Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

default-policies: trace kprobes arm and disarm operations #1921

Draft
wants to merge 17 commits into
base: main
Choose a base branch
from
Draft

default-policies: trace kprobes arm and disarm operations #1921

wants to merge 17 commits into from

Conversation

tixxdz
Copy link
Member

@tixxdz tixxdz commented Dec 28, 2023 •
edited
Loading 

{
  "process_kprobe": {
    "process": {
      "exec_id": "OjE3MzU4ODI5MDAwMDAwMDozODk0Njg=",
      "pid": 389468,
      "uid": 0,
      "cwd": "/root",
      "binary": "/usr/bin/bash"
       ...
    }
    "function_name": "write_enabled_file_bool",
    "args": [
      {
        "file_arg": {
          "path": "/sys/kernel/debug/kprobes/enabled"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Possible kprobe host modification that can lead to security evasion"
  },
  "time": "2023-12-28T17:27:09.427141176Z"
}
...
    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_security_bprm_committing_creds"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"
...
    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_wake_up_new_task"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"
...
    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_acct_process"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"

@tixxdz
api:proto: add short message field
b2b42b4 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
kubebuilder: add message field
35280b6 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
api:generate: add message field
6954f4e 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
kprobe: handle message field in kprobe events
1d789f7 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
tetragon: add default shipped directory for tracing policies
8728b01 
Load default shipped tracing policies from
/usr/lib/tetragon/tetragon.tp.d/

Make /etc/tetragon/tetragon.tp.d/ for administrators and users only.
This way we allow both to work together without conflicting.

Users can just remove /usr/lib/tetragon/tetragon.tp.d/ or tracing
policies inside that directory and restart to ingore the default shipped
ones.

Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
container: fill up /usr/lib/tetragon/tetragon.tp.d
6e26924 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
tetragon:host: copy default tracing policies
e43becf 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
default:tracingpolicy: observer kprobe sysfs enabled disable
f77efd9 
Add default tracing policy that observes if kprobes is being disabled.

On most distros it is enabled by default, so any modification here could
indicate that kprobes are being disarmed.

We will add more tracing to go by kprobe arm and disarm operation.

Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz tixxdz requested review from a team and mtardy as code owners December 28, 2023 17:10
@tixxdz tixxdz marked this pull request as draft December 28, 2023 17:10
@netlify Netlify
Copy link

netlify bot commented Dec 28, 2023 •
edited
Loading

✅ Deploy Preview for tetragon ready!

Name Link
🔨 Latest commit 73e74a2
🔍 Latest deploy log https://app.netlify.com/sites/tetragon/deploys/65981efe953f4e00080d1cb2
😎 Deploy Preview https://deploy-preview-1921--tetragon.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@tixxdz tixxdz force-pushed the pr/tixxdz/default-policy-kprobes branch from 50f95cf to 0227aa4 Compare December 28, 2023 17:32
@tixxdz
api:proto: add KernelProbe object
732f316 
Add KernelProbe to monitor kprobes usage.

Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
api:tracingpolicy: add kprobe object
d29f64e 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
tetragon: handle kprobe at bpf and userspace
3a31403 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
api: add kprobe_arg
8cd8cb5 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
api:proto: fixup the KernelProbe object
76797d5 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
tetragon: fix report the kprobe symbol
aa3904b 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz
tracingpolicy: add observer arm/disarm kprobes operations
73e74a2 
Output:

    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_security_bprm_committing_creds"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"

    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_wake_up_new_task"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"

    "function_name": "disarm_kprobe_ftrace",
    "args": [
      {
        "kprobe_arg": {
          "offset": 0,
          "symbol": "__pfx_acct_process"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST",
    "policy_name": "kprobes-observe",
    "return_action": "KPROBE_ACTION_POST",
    "message": "Disable a kprobe (kernel probe)"

Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz tixxdz added the release-note/major This PR introduces major new functionality label Jan 5, 2024
@tixxdz tixxdz changed the title default-policies: kprobes default-policies: trace kprobes arm and disarm operations Jan 5, 2024
@tixxdz
bpf: add missing kprobes.h
3868b4d 
Signed-off-by: Djalal Harouni <[email protected]>
@tixxdz tixxdz mentioned this pull request Jan 8, 2024
Merged
@kkourt kkourt added the needs-rebase This PR needs to be rebased because it has merge conflicts. label Jan 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mtardy mtardy Awaiting requested review from mtardy mtardy is a code owner

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
needs-rebase This PR needs to be rebased because it has merge conflicts. release-note/major This PR introduces major new functionality
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tixxdz @kkourt