{"id":15558599,"url":"https://github.com/mozillazg/cloud-native-security-with-ebpf","last_synced_at":"2025-06-26T03:04:47.537Z","repository":{"id":255827120,"uuid":"522203590","full_name":"mozillazg/cloud-native-security-with-ebpf","owner":"mozillazg","description":"《eBPF 云原生安全：原理与实践》书中示例程序的完整源代码","archived":false,"fork":false,"pushed_at":"2024-12-01T22:57:37.000Z","size":824,"stargazers_count":80,"open_issues_count":6,"forks_count":8,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-05T18:19:37.763Z","etag":null,"topics":["ebpf"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mozillazg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://mozillazg.com/wechat_donate.jpeg"],"patreon":"mozillazg"}},"created_at":"2022-08-07T12:13:40.000Z","updated_at":"2024-12-31T01:51:02.000Z","dependencies_parsed_at":null,"dependency_job_id":"547c8125-de88-4003-971a-e5ffcad9a699","html_url":"https://github.com/mozillazg/cloud-native-security-with-ebpf","commit_stats":null,"previous_names":["mozillazg/cloud-native-security-with-ebpf"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/mozillazg/cloud-native-security-with-ebpf","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozillazg%2Fcloud-native-security-with-ebpf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozillazg%2Fcloud-native-security-with-ebpf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozillazg%2Fcloud-native-security-with-ebpf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozillazg%2Fcloud-native-security-with-ebpf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mozillazg","download_url":"https://codeload.github.com/mozillazg/cloud-native-security-with-ebpf/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mozillazg%2Fcloud-native-security-with-ebpf/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261990349,"owners_count":23241188,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf"],"created_at":"2024-10-02T15:39:48.277Z","updated_at":"2025-06-26T03:04:47.513Z","avatar_url":"https://github.com/mozillazg.png","language":"C","funding_links":["https://mozillazg.com/wechat_donate.jpeg","https://patreon.com/mozillazg"],"categories":["C"],"sub_categories":[],"readme":"# eBPF 云原生安全：原理与实践 [![CI](https://img.shields.io/github/actions/workflow/status/mozillazg/cloud-native-security-with-ebpf/build.yml?label=build%20programs)](https://github.com/mozillazg/cloud-native-security-with-ebpf/actions/workflows/build.yml)\n\n\n\u003cimg src=\"cover.jpg\" height=250 alt=\"eBPF 云原生安全：原理与实践\" /\u003e\n\n\n《eBPF 云原生安全：原理与实践》书中示例程序的完整源代码。\n\n\n\n## 链接\n\n* 豆瓣：\u003chttps://book.douban.com/subject/37022239/\u003e\n* 天猫：\u003chttps://detail.tmall.com/item.htm?id=822518924758\u003e\n* 京东：\u003chttps://item.jd.com/10111206687256.html\u003e\n\n\n## 目录\n\n\n\u003cdetails\u003e\u003csummary\u003e书籍目录：\u003c/summary\u003e\n\n* 前言\n* 目录\n* 第一部分 eBPF 助力云原生安全\n  * 第 1 章 云原生安全概述\n    * 1.1 云原生安全的挑战\n      * 1.1.1 云原生平台基础设施的安全风险\n      * 1.1.2 DevOps 软件供应链的安全风险\n      * 1.1.3 云原生应用范式的安全风险\n    * 1.2 云原生安全的演进\n    * 1.3 云原生安全的理论基础\n      * 1.3.1 威胁建模\n      * 1.3.2 坚守安全准则\n      * 1.3.3 安全观测和事件响应\n    * 1.4 云原生安全的方法论\n      * 1.4.1 CNCF 云原生安全架构\n      * 1.4.2 云原生应用保护平台\n    * 1.5 本章小结\n  * 第 2 章 初识 eBPF\n    * 2.1 eBPF 历史\n    * 2.2 eBPF 的关键特性和应用场景\n      * 2.2.1 Linux 内核\n      * 2.2.2 eBPF 的关键特性\n      * 2.2.3 eBPF 的应用场景\n    * 2.3 eBPF 的架构\n    * 2.4 本章小结\n  * 第 3 章 eBPF 技术原理详解\n    * 3.1 eBPF“Hello World”程序\n    * 3.2 eBPF 技术原理\n      * 3.2.1 eBPF Map 数据结构\n      * 3.2.2 eBPF 虚拟机\n      * 3.2.3 eBPF 验证器\n      * 3.2.4 bpf() 系统调用\n      * 3.2.5 eBPF 程序和附着类型\n    * 3.3 eBPF 程序的开发模式\n      * 3.3.1 BCC 模式\n      * 3.3.2 CO-RE+ libbpf 模式\n    * 3.4 本章小结\n  * 第 4 章 eBPF 技术在云原生安全领域的应用\n    * 4.1 针对云原生应用的攻击\n    * 4.2 eBPF 和云原生安全的契合点\n      * 4.2.1 容器中的基础隔离\n      * 4.2.2 传统安全架构\n      * 4.2.3 eBPF 提升云原生应用运行时安全\n      * 4.2.4 eBPF 伴随云原生应用生命周期\n    * 4.3 eBPF 云原生安全开源项目\n      * 4.3.1 Falco\n      * 4.3.2 Tracee\n      * 4.3.3 Tetragon\n    * 4.4 双刃剑\n    * 4.5 本章小结\n* 第二部分 云原生安全项目详解\n  * 第 5 章 云原生安全项目 Falco 详解\n    * 5.1 项目介绍\n      * 5.1.1 功能\n      * 5.1.2 使用场景\n    * 5.2 安装\n      * 5.2.1 使用包管理工具\n      * 5.2.2 下载二进制包\n      * 5.2.3 Kubernetes 环境\n    * 5.3 使用示例\n      * 5.3.1 规则引擎\n      * 5.3.2 告警输出\n      * 5.3.3 事件源\n    * 5.4 架构和实现原理\n      * 5.4.1 架构\n      * 5.4.2 驱动\n      * 5.4.3 用户态模块\n    * 5.5 本章小结\n  * 第 6 章 云原生安全项目 Tracee 详解\n    * 6.1 项目介绍\n    * 6.2 安装\n    * 6.3 使用示例\n      * 6.3.1 事件追踪\n      * 6.3.2 制品捕获\n      * 6.3.3 风险探测\n      * 6.3.4 外部集成\n    * 6.4 架构和实现原理\n      * 6.4.1 架构\n      * 6.4.2 tracee-ebpf 实现原理\n    * 6.5 本章小结\n  * 第 7 章 云原生安全项目 Tetragon 详解\n    * 7.1 项目介绍\n    * 7.2 安装\n    * 7.3 使用示例\n      * 7.3.1 事件观测\n      * 7.3.2 风险拦截\n    * 7.4 架构和实现原理\n      * 7.4.1 架构\n      * 7.4.2 事件观测\n      * 7.4.3 风险拦截\n    * 7.5 本章小结\n* 第三部分 eBPF 安全技术实战\n  * 第 8 章 使用 eBPF 技术审计和拦截命令执行操作\n    * 8.1 审计命令执行操作\n      * 8.1.1 基于 eBPF Kprobe 和 Kretprobe 实现\n      * 8.1.2 基于 eBPF Fentry 和 Fexit 实现\n      * 8.1.3 基于 eBPF Ksyscall 和 Kretsyscall 实现\n      * 8.1.4 基于 eBPF Tracepoint 实现\n    * 8.2 拦截命令执行操作\n      * 8.2.1 基于 bpf_send_signal 实现\n      * 8.2.2 基于 bpf_override_return 实现\n    * 8.3 本章小结\n  * 第 9 章 使用 eBPF 技术审计和拦截文件读写操作\n    * 9.1 审计文件读写操作\n      * 9.1.1 基于 eBPF Kprobe 和 Kretprobe 实现\n      * 9.1.2 基于 eBPF Tracepoint 实现\n      * 9.1.3 基于 eBPF LSM 实现\n    * 9.2 拦截文件读写操作\n      * 9.2.1 基于 bpf_send_signal 实现\n      * 9.2.2 基于 bpf_override_return 实现\n      * 9.2.3 基于 eBPF LSM 实现\n    * 9.3 本章小结\n  * 第 10 章 使用 eBPF 技术审计和拦截权限提升操作\n    * 10.1 审计权限提升操作\n      * 10.1.1 基于 eBPF LSM 实现\n      * 10.1.2 基于 eBPF Kprobe 实现\n    * 10.2 拦截权限提升操作\n    * 10.3 本章小结\n  * 第 11 章 使用 eBPF 技术审计和拦截网络流量\n    * 11.1 审计网络流量\n      * 11.1.1 基于 eBPF 套接字过滤器实现\n      * 11.1.2 基于 eBPF TC 实现\n      * 11.1.3 基于 eBPF XDP 实现\n      * 11.1.4 基于 Kprobe 实现\n    * 11.2 拦截网络流量\n      * 11.2.1 基于 eBPF TC 实现\n      * 11.2.2 基于 eBPF XDP 实现\n    * 11.3 本章小结\n  * 第 12 章 为事件关联上下文信息\n    * 12.1 进程信息\n      * 12.1.1 进程操作事件\n      * 12.1.2 网络事件\n    * 12.2 容器和 Pod 信息\n      * 12.2.1 进程操作事件\n      * 12.2.2 网络事件\n    * 12.3 本章小结\n* 第四部分 eBPF 安全进阶\n  * 第 13 章 使用 eBPF 技术审计复杂的攻击手段\n    * 13.1 审计使用无文件攻击技术实现的命令执行操作\n    * 13.2 审计反弹 Shell 操作\n    * 13.3 本章小结\n  * 第 14 章 使用 eBPF 技术探测恶意eBPF 程序\n    * 14.1 恶意 eBPF 程序\n      * 14.1.1 常规程序\n      * 14.1.2 网络程序\n    * 14.2 防护恶意 eBPF 程序\n    * 14.3 探测和审计恶意 eBPF 程序\n      * 14.3.1 文件分析\n      * 14.3.2 bpftool\n      * 14.3.3 内核探测\n    * 14.4 本章小结\n\u003c/details\u003e\n\n\n### 开发环境\n\n开发环境如下：\n* 系统：Ubuntu 22.04\n* 依赖 (安装和配置方法详见 [CI](https://github.com/mozillazg/cloud-native-security-with-ebpf/blob/master/.github/workflows/build.yml) ，也可以使用 [Vagrant](https://www.vagrantup.com/) 一键创建开发环境)：\n  * Go \u003e= 1.21\n  * Clang/LLVM 12\n  * gcc\n  * libelf-dev\n  * zlib1g-dev\n  * libzstd-dev\n  * pkgconf\n  * make\n  * git\n  * linux-tools-common linux-tools-generic linux-tools-$(uname -r)\n  * build-essential\n\n### 源码目录\n\n\n| 章节   | 源代码                                                                                                                                                                                                                                                                 |\n|------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| 第8章 使用 eBPF 技术审计和拦截命令执行操作 | [chapter08](chapter08)                                                                                                                                                                                                                                             |\n| 8.1 审计命令执行操作  | |\n| 8.1.1  | [chapter08/kprobe](chapter08/kprobe)                                                                                                                                                                                                                               |\n| 8.1.2 | [chapter08/fentry](chapter08/fentry)                                                                                                                                                                                                                               |\n| 8.1.3 | [chapter08/ksyscall](chapter08/ksyscall)                                                                                                                                                                                                                           |\n| 8.1.4 | [chapter08/tracepoint](chapter08/tracepoint)                                                                                                                                                                                                                       |\n| 8.2 拦截命令执行操作  | |\n| 8.2.1 | [chapter08/bpf_send_signal](chapter08/bpf_send_signal)                                                                                                                                                                                                             |\n| 8.2.2 | [chapter08/bpf_override_return](chapter08/bpf_override_return)                                                                                                                                                                                                     |\n| 第9章 使用 eBPF 技术审计和拦截文件读写操作 | [chapter09](chapter09)                                                                                                                                                                                                                                             |\n| 9.1 审计文件读写操作  | |\n| 9.1.1 | [chapter09/kprobe](chapter09/kprobe)                                                                                                                                                                                                                               |\n| 9.1.2 | [chapter09/tracepoint](chapter09/tracepoint)                                                                                                                                                                                                                       |\n| 9.1.3 | [chapter09/lsm](chapter09/lsm)                                                                                                                                                                                                                                     |\n| 9.2 拦截文件读写操作  | |\n| 9.2.1 | [chapter09/bpf_send_signal](chapter09/bpf_send_signal)                                                                                                                                                                                                             |\n| 9.2.2 | [chapter09/bpf_override_return](chapter09/bpf_override_return)                                                                                                                                                                                                     |\n| 9.2.3 | [chapter09/lsm-block](chapter09/lsm-block)                                                                                                                                                                                                                         |\n| 第10章 使用 eBPF 技术审计和拦截权限提升操作 | [chapter10](chapter10)                                                                                                                                                                                                                                             |\n| 10.1 审计权限提升操作  | |\n| 10.1.1 | [chapter10/lsm-file_open](chapter10/lsm-file_open), [chapter10/lsm-bprm_check_security](chapter10/lsm-bprm_check_security)                                                                                                                                         |\n| 10.1.2 | [chapter10/kprobe](chapter10/kprobe)                                                                                                                                                                                                                               |\n| 10.2 拦截权限提升操作  | |\n| 10.2 | [chapter10/lsm-block](chapter10/lsm-block)                                                                                                                                                                                                                         |\n| 第11章 使用 eBPF 技术审计和拦截网络流量 | [chapter11](chapter11)                                                                                                                                                                                                                                             |\n| 11.1 审计网络流量  | |\n| 11.1.1 | [chapter11/socket-filter](chapter11/socket-filter), [chapter11/socket-filter-userspace-parse](chapter11/socket-filter-userspace-parse)                                                                                                                             |\n| 11.1.2 | [chapter11/tc](chapter11/tc), [chapter11/tc-userspace-parse](chapter11/tc-userspace-parse)                                                                                                                                                                         |\n| 11.1.3 | [chapter11/xdp-userspace-parse](chapter11/xdp-userspace-parse)                                                                                                                                                                                                     |\n| 11.1.4 | [chapter11/kprobe](chapter11/kprobe)                                                                                                                                                                                                                               |\n| 11.2 拦截网络流量  | |\n| 11.2.1 | [chapter11/tc-block](chapter11/tc-block)                                                                                                                                                                                                                           |\n| 11.2.2 | [chapter11/xdp-block](chapter11/xdp-block)                                                                                                                                                                                                                         |\n| 第12章 为事件关联上下文信息 | [chapter12](chapter12)                                                                                                                                                                                                                                             |\n| 12.1 进程信息  | |\n| 12.1.1 | [chapter12/process-context](chapter12/process-context)                                                                                                                                                                                                             |\n| 12.1.2 | [chapter12/net-context](chapter12/net-context)                                                                                                                                                                                                                     |\n| 第13章 使用 eBPF 技术审计复杂的攻击手段 | [chapter13](chapter13)                                                                                                                                                                                                                                             |\n| 13.1 审计使用无文件攻击技术实现的命令执行操作  | |\n| 13.1 | [chapter13/memfd-create](chapter13/memfd-create), [chapter13/lsm-bprm_creds_from_file](chapter13/lsm-bprm_creds_from_file)                                                                                                                                         |\n| 13.2 审计反弹 Shell 操作  | |\n| 13.2 | [chapter13/reverse-shell](chapter13/reverse-shell)                                                                                                                                                                                                                 |\n| 第14章 使用 eBPF 技术探测恶意 eBPF 程序 | [chapter14](chapter14)                                                                                                                                                                                                                                             |\n| 14.1 恶意 eBPF 程序  | |\n| 14.1.1 | [chapter14/read-file](chapter14/read-file), [chapter14/add-sudo](chapter14/add-sudo), [chapter14/execve-hijack](chapter14/execve-hijack), [chapter14/hide-pid](chapter14/hide-pid)                                                                                 |\n| 14.1.2 | [chapter14/pipe-hijack](chapter14/pipe-hijack), [chapter14/modify-incoming-traffic](chapter14/modify-incoming-traffic), [chapter14/hide-incoming-traffic](chapter14/hide-incoming-traffic), [chapter14/hijack-tcp-to-send-data](chapter14/hijack-tcp-to-send-data) |\n| 14.3 探测和审计恶意 eBPF 程序  | |\n| 14.3.2 | [chapter14/inspect-ebpf-helpers](chapter14/inspect-ebpf-helpers)                                                                                                                                                                                                   |\n| 14.3.3 | [chapter14/check-helper-call](chapter14/check-helper-call)                                                                                                                                                                                                         |\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozillazg%2Fcloud-native-security-with-ebpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmozillazg%2Fcloud-native-security-with-ebpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmozillazg%2Fcloud-native-security-with-ebpf/lists"}