1
# 查看当前启用的 LSM
2
cat /sys/kernel/security/lsm
3
# lockdown,yama,integrity,apparmor
4

5
# 添加 bpf（需要重启）
6
# GRUB_CMDLINE_LINUX="lsm=lockdown,yama,integrity,apparmor,bpf"

1
#include "vmlinux.h"
2
#include <bpf/bpf_helpers.h>
3
#include <bpf/bpf_tracing.h>
4

5
// 受保护文件列表
6
struct {
7
    __uint(type, BPF_MAP_TYPE_HASH);
8
    __uint(max_entries, 1024);
9
    __type(key, u64);    // inode 号
10
    __type(value, u32);  // 允许的 UID
11
} protected_files SEC(".maps");
12

13
SEC("lsm/inode_permission")
14
int BPF_PROG(restrict_file_access, struct inode *inode, int mask)
15
{
16
    u64 ino = BPF_CORE_READ(inode, i_ino);
17
    u32 uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
18

19
    // 检查是否为受保护文件
20
    u32 *allowed_uid = bpf_map_lookup_elem(&protected_files, &ino);
21
    if (!allowed_uid)
22
        return 0;  // 非受保护文件，允许
23

24
    // 检查当前用户是否有权限
25
    if (uid != *allowed_uid) {
26
        // 记录非法访问
27
        bpf_trace_printk("Access denied: uid=%d ino=%lu\n", uid, ino);
28
        return -EPERM;  // 拒绝
29
    }
30

31
    return 0;  // 允许
32
}
33

34
char LICENSE[] SEC("license") = "GPL";

1
#include "vmlinux.h"
2
#include <bpf/bpf_helpers.h>
3
#include <bpf/bpf_tracing.h>
4

5
// 允许连接的 IP 列表
6
struct {
7
    __uint(type, BPF_MAP_TYPE_HASH);
8
    __uint(max_entries, 1024);
9
    __type(key, u32);    // 目标 IP
10
    __type(value, u32);  // 允许的 UID
11
} allowed_ips SEC(".maps");
12

13
SEC("lsm/socket_connect")
14
int BPF_PROG(restrict_connect, struct socket *sock, struct sockaddr *address)
15
{
16
    struct sockaddr_in *addr = (struct sockaddr_in *)address;
17
    u32 dst_ip = BPF_CORE_READ(addr, sin_addr.s_addr);
18
    u32 uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
19

20
    u32 *allowed = bpf_map_lookup_elem(&allowed_ips, &dst_ip);
21
    if (allowed && uid != *allowed)
22
        return -EPERM;
23

24
    return 0;
25
}
26

27
char LICENSE[] SEC("license") = "GPL";

1
// Seccomp-BPF 程序：只允许基本系统调用
2
// 通过 prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) 安装
3
SEC("socket")
4
int seccomp_filter(struct seccomp_data *ctx)
5
{
6
    // ctx->nr 是系统调用号
7
    // ctx->arch 是架构标识
8
    // ctx->args[0..5] 是系统调用参数
9

10
    switch (ctx->nr) {
11
    case __NR_read:
12
    case __NR_write:
13
    case __NR_openat:
14
    case __NR_close:
15
    case __NR_fstat:
16
    case __NR_mmap:
17
    case __NR_munmap:
18
    case __NR_brk:
19
    case __NR_exit_group:
20
    case __NR_clock_gettime:
21
        return SECCOMP_RET_ALLOW;  // 允许
22

23
    case __NR_socket:
24
        // 只允许 AF_INET 和 AF_INET6
25
        if (ctx->args[0] == AF_INET || ctx->args[0] == AF_INET6)
26
            return SECCOMP_RET_ALLOW;
27
        return SECCOMP_RET_ERRNO | EAFNOSUPPORT;
28

29
    default:
30
        // 其他系统调用：记录并拒绝
31
        return SECCOMP_RET_ERRNO | ENOSYS;
32
    }
33
}

1
// 审计模式：记录但不阻止
2
SEC("lsm/socket_connect")
3
int BPF_PROG(audit_connect, struct socket *sock, struct sockaddr *address)
4
{
5
    u32 uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
6
    struct sockaddr_in *addr = (struct sockaddr_in *)address;
7
    u32 dst_ip = BPF_CORE_READ(addr, sin_addr.s_addr);
8

9
    u32 *blocked = bpf_map_lookup_elem(&blocked_ips, &dst_ip);
10
    if (blocked && uid != *blocked) {
11
        // 审计模式：仅记录事件到 Ring Buffer
12
        struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
13
        if (e) {
14
            e->type = EVENT_BLOCKED_CONNECT;
15
            e->uid = uid;
16
            e->dst_ip = dst_ip;
17
            bpf_ringbuf_submit(e, 0);
18
        }
19
        // 审计模式：仍然允许
20
        return 0;
21
        // 阻断模式：取消上面 return 0，改为：
22
        // return -EPERM;
23
    }
24
    return 0;
25
}

1
# Tetragon TracingPolicy 示例：监控所有进程执行
2
apiVersion: cilium.io/v1alpha1
3
kind: TracingPolicy
4
metadata:
5
  name: monitor-process-exec
6
spec:
7
  kprobes:
8
  - call: "sys_execve"
9
    syscall: true
10
    args:
11
    - index: 0
12
      type: "string"
13
    selectors:
14
    - matchNames:
15
      - namespace: "default"
16
    return: true
17
    returnArg:
18
      index: 0
19
      type: "int"

1
# 使用 Helm 部署 Tetragon
2
helm repo add cilium https://helm.cilium.io
3
helm install tetragon cilium/tetragon -n kube-system
4

5
# 查看 Tetragon 日志
6
kubectl logs -n kube-system -l app.kubernetes.io/name=tetragon
7

8
# 使用 tetragon CLI 查看事件
9
kubectl exec -n kube-system tetragon-xxx -- tetra getevents

1
apiVersion: cilium.io/v1alpha1
2
kind: TracingPolicy
3
metadata:
4
  name: detect-privileged-exec
5
spec:
6
  kprobes:
7
  - call: "cap_capable"
8
    args:
9
    - index: 1
10
      type: "int"
11
    - index: 2
12
      type: "int"
13
    - index: 3
14
      type: "int"
15
    selectors:
16
    - matchArgs:
17
      - index: 2
18
        operator: "Equal"
19
        values:
20
        - "21"  # CAP_SYS_ADMIN

1
#include "vmlinux.h"
2
#include <bpf/bpf_helpers.h>
3

4
struct event {
5
    u32 pid;
6
    u32 ppid;
7
    char comm[16];
8
    char filename[256];
9
    u8 type;  // 0=exec, 1=fork, 2=exit
10
};
11

12
struct {
13
    __uint(type, BPF_MAP_TYPE_RINGBUF);
14
    __uint(max_entries, 256 * 1024);
15
} events SEC(".maps");
16

17
// 追踪进程执行
18
SEC("tracepoint/sched/sched_process_exec")
19
int trace_exec(struct trace_event_raw_sched_process_template *ctx)
20
{
21
    struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
22
    if (!e) return 0;
23

24
    e->type = 0;
25
    e->pid = bpf_get_current_pid_tgid() >> 32;
26
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
27

28
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
29
    e->ppid = BPF_CORE_READ(task, real_parent, pid);
30

31
    bpf_ringbuf_submit(e, 0);
32
    return 0;
33
}
34

35
// 追踪进程退出
36
SEC("tracepoint/sched/sched_process_exit")
37
int trace_exit(struct trace_event_raw_sched_process_template *ctx)
38
{
39
    struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
40
    if (!e) return 0;
41

42
    e->type = 2;
43
    e->pid = bpf_get_current_pid_tgid() >> 32;
44
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
45

46
    bpf_ringbuf_submit(e, 0);
47
    return 0;
48
}
49

50
char LICENSE[] SEC("license") = "GPL";

1
# 追踪所有进程执行
2
sudo bpftrace -e 'tracepoint:sched:sched_process_exec {
3
    printf("EXEC: pid=%d comm=%s\n", pid, comm);
4
}'
5

6
# 追踪特权操作
7
sudo bpftrace -e 'kprobe:cap_capable {
8
    if (arg2 == 21)  // CAP_SYS_ADMIN
9
        printf("CAP_SYS_ADMIN: pid=%d comm=%s\n", pid, comm);
10
}'
11

12
# 追踪网络连接
13
sudo bpftrace -e 'tracepoint:syscalls:sys_enter_connect {
14
    printf("CONNECT: pid=%d comm=%s\n", pid, comm);
15
}'

1
# 检查内核是否支持 LSM BPF
2
cat /sys/kernel/security/lsm
3
# 输出应包含 "bpf"
4

5
# 如果不包含，需要添加内核参数
6
# GRUB_CMDLINE_LINUX="lsm=lockdown,yama,integrity,apparmor,bpf"

1
# 快速部署
2
kubectl apply -f https://raw.githubusercontent.com/cilium/tetragon/main/install/kubernetes/tetragon.yaml
3

4
# 查看实时事件
5
kubectl exec -n kube-system ds/tetragon -- tetra getevents -o compact