helpers/btfinfo: renamed to osinfo and improved, syncing #981

rafaeldtinoco · 2021-09-01T17:07:54Z

Reference: aquasecurity/libbpfgo#60

Needs aquasecurity/libbpfgo#67 merged first.

tracee-ebpf/go.mod

tracee-ebpf/main.go

yanivagman · 2021-09-02T21:16:30Z

Can we remove the UnameRelease() and KernelIsAtLeast() functions from tracee.go after the libbpfgo PR is merged?

rafaeldtinoco · 2021-09-03T05:38:01Z

This will only work after aquasecurity/libbpfgo#70 is reviewed and merged AND we bump libbpfgo dependency to that commit. Tests at: aquasecurity/libbpfgo#61 (comment)

rafaeldtinoco · 2021-09-03T05:47:14Z

Maybe we should consider that... if no kconfig file was found the kconfig variable CONFIG_ARCH_HAS_SYSCALL_WRAPPER is yes ? Most of the times it will be, no ?

Same test using an existing kconfig file:

it sets CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y because of the kconfig file.

tracee-ebpf/main.go

rafaeldtinoco · 2021-09-03T16:26:51Z

All tests are good but now I'm failing if no kconfig file exists from tracee side (because I need the CONFIG_ARCH_HAS_SYSCALL_WRAPPER value). I'll have to define as TRUE or FALSE by default if no kconfig file is found @yanivagman. Is that ok ? This way we can fully get rid of kconfig if there is none provided AND none in the OS.

Reference: aquasecurity/libbpfgo#60 Reference: aquasecurity/libbpfgo#61

tracee-ebpf/tracee/tracee.bpf.c

Use helpers/kernel_config custom KernelConfigOption's feature in order to extend KernelConfig default values and seek for specific ones needed to feed tracee-ebpf's kconfig map. Fixes: aquasecurity/libbpfgo#61

rafaeldtinoco · 2021-09-03T19:57:07Z

regular call

$ sudo ./dist/tracee-ebpf --debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
OSInfo: ID_LIKE: debian
OSInfo: PRETTY_NAME: "Ubuntu 21.04"
OSInfo: VERSION_ID: "21.04"
OSInfo: VERSION_CODENAME: hirsute
OSInfo: KERNEL_RELEASE: 5.11.0-31-generic
OSInfo: VERSION: "21.04 (Hirsute Hippo)"
OSInfo: ID: ubuntu
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876184
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
16:50:31:118904  1000   bash             765133  765133  0                execve               pathname: /bin/exa, argv: [exa --color=auto]
16:50:31:128992
8000
  1000   bash             765136  765136  0                execve               pathname: /home/rafaeldtinoco/scripts/git, argv: [git branch]
16:50:31:129741  1000   bash             765137  765137  0                execve               pathname: /bin/sed, argv: [sed -e /^[^*]/d -e s/* \(.*\)/\1/]
16:50:31:133130  1000   git              765136  765136  0                execve               pathname: /usr/bin/git, argv: [/usr/bin/git branch]

End of events stream
Stats: {EventCount:4 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

regular external files:

$ sudo LIBBPFGO_OSRELEASE_FILE=/etc/os-release LIBBPFGO_KCONFIG_FILE=/boot/config-$(uname -r) ./dist/tracee-ebpf --debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
OSInfo: KERNEL_RELEASE: 5.11.0-31-generic
OSInfo: VERSION: "21.04 (Hirsute Hippo)"
OSInfo: ID: ubuntu
OSInfo: ID_LIKE: debian
OSInfo: PRETTY_NAME: "Ubuntu 21.04"
OSInfo: VERSION_ID: "21.04"
OSInfo: VERSION_CODENAME: hirsute
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876184
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
16:50:59:091511  1000   bash             771084  771084  0                execve               pathname: /bin/exa, argv: [exa --color=auto]
16:50:59:100976  1000   bash             771087  771087  0                execve               pathname: /home/rafaeldtinoco/scripts/git, argv: [git branch]
16:50:59:101706  1000   bash             771088  771088  0                execve               pathname: /bin/sed, argv: [sed -e /^[^*]/d -e s/* \(.*\)/\1/]
16:50:59:106542  1000   git              771087  771087  0                execve               pathname: /usr/bin/git, argv: [/usr/bin/git branch]

End of events stream
Stats: {EventCount:4 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

no os-release file, try to continue:

$ sudo LIBBPFGO_OSRELEASE_FILE=NOFILE LIBBPFGO_KCONFIG_FILE=/boot/config-$(uname -r) ./dist/tracee-ebpf --debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
OSInfo: KERNEL_RELEASE: 5.11.0-31-generic
OSInfo: warning: os-release file could be found
(could not open LIBBPFGO_OSRELEASE_FILE NOFILE)
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876184
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876186
Running container = 5e539daad7d5bf83f6f1819570c3766a75d9f488598d17fed58c7a93ecb8ded4 pid = 876182
16:51:37:896163  1000   bash             774394  774394  0                execve               pathname: /bin/exa, argv: [exa --color=auto]
16:51:37:905983  1000   bash             774397  774397  0                execve               pathname: /home/rafaeldtinoco/scripts/git, argv: [git branch]
16:51:37:906384  1000   bash             774398  774398  0                execve               pathname: /bin/sed, argv: [sed -e /^[^*]/d -e s/* \(.*\)/\1/]
16:51:37:909142  1000   git              774397  774397  0                execve               pathname: /usr/bin/git, argv: [/usr/bin/git branch]

End of events stream
Stats: {EventCount:4 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

No os-release NOR kconfig files. Tracee assumes CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y.

$ sudo LIBBPFGO_OSRELEASE_FILE=/etc/os-release LIBBPFGO_KCONFIG_FILE=NOFILE ./dist/tracee-ebpf --debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
KConfig: warning: could not check enabled kconfig features
(could not open LIBBPFGO_KCONFIG_FILE NOFILE)
OSInfo: KERNEL_RELEASE: 5.14.0-rc5+
OSInfo: warning: os-release file could be found
(could not open LIBBPFGO_OSRELEASE_FILE /etc/os-release)
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
19:52:06:661000  1000   bash             12112   12112   0                execve               pathname: /bin/ls, argv: [ls --color=auto]

End of events stream
Stats: {EventCount:1 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

Check if given kconfig in environment with no kconfig is good for libbpf:

$ ls /etc/os-release
ls: cannot access '/etc/os-release': No such file or directory

$ ls /boot/config-$(uname -r)
ls: cannot access '/boot/config-5.14.0-rc5+': No such file or directory

$ sudo ./dist/tracee-ebpf --debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
KConfig: warning: could not check enabled kconfig features
(could not read /boot/config-5.14.0-rc5+: stat /boot/config-5.14.0-rc5+: no such file or directory)
OSInfo: KERNEL_RELEASE: 5.14.0-rc5+
OSInfo: warning: os-release file could be found
(open /etc/os-release: no such file or directory)
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
19:53:35:871855  1000   bash             12201   12201   0                execve               pathname: /bin/ls, argv: [ls --color=auto]

End of events stream
Stats: {EventCount:1 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

If we manually remove CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y from the given kconfig file, for testing purposes, we have to break the arguments:

$ sudo LIBBPFGO_KCONFIG_FILE=/boot/config-5.14.0-rc5+.orig ./dist/tracee-ebpf -debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
OSInfo: KERNEL_RELEASE: 5.14.0-rc5+
OSInfo: warning: os-release file could be found
(open /etc/os-release: no such file or directory)
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
19:56:20:463406  1000   bash             12248   12248   0                execve               pathname:  , argv: []

End of events stream
Stats: {EventCount:1 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

And if I put it back on (=y):

$ sudo LIBBPFGO_KCONFIG_FILE=/boot/config-5.14.0-rc5+.orig ./dist/tracee-ebpf -debug --trace uid=1000 --trace pid=new --trace event=execve --trace event=cap_capable --output option:detect-syscall
OSInfo: KERNEL_RELEASE: 5.14.0-rc5+
OSInfo: warning: os-release file could be found
(open /etc/os-release: no such file or directory)
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
20:02:58:949046  1000   bash             12313   12313   0                execve               pathname: /bin/ls, argv: [ls --color=auto]

End of events stream
Stats: {EventCount:1 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}

Everything seems to be working as expected.

Signed-off-by: grantseltzer <grantseltzer@gmail.com>

grantseltzer

LGTM!

tracee-ebpf/go.mod

grantseltzer · 2021-09-04T01:43:21Z

It was done by me accidentally when I upgradded the libbfgo dependency. I deleted go.mod first when debugging. Not necessary for the release but yes, it's already reverted.

…

On Fri, Sep 3, 2021 at 9:25 PM Rafael David Tinoco ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In tracee-ebpf/go.mod <#981 (comment)>: > @@ -2,15 +2,13 @@ module github.com/aquasecurity/tracee/tracee-ebpf go 1.16 -replace github.com/aquasecurity/tracee/tracee-ebpf/external => ./external/ - This was done automatically by GoLand, I'll check why that happened. I see it was already put back. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#981 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACS2XBPQUBGOOUMHTHCCS3TUAFYSNANCNFSM5DG57RMA> .

tracee-ebpf/tracee/tracee.go

tracee-ebpf/tracee/consts.go

rafaeldtinoco · 2021-09-06T20:46:41Z

FTR, I've got some minor continuation of this at: #999

rafaeldtinoco requested review from grantseltzer and itaysk September 1, 2021 17:08

itaysk reviewed Sep 2, 2021

View reviewed changes

tracee-ebpf/go.mod Outdated Show resolved Hide resolved

tracee-ebpf/main.go Outdated Show resolved Hide resolved

tracee-ebpf/main.go Outdated Show resolved Hide resolved

grantseltzer reviewed Sep 2, 2021

View reviewed changes

tracee-ebpf/main.go Outdated Show resolved Hide resolved

grantseltzer added the area/ebpf label Sep 2, 2021

rafaeldtinoco mentioned this pull request Sep 3, 2021

helpers/kernel_config.go: allow kconfig files logic aquasecurity/libbpfgo#70

Merged

rafaeldtinoco requested a review from yanivagman September 3, 2021 05:39

grantseltzer reviewed Sep 3, 2021

View reviewed changes

tracee-ebpf/main.go Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

rafaeldtinoco added 3 commits September 3, 2021 16:10

helpers/btfinfo: renamed to osinfo & improved API

bf761da

main.go: allow kconfig file override using env variable

07de7b8

Reference: aquasecurity/libbpfgo#60 Reference: aquasecurity/libbpfgo#61

tracee: remove UnameRelease and kernelIsAtLeast functions

743fc44

rafaeldtinoco requested a review from grantseltzer September 3, 2021 19:30

grantseltzer reviewed Sep 3, 2021

View reviewed changes

tracee-ebpf/tracee/tracee.bpf.c Outdated Show resolved Hide resolved

rafaeldtinoco added 7 commits September 3, 2021 16:49

tracee-ebpf: use kconfig map instead of .kconfig rel from libbpf

6581847

tracee: use KernelConfig to set new kconfig map variables

d7c12ca

tracee: custom KernelConfigOption's given to tracee-ebpf

a1277b7

Use helpers/kernel_config custom KernelConfigOption's feature in order to extend KernelConfig default values and seek for specific ones needed to feed tracee-ebpf's kconfig map. Fixes: aquasecurity/libbpfgo#61

tracee: use KernelConfigOption type

270efae

tracee: fix build: depend on libbpfgo/helpers

b7a6e4b

tracee-ebpf: assume CONFIG_ARCH_HAS_SYSCALL_WRAPPER if no kconfig file

3299e57

tracee: bump libbpfgo latest version for tests before release

ea9b9e3

rafaeldtinoco requested review from grantseltzer and removed request for yanivagman September 3, 2021 20:17

Update go.mod and go.sum to new version of libbpfgo

e3aead4

Signed-off-by: grantseltzer <grantseltzer@gmail.com>

grantseltzer approved these changes Sep 3, 2021

View reviewed changes

grantseltzer merged commit bcf7153 into aquasecurity:main Sep 3, 2021

yanivagman reviewed Sep 3, 2021

View reviewed changes

tracee-ebpf/go.mod Show resolved Hide resolved

yanivagman reviewed Sep 5, 2021

View reviewed changes

tracee-ebpf/tracee/tracee.go Show resolved Hide resolved

tracee-ebpf/tracee/consts.go Show resolved Hide resolved

rafaeldtinoco deleted the osinfonew branch November 6, 2021 08:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

helpers/btfinfo: renamed to osinfo and improved, syncing #981

helpers/btfinfo: renamed to osinfo and improved, syncing #981

This comment has been minimized.

helpers/btfinfo: renamed to osinfo and improved, syncing #981

helpers/btfinfo: renamed to osinfo and improved, syncing #981

Conversation

This comment has been minimized.

Choose a reason for hiding this comment