https://github.com/mrtc0/bouheki

bouheki is KRSI(eBPF+LSM) based Linux security auditing tool.
https://github.com/mrtc0/bouheki

audit ebpf firewall linux security

Last synced: 2 months ago
JSON representation

bouheki is KRSI(eBPF+LSM) based Linux security auditing tool.

• Host: GitHub
• URL: https://github.com/mrtc0/bouheki
• Owner: mrtc0
• License: mit
• Created: 2021-09-21T12:59:57.000Z (over 3 years ago)
• Default Branch: master
• Last Pushed: 2023-02-28T19:01:15.000Z (almost 2 years ago)
• Last Synced: 2024-10-14T14:21:15.298Z (3 months ago)
• Topics: audit, ebpf, firewall, linux, security
• Language: C
• Homepage: https://mrtc0.github.io/bouheki
• Size: 1.53 MB
• Stars: 83
• Watchers: 5
• Forks: 8
• Open Issues: 12
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# bouheki: KRSI(eBPF+LSM) based Linux security auditing tool

bouheki is KRSI(eBPF+LSM) based Linux security auditing tool.  

Security events can be audited and blocked based on the container of the process, and restrictions can be applied to container environments.

# Features

* Restriction rules based on process context, such as command name or UID and more

* Restrictions limited to containers

* Network Access Control

* File Access Control

* Restictions bind mounts from host filesystem to containers

# Getting Started

https://mrtc0.github.io/bouheki

# DEMO

[![asciicast](https://asciinema.org/a/475371.svg)](https://asciinema.org/a/475371)

# LICENSE

bouheki's userspace program is licensed under MIT License.  

eBPF programs inside [pkg/bpf directory](pkg/bpf) are licensed under [GNU General Public License version 2](./pkg/bpf/LICENSE.md).