eBPF Security: Revolutionizing Runtime Protection and Threat Detection in Linux#

1
// Example: Detecting suspicious file access patterns
2
SEC("lsm/file_open")
3
int detect_suspicious_file_access(struct file *file) {
4
    char filename[256];
5
    bpf_d_path(&file->f_path, filename, sizeof(filename));
6

7
    // Check for access to sensitive files
8
    if (strstr(filename, "/etc/shadow") ||
9
        strstr(filename, "/etc/passwd") ||
10
        strstr(filename, ".ssh/")) {
11

12
        u32 pid = bpf_get_current_pid_tgid() >> 32;
13
        u32 uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
14

15
        // Log suspicious activity
16
        bpf_printk("ALERT: PID %d (UID %d) accessing %s", pid, uid, filename);
17

18
        // Could also send to user-space for further analysis
19
        struct security_event event = {
20
            .type = FILE_ACCESS_VIOLATION,
21
            .pid = pid,
22
            .uid = uid,
23
        };
24
        bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU,
25
                              &event, sizeof(event));
26
    }
27

28
    return 0; // Allow access (monitoring only)
29
}

1
// Example: DDoS mitigation at line rate
2
SEC("xdp")
3
int xdp_ddos_mitigate(struct xdp_md *ctx) {
4
    void *data_end = (void *)(long)ctx->data_end;
5
    void *data = (void *)(long)ctx->data;
6

7
    struct ethhdr *eth = data;
8
    if ((void *)(eth + 1) > data_end)
9
        return XDP_PASS;
10

11
    if (eth->h_proto != htons(ETH_P_IP))
12
        return XDP_PASS;
13

14
    struct iphdr *ip = (void *)(eth + 1);
15
    if ((void *)(ip + 1) > data_end)
16
        return XDP_PASS;
17

18
    // Rate limiting per source IP
19
    u32 src_ip = ip->saddr;
20
    struct rate_limit *rl = bpf_map_lookup_elem(&rate_limits, &src_ip);
21

22
    if (rl && rl->packets > THRESHOLD) {
23
        // Drop packets from this source
24
        return XDP_DROP;
25
    }
26

27
    // Update rate limit
28
    update_rate_limit(&rate_limits, &src_ip);
29

30
    return XDP_PASS;
31
}

1
// Example: Container escape detection
2
SEC("tracepoint/sched/sched_process_fork")
3
int detect_container_escape(struct trace_event_raw_sched_process_fork *ctx) {
4
    u32 pid = ctx->child_pid;
5
    u32 parent_pid = ctx->parent_pid;
6

7
    // Check if process is breaking out of namespace
8
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
9

10
    u32 host_pid_ns = get_host_pid_ns();
11
    u32 current_pid_ns = get_task_pid_ns(task);
12

13
    if (current_pid_ns != host_pid_ns &&
14
        is_privilege_escalation(task)) {
15

16
        // Potential container escape attempt
17
        struct security_alert alert = {
18
            .type = CONTAINER_ESCAPE_ATTEMPT,
19
            .pid = pid,
20
            .parent_pid = parent_pid,
21
            .timestamp = bpf_ktime_get_ns(),
22
        };
23

24
        bpf_ringbuf_output(&security_alerts, &alert, sizeof(alert), 0);
25
    }
26

27
    return 0;
28
}

1
// Detect unusual privilege escalation patterns
2
SEC("kprobe/commit_creds")
3
int detect_priv_escalation(struct pt_regs *ctx) {
4
    struct cred *new_cred = (struct cred *)PT_REGS_PARM1(ctx);
5
    u32 old_uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
6
    u32 new_uid;
7

8
    bpf_probe_read(&new_uid, sizeof(new_uid), &new_cred->uid);
9

10
    if (old_uid != 0 && new_uid == 0) {
11
        // Non-root process becoming root - suspicious!
12
        log_security_event(PRIVILEGE_ESCALATION, bpf_get_current_pid_tgid() >> 32);
13
    }
14

15
    return 0;
16
}

1
// Monitor for suspicious child process creation
2
SEC("tracepoint/sched/sched_process_exec")
3
int monitor_process_exec(struct trace_event_raw_sched_process_exec *ctx) {
4
    char comm[TASK_COMM_LEN];
5
    char parent_comm[TASK_COMM_LEN];
6

7
    bpf_get_current_comm(&comm, sizeof(comm));
8
    get_parent_comm(&parent_comm, sizeof(parent_comm));
9

10
    // Check for unexpected process relationships
11
    if (is_interpreter(parent_comm) && is_suspicious_binary(comm)) {
12
        // Python/Node.js spawning unexpected binaries
13
        alert_supply_chain_attack(comm, parent_comm);
14
    }
15

16
    return 0;
17
}

1
// Analyze TLS handshake patterns
2
SEC("kprobe/tls_sw_sendmsg")
3
int analyze_tls_traffic(struct pt_regs *ctx) {
4
    struct socket *sock = (struct socket *)PT_REGS_PARM1(ctx);
5
    size_t size = PT_REGS_PARM3(ctx);
6

7
    // Track TLS connection patterns
8
    struct tls_stats *stats = get_or_create_tls_stats(sock);
9
    stats->bytes_sent += size;
10
    stats->packets_sent++;
11

12
    // Detect potential data exfiltration
13
    if (is_data_exfiltration_pattern(stats)) {
14
        alert_suspicious_tls_traffic(sock);
15
    }
16

17
    return 0;
18
}

1
// Good practice: Bounded loops
2
#define MAX_ITERATIONS 100
3

4
SEC("kprobe/example")
5
int bounded_loop_example(struct pt_regs *ctx) {
6
    #pragma unroll
7
    for (int i = 0; i < MAX_ITERATIONS && i < configured_limit; i++) {
8
        // Process data
9
        if (!process_item(i))
10
            break;
11
    }
12
    return 0;
13
}

1
// Use per-CPU maps for high-frequency events
2
struct {
3
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
4
    __uint(max_entries, 1);
5
    __type(key, u32);
6
    __type(value, struct event_stats);
7
} stats_map SEC(".maps");
8

9
// Batch events before sending to user space
10
struct {
11
    __uint(type, BPF_MAP_TYPE_RINGBUF);
12
    __uint(max_entries, 1 << 24); // 16MB buffer
13
} events SEC(".maps");

1
// Use sampling for high-frequency events
2
SEC("kprobe/vfs_read")
3
int sample_file_reads(struct pt_regs *ctx) {
4
    // Sample 1 in 1000 events
5
    if (bpf_get_prandom_u32() % 1000 != 0)
6
        return 0;
7

8
    // Process sampled event
9
    process_file_read(ctx);
10
    return 0;
11
}