Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] feat: extend string data filtering to LSM related events #4590

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

rscampos
Copy link
Collaborator

@rscampos rscampos commented Feb 14, 2025

1. Explain what the PR does

68b5feb test: external triggers for integration
db02b57 feat(ebpf): extend string data filtering for LSM events
7a42ae3 feat: allow different field names

68b5feb test: external triggers for integration

- Add external scripts to be triggered in order to test data filter
related to events that uses LSM.

db02b57 feat(ebpf): extend string data filtering for LSM events

- Only for LSM related events.

7a42ae3 feat: allow different field names

- Allow any field name in the in-kernel string filter.
- Currently, only one string-type field name is supported.
- Future support for multiple field names is planned.
- Start with LSM related events.

2. Explain how to test it

3. Other comments

This PR only focus on LSM hooks and the related tests.
part of #4432

Event String Name Trigger
✅ security_bprm_check pathname 5
✅ security_file_open pathname 1 (already present)
✅ security_inode_unlink pathname 3
✅ security_sb_mount path Yes
✅ security_bpf_map map_name Yes
✅ security_kernel_read_file pathname 4
✅ security_inode_mknod file_name Yes
✅ security_kernel_post_read_file pathname 4
✅ security_inode_symlink linkpath 3
✅ security_mmap_file pathname 2 (already present)
✅ security_file_mprotect pathname 5
✅ security_inode_rename old_path 3
✅ security_bpf_prog name Yes
✅ security_path_notify pathname Yes
✅ shared_object_loaded pathname 5
Trigger Name
1 comm: event: data: trace event security_file_open set in multiple policies using multiple filter types
2 comm: event: data: trace event security_mmap_file using multiple filter types
3 event: data: trace event security_inode_symlink, security_inode_rename and security_inode_unlink using data filter
4 event: data: trace event security_kernel_read_file and security_kernel_post_read_file using data filter
5 comm: event: data: trace event security_bprm_check, shared_object_loaded and security_file_mprotect using data filter

- Allow any field name in the in-kernel string filter.
- Currently, only one string-type field name is supported.
- Future support for multiple field names is planned.
- Start with LSM related events.
- Add external scripts to be triggered in order to test data filter
related to events that uses LSM.
@rscampos rscampos force-pushed the data_filter_in_kernel_phase2_lsm branch from 68b5feb to 5cf3a81 Compare February 14, 2025 20:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant