.

Fixes #2544

Does this PR introduce a breaking change?

No

If the changes in this PR are manually verified, list down the scenarios covered::

Verified by reproducing the verifier error on Talos 1.12.6 (kernel 6.18.18-talos) with kubearmor 1.6.16 and confirming the error matches the stack boundary analysis. Unable to recompile BPF objects locally to test binary, but the root cause is confirmed directly from the verifier output.

Additional information for reviewer? :

The commented-out cgroup_ns line in get_outer_key has the same pattern BPF_CORE_READ(t, nsproxy, cgroup_ns, ns).inum and will hit the same verifier error if uncommented. Should be fixed preemptively.

Checklist:

• Bug fix. Fixes Talos 1.12.6 bpf verifier permission errors #2544
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• PR Title follows the convention of <type>(<scope>): <subject>
• Commit has unit tests
• Commit has integration tests

[Copilot]

Pull request overview

Fixes a BPF verifier rejection on newer kernels by ensuring namespace inode numbers are read as scalars directly from kernel memory (via CO-RE), avoiding an intermediate ns_common stack copy that can lead to out-of-bounds stack access under stricter verification.

Changes:

• Update get_task_pid_ns_id() to read ns.inum via BPF_CORE_READ(...) instead of reading ns then accessing .inum.
• Update get_task_mnt_ns_id() similarly to read ns.inum via BPF_CORE_READ(...).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Athang69]

Hi @Aryan-sharma11, gentle ping on this PR would appreciate your review when possible. Thanks!

[rksharma95]

@Athang69 really appreciate your efforts, the issue has been fixed with #2572

[Athang69]

@rksharma95 Thanks for the update! No worries at all. Happy to see the issue is resolved. I'll close this PR