Building Modern eBPF Security Tools with Rust and Aya: A Comprehensive Guide#

The eBPF ecosystem has evolved significantly, with Rust emerging as a powerful language for building safe, efficient, and maintainable eBPF programs. Aya, a pure-Rust eBPF library, has revolutionized how we develop kernel-level security tools by bringing Rust’s safety guarantees to the kernel. This comprehensive guide explores building production-grade security monitoring solutions using Rust and Aya.

Why Rust and Aya for eBPF Security?#

The Perfect Match#

Rust’s memory safety, zero-cost abstractions, and powerful type system make it ideal for eBPF development:

Memory Safety: No null pointer dereferences or buffer overflows
Type Safety: Catch errors at compile time, not in production
Performance: Zero-cost abstractions mean no runtime overhead
Expressiveness: Modern language features for cleaner code

Aya’s Advantages#

Unlike traditional eBPF development with C and libbpf, Aya offers:

Pure Rust: Both kernel and user-space code in Rust
No Dependencies: Built from scratch without libbpf or BCC
Compile Once, Run Everywhere: True portability with BTF and musl
Developer Experience: Idiomatic Rust APIs and excellent tooling

Setting Up Your Development Environment#

Prerequisites#

1
# Install Rust and cargo
2
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
3

4
# Install bpf-linker for eBPF compilation
5
cargo install bpf-linker
6

7
# Install cargo-generate for project templates
8
cargo install cargo-generate
9

10
# Install bpftool for debugging
11
sudo apt-get install linux-tools-common linux-tools-generic
12

13
# Verify kernel support
14
uname -r  # Should be 5.4+ for best compatibility

Creating Your First Aya Project#

1
# Generate a new eBPF project
2
cargo generate https://github.com/aya-rs/aya-template
3

4
# Project structure
5
security-monitor/
6
├── Cargo.toml
7
├── security-monitor/
8
│   ├── Cargo.toml
9
│   └── src/
10
│       └── main.rs
11
├── security-monitor-common/
12
│   ├── Cargo.toml
13
│   └── src/
14
│       └── lib.rs
15
├── security-monitor-ebpf/
16
│   ├── Cargo.toml
17
│   └── src/
18
│       └── main.rs
19
└── xtask/
20
    ├── Cargo.toml
21
    └── src/
22
        └── main.rs

Building a File Integrity Monitor#

Let’s build a production-grade file integrity monitoring system:

eBPF Program (Kernel Space)#

1
#![no_std]
2
#![no_main]
3

4
use aya_ebpf::{
5
    bindings::xdp_action,
6
    macros::{kprobe, lsm, map, tracepoint},
7
    maps::{HashMap, PerfEventArray, RingBuf},
8
    programs::{KProbeContext, LsmContext, TracePointContext},
9
    helpers::{
10
        bpf_get_current_pid_tgid,
11
        bpf_get_current_uid_gid,
12
        bpf_ktime_get_ns,
13
        bpf_probe_read_kernel_str_bytes,
14
        bpf_d_path,
15
    },
16
};
17
use aya_log_ebpf::info;
18
use security_monitor_common::{FileEvent, EventType, ProcessInfo};
19

20
#[map]
21
static mut FILE_EVENTS: RingBuf = RingBuf::with_max_entries(256 * 1024, 0);
22

23
#[map]
24
static mut PROCESS_CACHE: HashMap<u32, ProcessInfo> = HashMap::with_max_entries(10240, 0);
25

26
#[map]
27
static mut MONITORED_PATHS: HashMap<[u8; 256], u8> = HashMap::with_max_entries(1024, 0);
28

29
#[lsm(hook = "file_open")]
30
pub fn monitor_file_open(ctx: LsmContext) -> i32 {
31
    match try_monitor_file_open(ctx) {
32
        Ok(ret) => ret,
33
        Err(_) => 0,
34
    }
35
}
36

37
fn try_monitor_file_open(ctx: LsmContext) -> Result<i32, i64> {
38
    // Get file path
39
    let file: *const bindings::file = unsafe { ctx.arg(0) };
40
    let mut path_buf = [0u8; 256];
41

42
    unsafe {
43
        let dentry = (*file).f_path.dentry;
44
        let mnt = (*file).f_path.mnt;
45

46
        // Use d_path helper to get full path
47
        bpf_d_path(&(*file).f_path as *const _ as *mut _,
48
                   path_buf.as_mut_ptr() as *mut _,
49
                   path_buf.len() as u32);
50
    }
51

52
    // Check if path is monitored
53
    if !is_monitored_path(&path_buf)? {
54
        return Ok(0);
55
    }
56

57
    // Get process information
58
    let pid_tgid = bpf_get_current_pid_tgid();
59
    let pid = (pid_tgid >> 32) as u32;
60
    let tgid = pid_tgid as u32;
61

62
    let uid_gid = bpf_get_current_uid_gid();
63
    let uid = uid_gid as u32;
64
    let gid = (uid_gid >> 32) as u32;
65

66
    // Create file event
67
    let event = FileEvent {
68
        timestamp: unsafe { bpf_ktime_get_ns() },
69
        event_type: EventType::FileOpen,
70
        pid,
71
        tgid,
72
        uid,
73
        gid,
74
        path: path_buf,
75
        flags: unsafe { (*file).f_flags },
76
        mode: unsafe { (*file).f_mode },
77
    };
78

79
    // Submit event to ring buffer
80
    unsafe {
81
        FILE_EVENTS.output(&event, 0)?;
82
    }
83

84
    Ok(0)
85
}
86

87
#[kprobe("security_file_permission")]
88
pub fn monitor_file_permission(ctx: KProbeContext) -> i32 {
89
    match try_monitor_file_permission(ctx) {
90
        Ok(ret) => ret,
91
        Err(_) => 0,
92
    }
93
}
94

95
fn try_monitor_file_permission(ctx: KProbeContext) -> Result<i32, i64> {
96
    let file: *const bindings::file = unsafe { ctx.arg(0).ok_or(0i64)? };
97
    let mask: i32 = unsafe { ctx.arg(1).ok_or(0i64)? };
98

99
    // Check for write operations
100
    if mask & 0x2 == 0 {  // MAY_WRITE
101
        return Ok(0);
102
    }
103

104
    let mut path_buf = [0u8; 256];
105
    unsafe {
106
        bpf_d_path(&(*file).f_path as *const _ as *mut _,
107
                   path_buf.as_mut_ptr() as *mut _,
108
                   path_buf.len() as u32);
109
    }
110

111
    if !is_monitored_path(&path_buf)? {
112
        return Ok(0);
113
    }
114

115
    let pid_tgid = bpf_get_current_pid_tgid();
116
    let uid_gid = bpf_get_current_uid_gid();
117

118
    let event = FileEvent {
119
        timestamp: unsafe { bpf_ktime_get_ns() },
120
        event_type: EventType::FileWrite,
121
        pid: (pid_tgid >> 32) as u32,
122
        tgid: pid_tgid as u32,
123
        uid: uid_gid as u32,
124
        gid: (uid_gid >> 32) as u32,
125
        path: path_buf,
126
        flags: mask as u32,
127
        mode: 0,
128
    };
129

130
    unsafe {
131
        FILE_EVENTS.output(&event, 0)?;
132
    }
133

134
    Ok(0)
135
}
136

137
#[tracepoint("syscalls", "sys_exit_unlink")]
138
pub fn monitor_file_unlink(ctx: TracePointContext) -> i32 {
139
    match try_monitor_file_unlink(ctx) {
140
        Ok(ret) => ret,
141
        Err(_) => 0,
142
    }
143
}
144

145
fn try_monitor_file_unlink(ctx: TracePointContext) -> Result<i32, i64> {
146
    // Get return value to check if unlink succeeded
147
    let ret: i64 = unsafe { ctx.read_at(16)? };
148
    if ret < 0 {
149
        return Ok(0);  // Unlink failed
150
    }
151

152
    // Get the pathname from saved args
153
    let pathname_ptr: *const u8 = unsafe { ctx.read_at(24)? };
154
    let mut path_buf = [0u8; 256];
155

156
    unsafe {
157
        bpf_probe_read_kernel_str_bytes(
158
            pathname_ptr,
159
            &mut path_buf
160
        )?;
161
    }
162

163
    if !is_monitored_path(&path_buf)? {
164
        return Ok(0);
165
    }
166

167
    let pid_tgid = bpf_get_current_pid_tgid();
168
    let uid_gid = bpf_get_current_uid_gid();
169

170
    let event = FileEvent {
171
        timestamp: unsafe { bpf_ktime_get_ns() },
172
        event_type: EventType::FileDelete,
173
        pid: (pid_tgid >> 32) as u32,
174
        tgid: pid_tgid as u32,
175
        uid: uid_gid as u32,
176
        gid: (uid_gid >> 32) as u32,
177
        path: path_buf,
178
        flags: 0,
179
        mode: 0,
180
    };
181

182
    unsafe {
183
        FILE_EVENTS.output(&event, 0)?;
184
    }
185

186
    Ok(0)
187
}
188

189
#[inline(always)]
190
fn is_monitored_path(path: &[u8; 256]) -> Result<bool, i64> {
191
    // Check exact match
192
    unsafe {
193
        if MONITORED_PATHS.get(path).is_some() {
194
            return Ok(true);
195
        }
196
    }
197

198
    // Check prefix match for directories
199
    for i in (1..256).rev() {
200
        if path[i] == b'/' || path[i] == 0 {
201
            let mut prefix = [0u8; 256];
202
            prefix[..=i].copy_from_slice(&path[..=i]);
203

204
            unsafe {
205
                if MONITORED_PATHS.get(&prefix).is_some() {
206
                    return Ok(true);
207
                }
208
            }
209

210
            if path[i] == 0 {
211
                break;
212
            }
213
        }
214
    }
215

216
    Ok(false)
217
}
218

219
#[panic_handler]
220
fn panic(_info: &core::panic::PanicInfo) -> ! {
221
    unreachable!()
222
}

Common Types (Shared)#

1
#![no_std]
2

3
#[repr(C)]
4
#[derive(Clone, Copy, Debug)]
5
pub struct FileEvent {
6
    pub timestamp: u64,
7
    pub event_type: EventType,
8
    pub pid: u32,
9
    pub tgid: u32,
10
    pub uid: u32,
11
    pub gid: u32,
12
    pub path: [u8; 256],
13
    pub flags: u32,
14
    pub mode: u32,
15
}
16

17
#[repr(C)]
18
#[derive(Clone, Copy, Debug)]
19
pub enum EventType {
20
    FileOpen = 1,
21
    FileWrite = 2,
22
    FileDelete = 3,
23
    FileRename = 4,
24
    ProcessExec = 5,
25
    NetworkConnect = 6,
26
}
27

28
#[repr(C)]
29
#[derive(Clone, Copy, Debug)]
30
pub struct ProcessInfo {
31
    pub pid: u32,
32
    pub ppid: u32,
33
    pub uid: u32,
34
    pub gid: u32,
35
    pub comm: [u8; 16],
36
    pub executable: [u8; 256],
37
    pub start_time: u64,
38
}
39

40
// Implement safe conversion for paths
41
impl FileEvent {
42
    pub fn path_str(&self) -> Result<&str, core::str::Utf8Error> {
43
        let len = self.path.iter()
44
            .position(|&x| x == 0)
45
            .unwrap_or(self.path.len());
46
        core::str::from_utf8(&self.path[..len])
47
    }
48
}

User Space Application#

1
use anyhow::{Context, Result};
2
use aya::{
3
    include_bytes_aligned,
4
    maps::{HashMap, RingBuf},
5
    programs::{Lsm, KProbe, TracePoint},
6
    Btf, BpfLoader,
7
};
8
use aya_log::BpfLogger;
9
use bytes::BytesMut;
10
use clap::Parser;
11
use log::{info, warn, error};
12
use security_monitor_common::{FileEvent, EventType};
13
use std::{
14
    collections::HashSet,
15
    convert::TryFrom,
16
    path::PathBuf,
17
    sync::{
18
        atomic::{AtomicBool, Ordering},
19
        Arc,
20
    },
21
    time::Duration,
22
};
23
use tokio::{
24
    signal,
25
    sync::mpsc,
26
    time::sleep,
27
};
28

29
#[derive(Debug, Parser)]
30
struct Opt {
31
    /// Paths to monitor (can be specified multiple times)
32
    #[clap(short, long, value_name = "PATH")]
33
    monitor: Vec<String>,
34

35
    /// Output format (json, text)
36
    #[clap(short, long, default_value = "text")]
37
    format: String,
38

39
    /// Enable verbose output
40
    #[clap(short, long)]
41
    verbose: bool,
42
}
43

44
#[tokio::main]
45
async fn main() -> Result<()> {
46
    let opt = Opt::parse();
47

48
    env_logger::init();
49

50
    // Load eBPF program
51
    #[cfg(debug_assertions)]
52
    let mut bpf = BpfLoader::new()
53
        .btf(&Btf::from_sys_fs().ok())
54
        .load(include_bytes_aligned!(
55
            "../../target/bpfel-unknown-none/debug/security-monitor"
56
        ))?;
57

58
    #[cfg(not(debug_assertions))]
59
    let mut bpf = BpfLoader::new()
60
        .btf(&Btf::from_sys_fs().ok())
61
        .load(include_bytes_aligned!(
62
            "../../target/bpfel-unknown-none/release/security-monitor"
63
        ))?;
64

65
    // Initialize eBPF logger
66
    if let Err(e) = BpfLogger::init(&mut bpf) {
67
        warn!("Failed to initialize eBPF logger: {}", e);
68
    }
69

70
    // Set up monitored paths
71
    let mut monitored_paths: HashMap<_, [u8; 256], u8> =
72
        HashMap::try_from(bpf.take_map("MONITORED_PATHS").unwrap())?;
73

74
    for path in &opt.monitor {
75
        let mut path_buf = [0u8; 256];
76
        let path_bytes = path.as_bytes();
77
        let len = path_bytes.len().min(255);
78
        path_buf[..len].copy_from_slice(&path_bytes[..len]);
79
        path_buf[len] = 0;
80

81
        monitored_paths.insert(path_buf, 1, 0)?;
82
        info!("Monitoring path: {}", path);
83
    }
84

85
    // Attach programs
86
    let lsm_prog: &mut Lsm = bpf.program_mut("monitor_file_open").unwrap().try_into()?;
87
    lsm_prog.load()?;
88
    lsm_prog.attach()?;
89

90
    let kprobe_prog: &mut KProbe = bpf.program_mut("monitor_file_permission").unwrap().try_into()?;
91
    kprobe_prog.load()?;
92
    kprobe_prog.attach()?;
93

94
    let tp_prog: &mut TracePoint = bpf.program_mut("monitor_file_unlink").unwrap().try_into()?;
95
    tp_prog.load()?;
96
    tp_prog.attach()?;
97

98
    info!("Security monitor started. Press Ctrl-C to exit.");
99

100
    // Set up event processing
101
    let mut ring_buf = RingBuf::try_from(bpf.take_map("FILE_EVENTS").unwrap())?;
102

103
    let running = Arc::new(AtomicBool::new(true));
104
    let r = running.clone();
105

106
    // Handle shutdown signal
107
    tokio::spawn(async move {
108
        signal::ctrl_c().await.expect("Failed to listen for Ctrl-C");
109
        r.store(false, Ordering::SeqCst);
110
    });
111

112
    // Event processing loop
113
    let (tx, mut rx) = mpsc::channel::<FileEvent>(1000);
114

115
    // Spawn event reader task
116
    let reader_running = running.clone();
117
    tokio::task::spawn_blocking(move || {
118
        let mut buffers = (0..10)
119
            .map(|_| BytesMut::with_capacity(1024))
120
            .collect::<Vec<_>>();
121

122
        while reader_running.load(Ordering::SeqCst) {
123
            if let Err(e) = ring_buf.poll(&mut buffers) {
124
                if e.kind() != std::io::ErrorKind::WouldBlock {
125
                    error!("Error polling ring buffer: {}", e);
126
                }
127
                std::thread::sleep(Duration::from_millis(10));
128
                continue;
129
            }
130

131
            for buf in &mut buffers {
132
                if buf.len() >= std::mem::size_of::<FileEvent>() {
133
                    let event = unsafe {
134
                        std::ptr::read_unaligned(buf.as_ptr() as *const FileEvent)
135
                    };
136

137
                    if let Err(e) = tx.blocking_send(event) {
138
                        error!("Failed to send event: {}", e);
139
                    }
140

141
                    buf.clear();
142
                }
143
            }
144
        }
145
    });
146

147
    // Event processor
148
    let event_processor = EventProcessor::new(opt.format.clone());
149

150
    while running.load(Ordering::SeqCst) {
151
        tokio::select! {
152
            Some(event) = rx.recv() => {
153
                event_processor.process_event(&event).await?;
154
            }
155
            _ = sleep(Duration::from_secs(1)) => {
156
                // Periodic tasks can go here
157
            }
158
        }
159
    }
160

161
    info!("Security monitor stopped.");
162
    Ok(())
163
}
164

165
struct EventProcessor {
166
    format: String,
167
    event_count: u64,
168
}
169

170
impl EventProcessor {
171
    fn new(format: String) -> Self {
172
        Self {
173
            format,
174
            event_count: 0,
175
        }
176
    }
177

178
    async fn process_event(&mut self, event: &FileEvent) -> Result<()> {
179
        self.event_count += 1;
180

181
        match self.format.as_str() {
182
            "json" => self.output_json(event),
183
            _ => self.output_text(event),
184
        }
185
    }
186

187
    fn output_json(&self, event: &FileEvent) -> Result<()> {
188
        use serde_json::json;
189

190
        let path = event.path_str().unwrap_or("<invalid>");
191
        let event_type = match event.event_type {
192
            EventType::FileOpen => "open",
193
            EventType::FileWrite => "write",
194
            EventType::FileDelete => "delete",
195
            EventType::FileRename => "rename",
196
            _ => "unknown",
197
        };
198

199
        let output = json!({
200
            "timestamp": event.timestamp,
201
            "event_type": event_type,
202
            "pid": event.pid,
203
            "uid": event.uid,
204
            "gid": event.gid,
205
            "path": path,
206
            "flags": event.flags,
207
            "mode": event.mode,
208
            "event_number": self.event_count,
209
        });
210

211
        println!("{}", output);
212
        Ok(())
213
    }
214

215
    fn output_text(&self, event: &FileEvent) -> Result<()> {
216
        let path = event.path_str().unwrap_or("<invalid>");
217
        let event_type = match event.event_type {
218
            EventType::FileOpen => "OPEN",
219
            EventType::FileWrite => "WRITE",
220
            EventType::FileDelete => "DELETE",
221
            EventType::FileRename => "RENAME",
222
            _ => "UNKNOWN",
223
        };
224

225
        println!(
226
            "[{}] {} | PID: {} | UID: {} | Path: {} | Flags: 0x{:x}",
227
            self.event_count,
228
            event_type,
229
            event.pid,
230
            event.uid,
231
            path,
232
            event.flags
233
        );
234

235
        Ok(())
236
    }
237
}

Advanced Security Monitoring Features#

Network Security Monitor#

1
#![no_std]
2
#![no_main]
3

4
use aya_ebpf::{
5
    bindings::{TC_ACT_OK, TC_ACT_SHOT},
6
    macros::{classifier, map, xdp},
7
    maps::{LruHashMap, RingBuf},
8
    programs::{TcContext, XdpContext},
9
};
10
use core::mem;
11
use network_monitor_common::{NetworkEvent, ConnectionInfo, Protocol};
12

13
#[map]
14
static mut NETWORK_EVENTS: RingBuf = RingBuf::with_max_entries(256 * 1024, 0);
15

16
#[map]
17
static mut CONNECTION_TRACKING: LruHashMap<ConnectionInfo, u64> =
18
    LruHashMap::with_max_entries(65536, 0);
19

20
#[map]
21
static mut BLOCKED_IPS: LruHashMap<u32, u64> = LruHashMap::with_max_entries(10000, 0);
22

23
#[xdp]
24
pub fn xdp_firewall(ctx: XdpContext) -> u32 {
25
    match try_xdp_firewall(ctx) {
26
        Ok(ret) => ret,
27
        Err(_) => xdp_action::XDP_PASS,
28
    }
29
}
30

31
fn try_xdp_firewall(ctx: XdpContext) -> Result<u32, ()> {
32
    let ethhdr: *const EthHdr = unsafe { ptr_at(&ctx, 0)? };
33

34
    // Skip non-IP packets
35
    if unsafe { (*ethhdr).ether_type } != ETH_P_IP {
36
        return Ok(xdp_action::XDP_PASS);
37
    }
38

39
    let iphdr: *const IpHdr = unsafe { ptr_at(&ctx, EthHdr::LEN)? };
40
    let src_ip = unsafe { (*iphdr).src_addr };
41

42
    // Check if IP is blocked
43
    unsafe {
44
        if BLOCKED_IPS.get(&src_ip).is_some() {
45
            // Log blocked attempt
46
            let event = NetworkEvent {
47
                timestamp: bpf_ktime_get_ns(),
48
                event_type: NetworkEventType::Blocked,
49
                src_ip,
50
                dst_ip: (*iphdr).dst_addr,
51
                src_port: 0,
52
                dst_port: 0,
53
                protocol: Protocol::from((*iphdr).protocol),
54
                packet_len: ctx.data_end() - ctx.data(),
55
                action: NetworkAction::Drop,
56
            };
57

58
            let _ = NETWORK_EVENTS.output(&event, 0);
59
            return Ok(xdp_action::XDP_DROP);
60
        }
61
    }
62

63
    // Track connection for TCP
64
    if unsafe { (*iphdr).protocol } == IPPROTO_TCP {
65
        let tcphdr: *const TcpHdr = unsafe {
66
            ptr_at(&ctx, EthHdr::LEN + (*iphdr).ihl() as usize * 4)?
67
        };
68

69
        let conn_info = ConnectionInfo {
70
            src_ip,
71
            dst_ip: unsafe { (*iphdr).dst_addr },
72
            src_port: unsafe { (*tcphdr).source },
73
            dst_port: unsafe { (*tcphdr).dest },
74
            protocol: Protocol::TCP,
75
        };
76

77
        let now = unsafe { bpf_ktime_get_ns() };
78
        unsafe {
79
            CONNECTION_TRACKING.insert(&conn_info, &now, 0)?;
80
        }
81

82
        // Detect SYN flood
83
        if unsafe { (*tcphdr).syn() == 1 && (*tcphdr).ack() == 0 } {
84
            if is_syn_flood(&conn_info)? {
85
                let event = NetworkEvent {
86
                    timestamp: now,
87
                    event_type: NetworkEventType::SynFlood,
88
                    src_ip: conn_info.src_ip,
89
                    dst_ip: conn_info.dst_ip,
90
                    src_port: conn_info.src_port,
91
                    dst_port: conn_info.dst_port,
92
                    protocol: Protocol::TCP,
93
                    packet_len: ctx.data_end() - ctx.data(),
94
                    action: NetworkAction::Alert,
95
                };
96

97
                unsafe {
98
                    let _ = NETWORK_EVENTS.output(&event, 0);
99
                }
100
            }
101
        }
102
    }
103

104
    Ok(xdp_action::XDP_PASS)
105
}
106

107
#[classifier]
108
pub fn tc_egress_monitor(ctx: TcContext) -> i32 {
109
    match try_tc_egress_monitor(ctx) {
110
        Ok(ret) => ret,
111
        Err(_) => TC_ACT_OK,
112
    }
113
}
114

115
fn try_tc_egress_monitor(mut ctx: TcContext) -> Result<i32, ()> {
116
    let ethhdr: EthHdr = ctx.load(0)?;
117

118
    if ethhdr.ether_type != ETH_P_IP {
119
        return Ok(TC_ACT_OK);
120
    }
121

122
    let iphdr: IpHdr = ctx.load(EthHdr::LEN)?;
123

124
    // Monitor suspicious outbound connections
125
    if iphdr.protocol == IPPROTO_TCP {
126
        let tcphdr: TcpHdr = ctx.load(EthHdr::LEN + iphdr.ihl() as usize * 4)?;
127

128
        // Check for suspicious ports
129
        if is_suspicious_port(tcphdr.dest) {
130
            let event = NetworkEvent {
131
                timestamp: unsafe { bpf_ktime_get_ns() },
132
                event_type: NetworkEventType::SuspiciousConnection,
133
                src_ip: iphdr.src_addr,
134
                dst_ip: iphdr.dst_addr,
135
                src_port: tcphdr.source,
136
                dst_port: tcphdr.dest,
137
                protocol: Protocol::TCP,
138
                packet_len: ctx.len() as u32,
139
                action: NetworkAction::Monitor,
140
            };
141

142
            unsafe {
143
                let _ = NETWORK_EVENTS.output(&event, 0);
144
            }
145
        }
146
    }
147

148
    Ok(TC_ACT_OK)
149
}
150

151
#[inline(always)]
152
fn is_suspicious_port(port: u16) -> bool {
153
    matches!(port.to_be(),
154
        4444 |  // Common backdoor
155
        5555 |  // Android ADB
156
        6666 |  // IRC backdoor
157
        6667 |  // IRC
158
        8333 |  // Bitcoin
159
        9001    // Tor
160
    )
161
}
162

163
#[inline(always)]
164
fn is_syn_flood(conn: &ConnectionInfo) -> Result<bool, ()> {
165
    // Simple SYN flood detection: too many SYN packets from same source
166
    // In production, use more sophisticated detection
167
    Ok(false) // Placeholder
168
}

Process Behavior Analysis#

1
use aya_ebpf::{
2
    macros::{lsm, map, tracepoint},
3
    maps::{LruHashMap, RingBuf, PerCpuArray},
4
};
5

6
#[map]
7
static mut PROCESS_EVENTS: RingBuf = RingBuf::with_max_entries(512 * 1024, 0);
8

9
#[map]
10
static mut PROCESS_TREE: LruHashMap<u32, ProcessInfo> =
11
    LruHashMap::with_max_entries(10000, 0);
12

13
#[map]
14
static mut ANOMALY_SCORES: PerCpuArray<AnomalyScore> =
15
    PerCpuArray::with_max_entries(1, 0);
16

17
#[tracepoint("sched", "sched_process_exec")]
18
pub fn trace_exec(ctx: TracePointContext) -> i32 {
19
    match try_trace_exec(ctx) {
20
        Ok(ret) => ret,
21
        Err(_) => 0,
22
    }
23
}
24

25
fn try_trace_exec(ctx: TracePointContext) -> Result<i32, i64> {
26
    let pid = bpf_get_current_pid_tgid() >> 32;
27
    let ppid = get_parent_pid()?;
28

29
    // Get executable path
30
    let filename: *const u8 = unsafe { ctx.read_at(16)? };
31
    let mut exe_path = [0u8; 256];
32
    unsafe {
33
        bpf_probe_read_user_str_bytes(filename, &mut exe_path)?;
34
    }
35

36
    // Behavioral analysis
37
    let mut anomaly_score = 0u32;
38

39
    // Check 1: Execution from /tmp
40
    if is_tmp_execution(&exe_path) {
41
        anomaly_score += 20;
42
    }
43

44
    // Check 2: Hidden process (name starts with .)
45
    if exe_path[0] == b'.' {
46
        anomaly_score += 15;
47
    }
48

49
    // Check 3: Process tree anomaly
50
    if is_process_tree_anomaly(pid, ppid)? {
51
        anomaly_score += 30;
52
    }
53

54
    // Check 4: Known malicious patterns
55
    if contains_malicious_pattern(&exe_path) {
56
        anomaly_score += 40;
57
    }
58

59
    // Create process info
60
    let proc_info = ProcessInfo {
61
        pid,
62
        ppid,
63
        uid: (bpf_get_current_uid_gid() & 0xFFFFFFFF) as u32,
64
        gid: (bpf_get_current_uid_gid() >> 32) as u32,
65
        exe_path,
66
        anomaly_score,
67
        start_time: unsafe { bpf_ktime_get_ns() },
68
    };
69

70
    // Update process tree
71
    unsafe {
72
        PROCESS_TREE.insert(&pid, &proc_info, 0)?;
73
    }
74

75
    // Alert on high anomaly score
76
    if anomaly_score >= 50 {
77
        let event = ProcessEvent {
78
            timestamp: proc_info.start_time,
79
            event_type: ProcessEventType::AnomalousExecution,
80
            process: proc_info,
81
            details: ProcessEventDetails::AnomalyDetected { score: anomaly_score },
82
        };
83

84
        unsafe {
85
            PROCESS_EVENTS.output(&event, 0)?;
86
        }
87
    }
88

89
    Ok(0)
90
}
91

92
#[lsm(hook = "task_kill")]
93
pub fn monitor_kill(ctx: LsmContext) -> i32 {
94
    match try_monitor_kill(ctx) {
95
        Ok(ret) => ret,
96
        Err(_) => 0,
97
    }
98
}
99

100
fn try_monitor_kill(ctx: LsmContext) -> Result<i32, i64> {
101
    let target_task: *const task_struct = unsafe { ctx.arg(0) };
102
    let signal: i32 = unsafe { ctx.arg(2) };
103

104
    // Get killer and target PIDs
105
    let killer_pid = (bpf_get_current_pid_tgid() >> 32) as u32;
106
    let target_pid = unsafe { (*target_task).pid };
107

108
    // Check for suspicious kill patterns
109
    if is_suspicious_kill(killer_pid, target_pid, signal)? {
110
        let event = ProcessEvent {
111
            timestamp: unsafe { bpf_ktime_get_ns() },
112
            event_type: ProcessEventType::SuspiciousKill,
113
            process: get_process_info(killer_pid)?,
114
            details: ProcessEventDetails::Kill {
115
                target_pid,
116
                signal,
117
            },
118
        };
119

120
        unsafe {
121
            PROCESS_EVENTS.output(&event, 0)?;
122
        }
123
    }
124

125
    Ok(0)
126
}
127

128
#[inline(always)]
129
fn is_tmp_execution(path: &[u8; 256]) -> bool {
130
    path.len() >= 5 &&
131
    path[0] == b'/' &&
132
    path[1] == b't' &&
133
    path[2] == b'm' &&
134
    path[3] == b'p' &&
135
    path[4] == b'/'
136
}
137

138
#[inline(always)]
139
fn contains_malicious_pattern(path: &[u8; 256]) -> bool {
140
    // Check for known malicious patterns
141
    const PATTERNS: &[&[u8]] = &[
142
        b"xmrig",
143
        b"minerd",
144
        b"cryptonight",
145
        b".hidden",
146
        b"backdoor",
147
    ];
148

149
    for pattern in PATTERNS {
150
        if contains_pattern(path, pattern) {
151
            return true;
152
        }
153
    }
154

155
    false
156
}

Production Deployment with Aya#

Container Deployment#

1
# Dockerfile for eBPF security monitor
2
FROM rust:1.70 AS builder
3

4
# Install dependencies
5
RUN apt-get update && apt-get install -y \
6
    clang \
7
    llvm \
8
    libbpf-dev \
9
    linux-headers-generic
10

11
# Install bpf-linker
12
RUN cargo install bpf-linker
13

14
# Copy source code
15
WORKDIR /app
16
COPY . .
17

18
# Build eBPF programs
19
RUN cargo xtask build-ebpf --release
20

21
# Build user-space application
22
RUN cargo build --release
23

24
# Runtime image
25
FROM ubuntu:22.04
26

27
RUN apt-get update && apt-get install -y \
28
    ca-certificates \
29
    && rm -rf /var/lib/apt/lists/*
30

31
COPY --from=builder /app/target/release/security-monitor /usr/local/bin/
32
COPY --from=builder /app/target/bpfel-unknown-none/release/* /usr/local/lib/bpf/
33

34
# Run with required capabilities
35
ENTRYPOINT ["/usr/local/bin/security-monitor"]

Kubernetes Deployment#

1
apiVersion: apps/v1
2
kind: DaemonSet
3
metadata:
4
  name: aya-security-monitor
5
  namespace: security
6
spec:
7
  selector:
8
    matchLabels:
9
      app: aya-security-monitor
10
  template:
11
    metadata:
12
      labels:
13
        app: aya-security-monitor
14
    spec:
15
      hostNetwork: true
16
      hostPID: true
17
      containers:
18
        - name: monitor
19
          image: your-registry/aya-security-monitor:latest
20
          imagePullPolicy: Always
21
          command: ["/usr/local/bin/security-monitor"]
22
          args:
23
            - "--monitor=/etc"
24
            - "--monitor=/var/lib"
25
            - "--monitor=/usr/bin"
26
            - "--format=json"
27
          env:
28
            - name: NODE_NAME
29
              valueFrom:
30
                fieldRef:
31
                  fieldPath: spec.nodeName
32
          securityContext:
33
            privileged: true
34
            capabilities:
35
              add:
36
                - SYS_ADMIN
37
                - SYS_RESOURCE
38
                - NET_ADMIN
39
                - PERFMON
40
                - BPF
41
          volumeMounts:
42
            - name: sys
43
              mountPath: /sys
44
              readOnly: true
45
            - name: proc
46
              mountPath: /proc
47
              readOnly: true
48
            - name: dev
49
              mountPath: /dev
50
              readOnly: true
51
            - name: host
52
              mountPath: /host
53
              readOnly: true
54
          resources:
55
            limits:
56
              memory: 500Mi
57
              cpu: 500m
58
            requests:
59
              memory: 200Mi
60
              cpu: 100m
61
      volumes:
62
        - name: sys
63
          hostPath:
64
            path: /sys
65
        - name: proc
66
          hostPath:
67
            path: /proc
68
        - name: dev
69
          hostPath:
70
            path: /dev
71
        - name: host
72
          hostPath:
73
            path: /

Performance Optimization#

Efficient Map Usage#

1
// Use per-CPU maps for high-frequency updates
2
#[map]
3
static mut STATS: PerCpuArray<Statistics> = PerCpuArray::with_max_entries(1, 0);
4

5
// Use LRU maps for automatic eviction
6
#[map]
7
static mut CACHE: LruHashMap<u64, CachedData> = LruHashMap::with_max_entries(10000, 0);
8

9
// Use bloom filters for membership tests
10
#[map]
11
static mut SEEN_FILES: BloomFilter<u64> = BloomFilter::with_max_entries(100000, 0);

Batching and Sampling#

1
#[kprobe("vfs_read")]
2
pub fn sample_reads(ctx: KProbeContext) -> i32 {
3
    // Sample 1 in 1000 events
4
    let sample_rate = 1000;
5
    let rand = bpf_get_prandom_u32();
6

7
    if rand % sample_rate != 0 {
8
        return 0;
9
    }
10

11
    // Process sampled event
12
    process_read_event(ctx)
13
}

Testing and Debugging#

Unit Tests#

1
#[cfg(test)]
2
mod tests {
3
    use super::*;
4

5
    #[test]
6
    fn test_path_matching() {
7
        let path = b"/etc/passwd\0";
8
        let mut path_buf = [0u8; 256];
9
        path_buf[..path.len()].copy_from_slice(path);
10

11
        assert!(is_sensitive_path(&path_buf));
12
    }
13

14
    #[test]
15
    fn test_anomaly_scoring() {
16
        let mut score = AnomalyScore::default();
17
        score.add_tmp_execution();
18
        score.add_hidden_process();
19

20
        assert!(score.total() >= 35);
21
    }
22
}

Integration Tests#

1
use aya::{Bpf, BpfLoader};
2
use std::process::Command;
3

4
#[test]
5
fn test_file_monitoring() {
6
    // Load eBPF program
7
    let mut bpf = BpfLoader::new()
8
        .load_file("target/bpfel-unknown-none/debug/security-monitor")
9
        .unwrap();
10

11
    // Attach programs
12
    // ... attachment code ...
13

14
    // Trigger file access
15
    Command::new("cat")
16
        .arg("/etc/passwd")
17
        .output()
18
        .unwrap();
19

20
    // Verify event was captured
21
    // ... verification code ...
22
}

Best Practices and Tips#

1. Error Handling#

Always use fallible operations and handle errors gracefully:

1
fn try_process_event(ctx: ProbeContext) -> Result<i32, i64> {
2
    // Use ? operator for error propagation
3
    let pid = bpf_get_current_pid_tgid();
4
    let data = ctx.read_user::<UserData>(addr)?;
5

6
    // Validate data before use
7
    if data.len > MAX_LEN {
8
        return Err(-1);
9
    }
10

11
    Ok(0)
12
}

2. Memory Management#

Be mindful of stack usage and use heap maps when needed:

1
// Bad: Large stack allocation
2
let mut buffer = [0u8; 4096]; // Too large for eBPF stack
3

4
// Good: Use per-CPU array
5
#[map]
6
static mut BUFFERS: PerCpuArray<[u8; 4096]> = PerCpuArray::with_max_entries(1, 0);

3. Compatibility#

Use CO-RE (Compile Once, Run Everywhere) features:

1
use aya_ebpf::cty::c_void;
2
use aya_ebpf_bindings::helpers::bpf_core_read;
3

4
// CO-RE compatible field access
5
let offset = bpf_core_field_offset!(task_struct, pid);
6
let pid = bpf_core_read::<u32>(task as *const c_void, offset)?;

Conclusion#

Rust and Aya bring modern Security Software Engineering practices to eBPF development, making it easier to build safe, efficient, and maintainable security tools. The combination of Rust’s safety guarantees and eBPF’s kernel-level capabilities creates a powerful platform for next-generation security monitoring.

Key advantages of using Rust and Aya:

Type Safety: Catch errors at compile time
Memory Safety: No buffer overflows or null pointer dereferences
Modern Tooling: Cargo, rustfmt, clippy, and excellent IDE support
Pure Rust: Both kernel and user space in the same language
Performance: Zero-cost abstractions with no runtime overhead

As the eBPF ecosystem continues to evolve, Rust and Aya are positioned to become the standard for building production-grade eBPF applications, especially in security-critical environments where safety and reliability are paramount.

Resources for Further Learning#

Aya Book - Official Aya documentation
Aya Examples - Sample programs
awesome-aya - Curated list of Aya projects
Rust eBPF Working Group - Rust eBPF ecosystem

Next in the series: Building distributed eBPF security systems with Rust and cloud-native integration.