willfindlay / bpfbox Goto Github PK

Hi! - bpfbox looks really nice. Thanks for documenting your work via the research paper.

I just had a question regarding func directives. As mentioned in the paper, policies can include func names like check_password().

Does the func name here imply the name of the function within the source of the application that will be contained via bpfbox? If so, how would a func directive work with binaries that don't expose such information (e.g. are distributed as closed source software).

Need to finish configuring Semaphore CI to automatically run unit tests on newer kernels. So far, there are some linker issues with building bcc from source on the Ubuntu VM. Seems to be a Semaphore idiosyncrasy. See: iovisor/bcc#3161

The plan is to run QEMU on top of the Semaphore VM so we can test with bleeding-edge kernels.

Do you have any plans to enhance bpfbox network rules with specifying hostnames/ips allowed to connect to, as Windows firewalls/HIPS do?
Or is it out of scope of this project?