{"id":16931506,"url":"https://github.com/leodido/demo-cloud-native-ebpf-day","last_synced_at":"2025-06-17T16:35:59.120Z","repository":{"id":47594372,"uuid":"405429454","full_name":"leodido/demo-cloud-native-ebpf-day","owner":"leodido","description":"Various eBPF programs for tracing network connections","archived":false,"fork":false,"pushed_at":"2021-10-26T23:54:02.000Z","size":76,"stargazers_count":30,"open_issues_count":1,"forks_count":7,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-04T17:11:50.397Z","etag":null,"topics":["attack","auditing","bpf","defense","demo","ebpf","enforcement","experimentation","kernel","lsm","lsm-hooks","prevention","security","talk","tracepoints","tracing"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/leodido.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-09-11T16:35:31.000Z","updated_at":"2025-03-10T13:30:46.000Z","dependencies_parsed_at":"2022-09-10T06:51:19.098Z","dependency_job_id":null,"html_url":"https://github.com/leodido/demo-cloud-native-ebpf-day","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/leodido/demo-cloud-native-ebpf-day","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leodido%2Fdemo-cloud-native-ebpf-day","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leodido%2Fdemo-cloud-native-ebpf-day/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leodido%2Fdemo-cloud-native-ebpf-day/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leodido%2Fdemo-cloud-native-ebpf-day/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/leodido","download_url":"https://codeload.github.com/leodido/demo-cloud-native-ebpf-day/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leodido%2Fdemo-cloud-native-ebpf-day/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260399758,"owners_count":23003234,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attack","auditing","bpf","defense","demo","ebpf","enforcement","experimentation","kernel","lsm","lsm-hooks","prevention","security","talk","tracepoints","tracing"],"created_at":"2024-10-13T20:44:07.791Z","updated_at":"2025-06-17T16:35:54.111Z","avatar_url":"https://github.com/leodido.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# LSM BPF Changes Everything\n\nThis repository contains the code I used for the demo during my [talk](https://sched.co/mFTQ) @ [Cloud Native eBPF Day NA 2021](https://events.linuxfoundation.org/cloud-native-ebpf-day-north-america/).\n\nHere you'll find the following eBPF programs:\n\n\u003cdl\u003e\n  \u003cdt\u003e\u003ca href=\"./src/restrict_connect.bpf.c\"\u003erestrict_connect\u003c/a\u003e\u003c/dt\u003e\n  \u003cdd\u003eBPF LSM program (on \u003ccode\u003esocket_connect\u003c/code\u003e hook) that prevents any connection towards 1.1.1.1 to happen\u003c/dd\u003e\n  \u003cdt\u003e\u003ca href=\"./src/audit_connect.bpf.c\"\u003eaudit_connect\u003c/a\u003e\u003c/dt\u003e\n  \u003cdd\u003eprogram that shows BPF LSM for auditing (on \u003ccode\u003esocket_connect\u003c/code\u003e hook)\u003c/dd\u003e\n  \u003cdt\u003e\u003ca href=\"./src/kprobe_connect.bpf.c\"\u003ekprobe_connect\u003c/a\u003e\u003c/dt\u003e\n  \u003cdd\u003eprogram that instruments a kprobe on the Kernel function (\u003ccode\u003esecurity_socket_connect\u003c/code\u003e) installing the \u003ccode\u003esocket_connect\u003c/code\u003e hook\u003c/dd\u003e\n  \u003cdt\u003e\u003ca href=\"./src/trace_net.bpf.c\"\u003etrace_net\u003c/a\u003e\u003c/dt\u003e\n  \u003cdd\u003eeBPF program for the \u003ccode\u003enet/net_dev_queue\u003c/code\u003e tracepoint\u003c/dd\u003e\n  \u003cdt\u003e\u003ca href=\"./src/trace_connect.bpf.c\"\u003etrace_connect\u003c/a\u003e\u003c/dt\u003e\n  \u003cdd\u003eeBPF program tracing the entering of the \u003ccode\u003econnect\u003c/code\u003e syscall\u003c/dd\u003e\n\u003c/dl\u003e\n\n## Usage\n\nFirst thing you'd need to clone this repository, isn't it?\n\n```console\ngit clone --recurse-submodules -j8 https://github.com/leodido/demo-cloud-native-ebpf-day.git\n```\n\nI guess you wanna now build this machinery. Cool!\n\n### Prerequisites\n\nWait a sec, here are some preconditions to get all of this demo working...\n\n\u003cdetails\u003e\n\u003csummary\u003eYou need a \u003ca href=\"https://www.kernel.org/doc/html/latest/bpf/btf.html\"\u003eBTF\u003c/a\u003e capable Kernel (Linux Kernel 4.18+).\u003c/summary\u003e\n\u003cp\u003e\n\nTo check whether you have a BTF enabled kernel run:\n\n```console\n$ zcat /proc/config.gz | grep CONFIG_DEBUG_INFO_BTF=\n```\n\nOtherwise, you need to recompile you kernel with `CONFIG_DEBUG_INFO_BTF=y`: it's size will increase of ~1.5MB, not a big deal.\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eYou need to install \u003ccode\u003ebpftool\u003c/code\u003e and \u003ccode\u003eclang\u003c/code\u003e.\u003c/summary\u003e\n\u003cp\u003e\n\nOn ArchLinux this is as easy as running:\n\n```console\n$ sudo pacman -S bpf clang\n```\n\u003c/p\u003e\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eIf you also wanna try the BPF LSM programs, you need a Linux Kernel 5.7+ with BPF LSM on.\u003c/summary\u003e\n\u003cp\u003e\n\nTo check whether you have it enabled or not:\n\n```console\n$ zcat /proc/config.gz | grep CONFIG_LSM=\n```\n\nCheck if BPF hooks are enabled for LSM by looking at the output to contain them:\n\n```console\nCONFIG_LSM=\"...,bpf\"\n```\n\nRemember that BPF hooks for LSM can also be enabled via the `lsm` Kernel boot parameters, so take a look there too.\n\nAlso check your Kernel supports [BPF LSM instrumentation](https://github.com/torvalds/linux/blob/5d6ab0bb408ffdaac585982faa9ec8c7d5cc349f/kernel/bpf/Kconfig#L77) with:\n\n```console\n$ zcat /proc/config.gz | grep CONFIG_BPF_LSM=\n```\n\u003c/p\u003e\n\u003c/details\u003e\n\n### Building\n\nOk, now you can move to the `src` directory. Here you'll find a nice [Makefile](./src/Makefile) to build all the things at once:\n\n```console\n$ make\n```\n\nOr, one by one. For example:\n\n```console\n$ make trace_net\n$ make V=1 restrict_connect # in case you like to be verbose\n```\n\n### Running\n\nNow it's time to run 🏃\n\nWanna try to restrict connections towards 1.1.1.1? Try this:\n\n```console\n$ sudo ./restrict_connect\n```\n\nThen, in another terminal:\n\n```console\n$ curl https://1.1.1.1\n$ ping 1.1.1.1\n```\n\nAnd observe the output!\n\nNotice that all the other eBPF programs in this repo (so, except `restrict_connect` at the moment)\nwork only against connections coming from executables which name is `attack_connect`.\n\nThis means they'll ignore connections generating from `curl`, etc.\n\n## Evaluation\n\nOne of the reasons because this repository (and its talk) exist was because I wanted to test an attack ([CVE-2021-33505](https://nvd.nist.gov/vuln/detail/CVE-2021-33505))\nthat in some circumstances (ie., `userfaultfd` syscall enabled) is able to bypass security auditing tools\nbased on tracepoints (that were not exactly made to accomplish this goal, but still...).\n\nSo, I wanted to verify which tracing implementations for the security context\nare vulnerable to this attack... And here we are. 🙃\n\nWanna know more about this attack? Watch this [DEFCON talk](https://youtu.be/yaAdM8pWKG8) by my friend Xiaofei Rex Guo.\n\nNow, let's say that you wanna try the attack yourself targeting one of the eBPF programs here.\n\n\u003cdetails\u003e\n\u003csummary\u003eFirst, you'll need to verify whether you have the `userfaultfd` syscall...\u003c/summary\u003e\n\u003cp\u003e\n\n```console\n$ zcat /proc/config.gz | grep CONFIG_USERFAULTFD\n```\n\nYou'll also need to verify if it is enabled for unprivileged users\n(surprisingly, it is enabled for unprivileged users in many distro kernels).\n\n```console\n$ cat /proc/sys/vm/unprivileged_userfaultfd\n```\n\nIf `/proc/sys/vm/unprivileged_userfaultfd` is set to `0`, for the sake of this experimentation set it to `1`, like so:\n\n```console\n$ sudo sysctl -w vm.unprivileged_userfaultfd=1\n```\n\u003c/p\u003e\n\u003c/details\u003e\n\nNow you should be able to doo you experimentations!\n\nFirst, start an eBPF program of your choice...\n\nThen, it's attack time:\n\n```console\n$ pushd phantom-attack/phantom_v1/\n$ make\n$ popd\n$ ./phantom-attack/phantom_v1/attack_connect\n```\n\nI also wrote a bash script to make these experimentations more straightforward.\n\nMaybe, one day, I'll publish the results of such experimentations among different kernel releases, eBPF programs, etc.\n\nAnyways, you can find it at [experiment.sh](./experiment.sh) in this repo and you can execute it by providing the number of times you want the attack to run (let's say 10?) and the eBPF program to target (let's say `trace_connect`?).\n\n```console\n$ ./experiment.sh -i 100 -p trace_connect\n```\n\nHave fun!\n\n~\nLeo\n\n---\n\n[![Analytics](https://ga-beacon.appspot.com/UA-49657176-1/demo-cloud-native-ebpf-day?flat)](https://github.com/igrigorik/ga-beacon)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleodido%2Fdemo-cloud-native-ebpf-day","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleodido%2Fdemo-cloud-native-ebpf-day","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleodido%2Fdemo-cloud-native-ebpf-day/lists"}