deepfence / ebpfguard Goto Github PK

View Code? Open in Web Editor NEW

270.0 6.0 90.0 4.51 MB

Rust library for writing Linux security policies using eBPF

License: Apache License 2.0

Rust 95.78% Python 1.81% Dockerfile 0.55% C 1.85%

ebpfguard's People

Contributors

Stargazers

Watchers

Forkers

crackercat tomaszjonak rajkrishnamurthy nawabsahab16 vedantkolhe30 knighthawk-leo miarkable shanks2121 ishukrpathak kavyaswarnkar harshnow sitanshulall akashtiwari2003 manas234543 shrutiiihere ranjit7858 theayushgaur txtgrey yash-sakre bhumika987 prabhakarjha04 prateekmahant6 jayashtripathy carrycooldude amit7nayak bhaveshyadav1501 singhrishabh93 divyaa0325 dhruv-5319 manas031201 shivani8702 apoorvatiwari26 ahwhantiwari rashiiiiii shubhrad30 aishwaryyyaaaaa soniogar giteshsarvaiya amanjsr12 shekharkushwaha01 avanindrasingh007 gaurishankarpatel muskan-tiwari31 arshmandal0725 abhikashyap135 hitoutvrma amaan1305 aditya-kumar-sahu nilaysahu13 l0ki125 manasgajendra yadavsaket harshdewangan19 tarezh botkunal rajak82001 meghak1 speeddefiesgravity001 aakansha219 prakashsp23 notkashyap nilimasahu22 itzhoneybunny w-a-r-l-u prachix36 mopasha1 imsachin010 0armaan025 singhnikhil2002 vishvasingh mdhvishv amantiwari2091 kaustubhsaraf aamankhapre ayushchaware08 krutika2529 88samriddhi sakshimoharkar rutuja-balpande piyushsahu1 ankitaarya04 sonugithub5 anil534 yashaswisahu28 gittugaurav aaishakhan v0idmatr1x patrickkellyjr scma2z

ebpfguard's Issues

all example not able to run on ubuntu-jammy-22.04-amd64-server on ec2

  Compiling clap v4.2.7
   Compiling ebpfguard-common v0.1.0 (/home/ubuntu/ebpfguard/ebpfguard-common)
   Compiling ebpfguard v0.1.0 (/home/ubuntu/ebpfguard/ebpfguard)
   Compiling file_open v0.1.0 (/home/ubuntu/ebpfguard/examples/file_open)
    Finished dev [unoptimized + debuginfo] target(s) in 34.36s
sudo: target/debug/examples/file_open: command not found
Failed to run `sudo -E target/debug/examples/file_open --path-to-deny /tmp/test`

let me known if I'm missing anything @noboruma @tomaszjonak

Add remaining LSM hooks

Top level tracking issue. Will be done in batches.

eBPF: bpf-linker sigsegv in release mode

error: linking with `bpf-linker` failed: signal: 11 (SIGSEGV) (core dumped)
  |
  = note: LC_ALL="C" PATH="/home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/x86_64-unknown-linux-gnu/bin:/home/user/.local/bin:/home/user/.local/bin:/home/user/.local/bin:/home/user/.cargo/bin:/home/user/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin:/usr/local/go/bin:/usr/local/go/bin:/usr/local/go/bin" VSLANG="1033" "bpf-linker" "--export-symbols" "/tmp/rustcxgmdFZ/symbols" "/tmp/rustcxgmdFZ/symbols.o" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/bpfel-unknown-none/release/deps/ebpfguard-04a7e4f8d4e9bade.ebpfguard.97ac88886015d5ba-cgu.0.rcgu.o" "-L" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/bpfel-unknown-none/release/deps" "-L" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/release/deps" "-L" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/bpfel-unknown-none/release/build/ebpfguard-ebpf-09853f90652e03f0/out" "-L" "/home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/bpfel-unknown-none/lib" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/bpfel-unknown-none/release/build/ebpfguard-ebpf-09853f90652e03f0/out/vmlinux_access.o" "--cpu" "generic" "--cpu-features" "" "-L" "/home/user/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/bpfel-unknown-none/lib" "-o" "/home/user/deepfence/experimental/ebpfguard/ebpfguard-ebpf/../target/bpfel-unknown-none/release/deps/ebpfguard-04a7e4f8d4e9bade" "-O3" "--debug"
  = note: PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
          Stack dump:
          0.    Running pass 'Function Pass Manager' on module 'ebpfguard-04a7e4f8d4e9bade'.
          1.    Running pass 'BPF Assembly Printer' on function '@prog_bprm_check_security'
          16:54:59 [WARN] ignoring file "/tmp/rustcxgmdFZ/symbols.o": no embedded bitcode
          

error: could not compile `ebpfguard-ebpf` (bin "ebpfguard") due to previous error

Automatically trigger ebpf build on cargo run in workspace root

Poked a little today but no satisfying results. Looks like this would be a clean solution rust-lang/cargo#9096. It is not stabilized yet though.

Readme example bpf code fails verifier on debian 11 with 5.10.0 kernel

https://github.com/deepfence/ebpfguard/tree/3bcc2e8250cae04cf9863896229b0578ad9a8092/examples/readme_mount

Error: attach_sb_mount

Caused by:
    0: Failed to load BPF program: the BPF_PROG_LOAD syscall failed. Verifier output: 0: (bf) r6 = r1
       1: (85) call unknown#158
       invalid func unknown#158
       verification time 783 usec
       stack depth 0
       processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
       
    1: the BPF_PROG_LOAD syscall failed. Verifier output: 0: (bf) r6 = r1
       1: (85) call unknown#158
       invalid func unknown#158
       verification time 783 usec
       stack depth 0
       processed 2 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
       
    2: Invalid argument (os error 22)

BPF programs are not unloaded from kernel if user space program running in docker container receives SIGKILL

Encountered this while running demo_socket_listen in docker. kill -9 on host machine hanged container. Ended up rebooting the machine.

Add release automation and cut off 0.1

Can be similar to aya one. Github label based release notes. Granularity tbd.

SocketConnect: no enforcement on ubuntu 22.04

As title states. Ubuntu 22.04 LTS. Kernel 5.19.0-46-generic

        socket_connect.add_policy(SocketConnect {
            subject: PolicySubject::Binary("/usr/bin/curl".into()),
            allow: Addresses::All,
            deny: Addresses::Addresses(vec![IpAddr::from([127u8, 1u8, 2u8, 3u8])]),
        }).await?;

Debian{11,12}: socket bind deny policy loads but doesn't enforce rules

Debian 12 as a kvm based vm on ubuntu 22.04. Kernel 6.1.0-7-amd64.

Source code: demo_socket_listen

SocketConnect: returned alarm should include port

Right now we only return inode of a binary, addr and pid.

CI: compile, run and verify outcomes of all examples

Likewise run build container and try out compilation.

Expose library feature for inclusion of big endian eBPF object file

Right now we default to bpfel-unknown-none for eBPF object. Users may want bpfeb.

Publish to crates.io

Postponed till we get more LSM hooks integrated.

Ref: #32

fix example policies program with correct permissions

https://github.com/deepfence/ebpfguard/tree/main/examples

@noboruma @tomaszjonak

Add recommendation to use musl libc target to readme

Since we depend on a shim c layer differences in GLIBC versions may matter if build and runtime environments are different enough. This may result in errors akin to the following.

./demo_socket_listen: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.33' not found (required by ./demo_socket_listen)
./demo_socket_listen: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by ./demo_socket_listen)
./demo_socket_listen: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./demo_socket_listen)

If app deployment is containerized it shouldn't matter as the user controls libc version. Still calling this out explicitly wont hurt.