Data filter in kernel #4324

rscampos · 2024-09-24T02:03:03Z

1. Explain what the PR does

3717704 Tracee data filter equalities
0edc416 eBPF data filter (user-space)
48cc10b Enable data filter in eBPF program
f435287 eBPF data filter (kernel-space)
6ca82e6 Enable BPF_F_NO_PREALLOC for LPM TRIE

3717704 Tracee data filter equalities

- method equalities created for data filter;
- disable data filter (only pathname) for selected events.

0edc416 eBPF data filter (user-space)

- eBPF map definition for prefix, postfix and exactly match;
- create updateDataFilterLPMBPF and updateDataFilterBPF to populate eBPF
  maps;
- config map fields for prefix, postfix and exactly.

48cc10b Enable data filter in eBPF program

- how to enable data filter in the eBPF program using the function
evaluate_data_filters.

f435287 eBPF data filter (kernel-space)

- function load_str_from_buf created to retrieve str value based on index;
- function reverse_string created to revert the pathname in order to enable postfix;
- function evaluate_data_filters/match_data_filters created to apply: prefix, postfix and exactly match;
- eBPF maps for prefix, postfix and exactly. eBPF map for hold temporary LPM TRI key;
- add fields in config_map for prefix, postfix and exactly match.

2. Explain how to test it

The method for defining data filters in Tracee remains the same. However, for the security_file_open and magic_write events, if the pathname is used as a filter, the event is now filtered at the eBPF data plane, preventing it from being sent to user space for filtering.

Prefix:
Tracee:

sudo ./dist/tracee -e security_file_open.data.pathname=/etc/hosts*

Cmd:

cat /etc/hosts.allow
cat /etc/hosts.deny

Exactly:
Tracee:

sudo ./dist/tracee -e security_file_open.data.pathname=/etc/netconfig

Cmd:

cat /etc/netconfig

Postfix:
Tracee:

sudo ./dist/tracee -e security_file_open.data.pathname=*config

Cmd:

cat /etc/netconfig

3. Other comments

Next steps:

Evaluate and combine all three types of string-based filters simultaneously. Currently, they work separately but not together.
Improve the way we define (in user-space) which events should have an in-kernel filter enabled. Some parts of the logic I added were just for a PoC, so this needs to be reworked.
Currently, we explicitly define the index in evaluate_data_filters to retrieve the pathname for string-based filtering. This works for now, but it would be better to dynamically retrieve the index based on the event ID.

- function load_str_from_buf created to retrieve str value based on index; - function reverse_string created to revert the pathname in order to enable postfix; - function evaluate_data_filters/match_data_filters created to apply: prefix, postfix and exactly match; - eBPF maps for prefix, postfix and exactly. eBPF map for hold temporary LPM TRI key; - add fields in config_map for prefix, postfix and exactly match.

- how to enable data filter in the eBPF program using the function evaluate_data_filters.

- eBPF map definition for prefix, postfix and exactly match; - create updateDataFilterLPMBPF and updateDataFilterBPF to populate eBPF maps; - config map fields for prefix, postfix and exactly.

- method equalities created for data filter; - disable data filter (only pathname) for selected events.

geyslan

This is just a first pass (skimming) review.

Tested and working with:

sudo ./dist/tracee -e security_file_open.data.pathname=/etc/passwd
sudo ./dist/tracee -e security_file_open.data.pathname='/etc/passwd*'
sudo ./dist/tracee -e security_file_open.data.pathname='*passwd-'

Amazing, @rscampos! 👏🏼

geyslan · 2024-09-24T18:08:45Z

pkg/utils/utils.go

@@ -73,3 +73,12 @@ func Max(x, y uint64) uint64 {
 func GenerateRandomDuration(min, max int) time.Duration {
 	return time.Duration(rand.Intn(max-min+1)+min) * time.Second
 }
+
+func ReverseString(s string) string {


Perhaps this could be placed in the helpers pkg?

geyslan · 2024-09-24T18:13:45Z

pkg/policy/ebpf.go

@@ -706,6 +829,7 @@ func (ps *policies) computePoliciesConfig() *PoliciesConfig {
 		}

 		cfg.EnabledScopes |= 1 << offset
+		cfg.EnabledDataFilters |= 1 << offset


Shouldn't this be?

Suggested change

cfg.EnabledDataFilters |= 1 << offset

cfg.EnabledDataFilters |= (ExactlyEnabledDataFilters | PrefixEnabledDataFilters | cfg.PostfixEnabledDataFilters) & (1 << offset)

geyslan · 2024-09-24T18:21:49Z

pkg/filters/data.go

@@ -121,6 +211,12 @@ func (af *DataFilter) Parse(filterName string, operatorAndValues string, eventsN
 	// before the filter is applied
 	valueHandler := func(val string) (string, error) {
 		switch id {
+		case events.SecurityFileOpen,


There's duplicate logic in here from EnableKernel().

geyslan · 2024-09-24T18:23:41Z

pkg/filters/data.go

@@ -37,6 +116,17 @@ func (af *DataFilter) Filter(eventID events.ID, data []trace.Argument) bool {
 		return true
 	}

+	// don't Filter this special case


What do you think of checking a kernelFilter flag instead (it could be set on Parse)?

geyslan · 2024-09-24T18:27:32Z

pkg/filters/data.go

+		if filterMap, ok := af.filters[eventID]; ok {
+			if pathName, ok := filterMap[dataField]; ok {
+				if filter, ok := pathName.(*StringFilter); ok {


We can easily use the happy path here.

geyslan · 2024-09-24T18:30:34Z

pkg/ebpf/c/types.h

@@ -284,6 +284,17 @@ typedef struct path_filter {
    char path[MAX_PATH_PREF_SIZE];
 } path_filter_t;

+typedef struct data_filter_key {
+    u32 eventid;


Suggested change

u32 eventid;

u32 event_id;

nit: I know that there's still some eventid, but it would be nice to standardise them as well.

geyslan · 2024-09-24T18:30:46Z

pkg/ebpf/c/types.h

+} data_filter_key_t;
+
+typedef struct data_filter_lpm_key {
+    u32 prefixlen;


Suggested change

u32 prefixlen;

u32 prefix_len;

geyslan · 2024-09-24T18:36:23Z

pkg/ebpf/c/tracee.bpf.c

@@ -2209,6 +2209,9 @@ int BPF_KPROBE(trace_security_file_open)
    save_to_submit_buf(&p.event->args_buf, &ctime, sizeof(u64), 4);
    save_str_to_buf(&p.event->args_buf, syscall_pathname, 5);

+    if (!evaluate_data_filters(&p, 0))


We've already discussed about this. Just registering for possible improvements of the save_*to*_buf API.

I believe that save_str_to_buf(), for instance, could return the offset that it saved the string with a simple change. So that info should be propagated in the scrap buffers to be reused further as an argument to load_str_from_buf() and other helpers alike.

rscampos added 5 commits September 23, 2024 20:20

Enable BPF_F_NO_PREALLOC for LPM TRIE

6ca82e6

Enable data filter in eBPF program

48cc10b

- how to enable data filter in the eBPF program using the function evaluate_data_filters.

eBPF data filter (user-space)

0edc416

- eBPF map definition for prefix, postfix and exactly match; - create updateDataFilterLPMBPF and updateDataFilterBPF to populate eBPF maps; - config map fields for prefix, postfix and exactly.

Tracee data filter equalities

3717704

- method equalities created for data filter; - disable data filter (only pathname) for selected events.

github-actions bot assigned rscampos Sep 24, 2024

rscampos marked this pull request as draft September 24, 2024 02:03

github-actions bot added area/ebpf area/filtering labels Sep 24, 2024

geyslan reviewed Sep 24, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Data filter in kernel #4324

Data filter in kernel #4324

rscampos commented Sep 24, 2024 •

edited

Loading

geyslan left a comment

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

geyslan Sep 24, 2024

	cfg.EnabledDataFilters \|= 1 << offset
	cfg.EnabledDataFilters \|= (ExactlyEnabledDataFilters \| PrefixEnabledDataFilters \| cfg.PostfixEnabledDataFilters) & (1 << offset)

Data filter in kernel #4324

Are you sure you want to change the base?

Data filter in kernel #4324

Conversation

rscampos commented Sep 24, 2024 • edited Loading

1. Explain what the PR does

2. Explain how to test it

3. Other comments

geyslan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rscampos commented Sep 24, 2024 •

edited

Loading