{"id":28642143,"url":"https://github.com/amirhnajafiz/syscall-blocker","last_synced_at":"2025-08-28T05:13:43.388Z","repository":{"id":49853418,"uuid":"502089237","full_name":"amirhnajafiz/syscall-blocker","owner":"amirhnajafiz","description":"Using eBPF to block system calls in Linux.","archived":false,"fork":false,"pushed_at":"2025-03-08T22:35:41.000Z","size":217,"stargazers_count":11,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-06-23T04:41:24.521Z","etag":null,"topics":["bcc","c","ebpf","linux","python3","sandbox"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/amirhnajafiz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-06-10T15:17:59.000Z","updated_at":"2025-03-08T22:35:44.000Z","dependencies_parsed_at":"2023-08-10T03:48:21.226Z","dependency_job_id":"75024083-91a4-4ded-b376-03a269e899e4","html_url":"https://github.com/amirhnajafiz/syscall-blocker","commit_stats":null,"previous_names":["amirhnajafiz/personal-website","amirhnajafiz/kafka","amirhnajafiz/kafka-machine","amirhnajafiz/syscall-blocker"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/amirhnajafiz/syscall-blocker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amirhnajafiz%2Fsyscall-blocker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amirhnajafiz%2Fsyscall-blocker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amirhnajafiz%2Fsyscall-blocker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amirhnajafiz%2Fsyscall-blocker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/amirhnajafiz","download_url":"https://codeload.github.com/amirhnajafiz/syscall-blocker/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amirhnajafiz%2Fsyscall-blocker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":272443900,"owners_count":24936034,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-28T02:00:10.768Z","response_time":74,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bcc","c","ebpf","linux","python3","sandbox"],"created_at":"2025-06-12T22:33:00.725Z","updated_at":"2025-08-28T05:13:43.381Z","avatar_url":"https://github.com/amirhnajafiz.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# eBPF Program\n\nThis eBPF (Extended Berkeley Packet Filter) program is developed using the BCC (BPF Compiler Collection) and Linux Security Module (LSM) probes. To execute the program, run the following command:\n\n```bash\nsudo python3 script.py\n```\n\nFor better logging, you can redirect the output to a file using:\n\n```bash\nsudo python3 script.py \u003e logs.output.txt\n```\n\nPress `Ctrl+C` to exit and detach the program.\n\n## Functionality\n\nThe program loads kernel code from the file `ebpf_program.c` into a BPF instance and attaches four LSM probes to perform the following tasks:\n\n1. **Block File Creation:** A probe on `inode_create` is utilized to prevent the creation of files within a specified directory.\n2. **Block Command Execution:** A probe on `bprm_check_security` is employed to restrict the execution of a particular command.\n3. **Block Network Connections:** Probes on both `socket_connect` and `socket_accept` are implemented to prevent connections to and from a specified IP address.\n\n### Blocking File Creation\n\nTo block file creation in a specific directory, the program passes the inode (obtained by running the `__get_directory_inode` function in `script.py`) using a BPF map to the LSM probe with the following signature:\n\n```c\nLSM_PROBE(inode_create, struct inode *dir, struct dentry *dentry, umode_t mode)\n```\n\nEach time a file creation is attempted, this hook checks the inodes and blocks any that are directed to the target directory.\n\n### Blocking Command Execution\n\nTo prevent the execution of specific commands, the program passes the command string via a BPF map to a LSM probe defined as follows:\n\n```c\nLSM_PROBE(bprm_check_security, struct linux_binprm *bprm)\n```\n\nWhenever a command execution is initiated, this hook verifies the filename against the specified command and blocks it if there is a match.\n\n### Blocking Network Connections\n\nTo block network connections, IP addresses are converted to a 32-bit unsigned integer format using the following code:\n\n```python\nip_int = struct.unpack(\"!I\", socket.inet_aton(TARGET_IPA))[0]\nbpf[\"blocked_ips\"][ctypes.c_uint32(ip_int)] = ctypes.c_ubyte(1)\n```\n\nThis program uses two LSM probes for this purpose:\n\n```c\nLSM_PROBE(socket_connect, struct socket *sock, struct sockaddr *address, int addrlen)\nLSM_PROBE(socket_accept, struct socket *sock, struct socket *newsock)\n```\n\nWhen a connection or acceptance event occurs, the program checks the IP addresses against the specified targets. If a match is found, the connection is blocked.\n\n## Kernel-Level Details\n\nThe user-level Python application utilizes three BPF hash maps to send information about the directory inode, IP address, and file path of the executed command to the kernel program. Additionally, the kernel program employs `BPF_PERF_OUTPUT` to send events back to the user-level application. The structure of these events is defined as follows:\n\n```c\nstruct event\n{\n    u32 pid;               // Process ID\n    u32 uid;               // User ID\n    u32 ip;                // IP address\n    u64 timestamp;         // Event timestamp\n    u64 inode_number;      // Inode number of the file\n    char command[TASK_COMM_LEN]; // Command name\n    char filename[NAME_MAX]; // Filename being accessed\n    char syscall[16];      // System call name\n    char action[16];       // Action taken (allowed or denied)\n};\n```\n\n## User-Level Implementation\n\nIn the user-level program, a `while` loop continuously calls `perf_buffer_poll` to retrieve events from the performance buffer and invokes the `print_event` callback function.\n\n```python\n# Load the kernel code from ebpf_program.c to attach kprobes\nwith open(PROGRAM_PATH, \"r\") as file:\n    bpf_program = file.read()\n\n# Initialize BPF\nbpf = BPF(text=bpf_program)\n\n# Additional setup code goes here...\n\n# Open the performance buffer for events\nbpf[\"events\"].open_perf_buffer(print_event)\n\nwhile True:\n    try:\n        bpf.perf_buffer_poll()  # Poll for events\n    except KeyboardInterrupt:\n        print(\"Detaching...\")\n        break\n```\n\nIn the `print_event` callback function, the program captures events and calculates the timestamp based on the system's boot time. Events are printed for incoming actions. For IP address events, a helper function, `__ip_to_string`, converts the IP address from a 32-bit unsigned integer to a human-readable string format.\n\nFor other events, the program checks the `inode_number` field. If it contains a valid value, it uses the `__find_directory_by_inode` helper function to retrieve the absolute path of the file.\n\nThe program specifies target variables in lines 50 to 53 to indicate which actions to block:\n\n```python\n# Initialize target variables\nTARGET_DIR = \"/home/sekar/Desktop\"  # Block file creation in this directory\nTARGET_EXE = \"/bin/nc\"               # Block execution of this command\nTARGET_IPA = \"142.251.41.14\"         # Block connections to and from this IP address\n```\n\nTo determine the inode of files, the program sets the `INODE_START_PATH` variable in line 58 to specify the starting directory for inode checks, reducing the overhead of searching through directory names.\n\n```python\nINODE_START_PATH = \"/home/sekar/Desktop\"  # Starting point for inode checks\n```\n\n## Logging Output\n\nTo execute the program, you may adjust the specified variables as necessary. It is advisable to redirect the program's output to a log file. The output will be formatted as follows:\n\n```txt\nBlocker program running, press Ctrl+C to exit and detach.\n\nTimestamp                     PID     UID     System Call    Action   Path/IP\n2024-10-30 14:45:44.943664    12494   0       exec           allow    /usr/bin/ischroot\n2024-10-30 14:45:45.455794    12495   0       exec           allow    /usr/bin/dpkg\n2024-10-30 14:45:45.497490    12496   0       exec           allow    /usr/bin/dpkg\n2024-10-30 14:45:45.517889    12497   0       exec           allow    /usr/bin/dpkg\n2024-10-30 14:45:45.562129    12498   0       exec           allow    /usr/bin/dpkg\n2024-10-30 14:46:07.039886    12813   1000    open           denied   /home/sekar/Desktop/file\n2024-10-30 14:46:13.971619    12899   0       exec           allow    /bin/sh\n2024-10-30 14:46:14.133565    12903   1000    exec           denied   /bin/nc\n2024-10-30 14:46:37.438751    13247   1000    exec           allow    /usr/bin/wget\n2024-10-30 14:46:37.457748    13247   1000    connect        denied   142.251.41.14\n2024-10-30 14:46:39.452597    13255   1000    exec           allow    /bin/sh\n2024-10-30 14:46:39.458687    13256   1000    exec           allow    /usr/bin/ps\n```\n\nThis output provides a detailed log of the events processed by the program, including timestamps, process IDs, user IDs, system calls executed, actions taken (either allowed or denied), and the relevant paths or IP addresses involved.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famirhnajafiz%2Fsyscall-blocker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Famirhnajafiz%2Fsyscall-blocker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famirhnajafiz%2Fsyscall-blocker/lists"}