LSM sensor #2566

anfedotoff · 2024-06-16T09:07:08Z

LSM sensor support allows to use LSM BPF programs the way we use BPF programs for kprobes/tracepoints/uprobes.

TracingPolicy example:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "lsm"
spec:
  lsmhooks:
  - hook: "file_open"
    args:
      - index: 0
        type: "file"
    selectors:
    - matchBinaries:
      - operator: "In"
        values:
        - "/usr/bin/cat"

Event example:

{                                                                                                     
  "process_lsm": {                                                                                    
    "process": {                                                                                      
      "exec_id": "dXNlci1uaXg6MTk5MzE1NDk0NTk3MzM6MzIwMTA4",                                  
      "pid": 320108,                                                                                  
      "uid": 1000,                                                                                    
      "cwd": "/home/user/go/src/github.com/cilium/tetragon",                                    
      "binary": "/usr/bin/cat",                                                                       
      "arguments": "/etc/passwd",                                                                     
      "flags": "execve clone",                                                                        
      "start_time": "2024-06-15T18:03:29.742161520Z",                                                                                                                                                       
      "auid": 1000,                                                                                   
      "parent_exec_id": "dXNlci1uaXg6ODg1NjMwMDAwMDAwMDoxNDc4MTI=",                                                                                                                                 
      "refcnt": 1,                                                                                    
      "tid": 320108,                                                                                  
      "user": {                                                                                       
        "name": "user"                                                                          
      }                                                                                               
    },                                                                                                
    "parent": {                                                                                       
      "exec_id": "dXNlci1uaXg6ODg1NjMwMDAwMDAwMDoxNDc4MTI=",                                  
      "pid": 147812,                                                                                  
      "uid": 1000,                                                                                    
      "cwd": "/home/user/go/src/github.com/cilium/tetragon",                                                                                                                                          
      "binary": "/usr/bin/zsh",                                                                                                                                                                             
      "flags": "procFS auid",                                                                         
      "start_time": "2024-06-15T14:37:33.597296165Z",
      "auid": 1000,
      "parent_exec_id": "dXNlci1uaXg6MTM1ODA0MDAwMDAwMDozMTQ2",
      "tid": 147812
    },
    "function_name": "file_open",
    "policy_name": "lsm",
    "args": [
      {
        "file_arg": {
          "path":"/etc/passwd",
          "permission":"-rw-r--r--"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST"
  },
  "node_name": "user-nix",
  "time": "2024-06-15T18:03:29.743030933Z"
}

This is also necessary for #2409.

netlify · 2024-06-16T09:07:48Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`72fc133`
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/6694f2df98256300088c6cef
😎 Deploy Preview	https://deploy-preview-2566--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

anfedotoff · 2024-06-16T09:19:50Z

There are things to do:

Fix tests
Add lsm test
Decide minimal kernel version for LSM sensor support (LSM BPF is needed 5.7 kernel).
Fix some bugs in code and make it more neat.

I managed to load LSM BPF programs, tail calls also work for LSM programs! The most terrifying problems are solved, I think. I managed to catch some Lsm events).

anfedotoff · 2024-06-26T13:10:02Z

For now I managed to fix problem with args resolving. LSM BPF programs get args the way raw tracepoint programs do. So, LSM events now are looking good. It would be nice to start code review.

Some open questions:

./verify/verify.sh . I made a hack for loading generic LSM programs. But I need to install llvm-objcopy in CI
Tests. I think we need some tests. Maybe more than one. I'll work on it. Maybe we discuss what kind of tests it's good to have?
Enforce mode. If LSM BPF returns the value that is not qual to zero, than operation is not permitted. Maybe we should add an action for that? For example, if policy is violated just return -EPERM, instead of sending SIGKILL.

@kkourt, @olsajiri, @mtardy please could you have a look?

kkourt

Thanks!

Overall, this looks good to me! I've left some minor comments.

./verify/verify.sh . I made a hack for loading generic LSM programs. But I need to install llvm-objcopy in CI

Looks good to me. Yap, let's install it. I'm guessing it should be part of our clang container so we can just use that.

Tests. I think we need some tests. Maybe more than one. I'll work on it. Maybe we discuss what kind of tests it's good to have?

That's a good question. I would say start simple, and have one or two tests for the basic functionality (observability and enforcement)

Enforce mode. If LSM BPF returns the value that is not qual to zero, than operation > is not permitted. Maybe we should add an action for that? For example, if policy is > violated just return -EPERM, instead of sending SIGKILL.

Yap, I think that makes sense. We also have an override action that does something similar, but having a separate action for lsm (as you do in your PR) makes sense to me.

bpf/Makefile

pkg/sensors/tracing/genericlsm.go

pkg/sensors/tracing/lsm_test.go

kkourt · 2024-07-03T10:49:16Z

@olsajiri I added you to the reviewers. It would be great if you could have a look when you get a chance. Thanks!

Kprobes and uprobes have the almost the same code in generic_kprobe_start_process_filter and generic_uprobe_start_process_filter it can be generic. Signed-off-by: Andrei Fedotov <[email protected]>

anfedotoff · 2024-07-12T12:23:09Z

It seems to me, that test are passing and fixed all comments. @olsajiri @kkourt , please, could you have a look one more time:)?

olsajiri

lgtm, nice work! thanks

kkourt

LGTM, thanks!

mtardy

This PR is lovely and nice to review! Thanks!

docs/content/en/docs/concepts/tracing-policy/hooks.md

bpf/process/bpf_generic_lsm.c

Adding generic LSM bpf. It follows the kprobe/tracepoint/uprobe logic also calls same generic functions. Signed-off-by: Andrei Fedotov <[email protected]>

Set up tailcalls map for generic LSM sensor. Add LSMOpen function to override attach points collected from section names. Signed-off-by: Andrei Fedotov <[email protected]>

Use features.HaveProgramType(ebpf.LSM) and inspect /sys/kernel/security/lsm file to check LSM availability. Try to load and attach simple LSM probe. Signed-off-by: Andrei Fedotov <[email protected]>

Adding LSM message/event definition. Signed-off-by: Andrei Fedotov <[email protected]>

Signed-off-by: Andrei Fedotov <[email protected]>

Adding generic LSM sensor that reads LSM crd config and setups LSM programs. The LSM is configured with hook, like: spec: lsmhooks: - hook: "bprm_check_security" Signed-off-by: Andrei Fedotov <[email protected]>

Adding PROCESS_LSM to exportAllowList event_set values. Signed-off-by: Andrei Fedotov <[email protected]>

Adding tests for generic LSM sensor - load and apply tracing policy. Signed-off-by: Andrei Fedotov <[email protected]>

Adding test to check enforcement for generic LSM sensor. Signed-off-by: Andrei Fedotov <[email protected]>

Generic LSM BPF needs more complex userspace logic to load, so ignore it. Signed-off-by: Andrei Fedotov <[email protected]>

Adding examples of lsm tracing policies to monitor file access and process execution. Signed-off-by: Andrei Fedotov <[email protected]>

Adding section about LSM hook points. Signed-off-by: Andrei Fedotov <[email protected]>

tixxdz

Didn't have time to review all, thank you for the nice contributions ;-)

kkourt · 2024-07-19T05:36:56Z

Merging this, thanks! Great work!

There are some gaps in EventType and GetEventsResponse field numbers because some fields got removed from these events. Mark these field numbers as reserved to avoid accidentally re-using them. Move process_lsm field number from 13 to 28 since the field number 13 has already been used in the past. It's still safe to change the field number for process_lsm since we haven't released the process_lsm APIs [^1]. [^1]: #2566 Suggested-by: Lorenz Bauer <[email protected]> Signed-off-by: Michi Mutsuzaki <[email protected]>

anfedotoff requested a review from a team as a code owner June 16, 2024 09:07

anfedotoff requested a review from kkourt June 16, 2024 09:07

anfedotoff marked this pull request as draft June 16, 2024 09:09

anfedotoff force-pushed the lsm-sensor branch 7 times, most recently from a9f28bf to 1f5d707 Compare June 26, 2024 12:50

anfedotoff marked this pull request as ready for review June 26, 2024 13:11

anfedotoff requested a review from mtardy as a code owner June 26, 2024 13:11

anfedotoff force-pushed the lsm-sensor branch 2 times, most recently from f17edbc to 03cb7db Compare June 26, 2024 13:48

anfedotoff changed the title ~~wip: LSM sensor~~ LSM sensor Jun 26, 2024

anfedotoff force-pushed the lsm-sensor branch 6 times, most recently from 0127073 to 1cc6efb Compare July 2, 2024 11:56

kkourt added the release-note/major This PR introduces major new functionality label Jul 3, 2024

kkourt reviewed Jul 3, 2024

View reviewed changes

kkourt requested a review from olsajiri July 3, 2024 10:48

anfedotoff force-pushed the lsm-sensor branch 2 times, most recently from e0f9144 to 98e2cd3 Compare July 4, 2024 19:07

anfedotoff force-pushed the lsm-sensor branch 2 times, most recently from 30708a5 to 256b762 Compare July 12, 2024 11:15

bpf: Add generic_start_process_filter for kprobes and uprobes

41625b4

Kprobes and uprobes have the almost the same code in generic_kprobe_start_process_filter and generic_uprobe_start_process_filter it can be generic. Signed-off-by: Andrei Fedotov <[email protected]>

anfedotoff force-pushed the lsm-sensor branch from 256b762 to fc61137 Compare July 12, 2024 12:19

olsajiri approved these changes Jul 12, 2024

View reviewed changes

kkourt approved these changes Jul 13, 2024

View reviewed changes

kkourt requested a review from tixxdz July 13, 2024 08:17

mtardy reviewed Jul 15, 2024

View reviewed changes

docs/content/en/docs/concepts/tracing-policy/hooks.md Outdated Show resolved Hide resolved

docs/content/en/docs/concepts/tracing-policy/hooks.md Outdated Show resolved Hide resolved

anfedotoff force-pushed the lsm-sensor branch from fc61137 to 72fc133 Compare July 15, 2024 09:58

tixxdz reviewed Jul 15, 2024

View reviewed changes

bpf/process/bpf_generic_lsm.c Outdated Show resolved Hide resolved

anfedotoff added 12 commits July 15, 2024 23:15

bpf: Add generic LSM bpf object

5fbef64

Adding generic LSM bpf. It follows the kprobe/tracepoint/uprobe logic also calls same generic functions. Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Update LoadLSMProgram to load generic LSM bpf object

55ec250

Set up tailcalls map for generic LSM sensor. Add LSMOpen function to override attach points collected from section names. Signed-off-by: Andrei Fedotov <[email protected]>

bpf: Add HasLSMPrograms() to check LSM support

15be75a

Use features.HaveProgramType(ebpf.LSM) and inspect /sys/kernel/security/lsm file to check LSM availability. Try to load and attach simple LSM probe. Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Add ProcessLSM message

00696f2

Adding LSM message/event definition. Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Update codegen/generate

cb62dd3

Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Add generic LSM sensor

fce2a2b

Adding generic LSM sensor that reads LSM crd config and setups LSM programs. The LSM is configured with hook, like: spec: lsmhooks: - hook: "bprm_check_security" Signed-off-by: Andrei Fedotov <[email protected]>

helm: Add LSM event to exportAllowList and update install

92c9d83

Adding PROCESS_LSM to exportAllowList event_set values. Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Add TestLSMObjectLoad and TestLSMOpenFile

09c7d71

Adding tests for generic LSM sensor - load and apply tracing policy. Signed-off-by: Andrei Fedotov <[email protected]>

tetragon: Add TestLSMOverrideAction

fb6a0f6

Adding test to check enforcement for generic LSM sensor. Signed-off-by: Andrei Fedotov <[email protected]>

contrib: Skip LSM bpf generic object load check in verify.sh

a799857

Generic LSM BPF needs more complex userspace logic to load, so ignore it. Signed-off-by: Andrei Fedotov <[email protected]>

Add LSM TracingPolicy examples

7aaa765

Adding examples of lsm tracing policies to monitor file access and process execution. Signed-off-by: Andrei Fedotov <[email protected]>

Add documentation for LSM sensor

cd921bb

Adding section about LSM hook points. Signed-off-by: Andrei Fedotov <[email protected]>

anfedotoff force-pushed the lsm-sensor branch from 72fc133 to cd921bb Compare July 15, 2024 20:15

tixxdz approved these changes Jul 16, 2024

View reviewed changes

kkourt merged commit fd6ef3d into cilium:main Jul 19, 2024
48 checks passed

anfedotoff mentioned this pull request Jul 29, 2024

Tetragon based file integrity monitoring (FIM) #2409

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LSM sensor #2566

LSM sensor #2566

anfedotoff commented Jun 16, 2024 •

edited

Loading

netlify bot commented Jun 16, 2024 •

edited

Loading

anfedotoff commented Jun 16, 2024

anfedotoff commented Jun 26, 2024 •

edited

Loading

kkourt left a comment

kkourt commented Jul 3, 2024

anfedotoff commented Jul 12, 2024

olsajiri left a comment

kkourt left a comment

mtardy left a comment

tixxdz left a comment

kkourt commented Jul 19, 2024

LSM sensor #2566

LSM sensor #2566

Conversation

anfedotoff commented Jun 16, 2024 • edited Loading

netlify bot commented Jun 16, 2024 • edited Loading

✅ Deploy Preview for tetragon ready!

anfedotoff commented Jun 16, 2024

anfedotoff commented Jun 26, 2024 • edited Loading

kkourt left a comment

Choose a reason for hiding this comment

kkourt commented Jul 3, 2024

anfedotoff commented Jul 12, 2024

olsajiri left a comment

Choose a reason for hiding this comment

kkourt left a comment

Choose a reason for hiding this comment

mtardy left a comment

Choose a reason for hiding this comment

tixxdz left a comment

Choose a reason for hiding this comment

kkourt commented Jul 19, 2024

anfedotoff commented Jun 16, 2024 •

edited

Loading

netlify bot commented Jun 16, 2024 •

edited

Loading

anfedotoff commented Jun 26, 2024 •

edited

Loading