深入浅出 eBPF 安全项目 Tracee

1
2
3
4
5
6
7
8
9

$  sudo docker run --name tracee-only --rm --privileged --pid=host -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -v /boot/:/boot tracee -l
System Calls:          Sets:                                    Arguments:
____________           ____                                     _________

read                   [syscalls fs fs_read_write]              (int fd, void* buf, size_t count)
write                  [syscalls fs fs_read_write]              (int fd, void* buf, size_t count)
open                   [default syscalls fs fs_file_ops]        (const char* pathname, int flags, mode_t mode)
openat                 [default syscalls fs fs_file_ops]        (int dirfd, const char* pathname, int flags, mode_t mode)
...

1

$ sudo docker run --name tracee --rm --privileged -it aquasec/tracee:latest trace

1
2

$ sudo docker run --name tracee --rm --privileged --pid=host -v  /boot:/boot:ro -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -e TINI_SUBREAPER=true aquasec/tracee
Loaded signature(s):  [TRC-1 TRC-2 TRC-3 TRC-4 TRC-5 TRC-6 TRC-7]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$ sudo docker run --name tracee --rm --privileged --pid=host -v  /boot:/boot:ro -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -e TINI_SUBREAPER=true aquasec/tracee --list
Loaded signature(s):  [TRC-1 TRC-2 TRC-3 TRC-4 TRC-5 TRC-6 TRC-7]
ID         NAME                                VERSION DESCRIPTION
TRC-1      Standard Input/Output Over Socket   0.1.0   Redirection of process's standard input/output to socket
TRC-2      Anti-Debugging                      0.1.0   Process uses anti-debugging technique to block debugger
TRC-3      Code injection                      0.1.0   Possible code injection into another process
TRC-4      Dynamic Code Loading                0.1.0   Writing to executable allocated memory region
TRC-5      Fileless Execution                  0.1.0   Executing a process from memory, without a file in the disk
TRC-6      kernel module loading               0.1.0   Attempt to load a kernel module detection
TRC-7      LD_PRELOAD                          0.1.0   Usage of LD_PRELOAD to allow hooks on process

1
2
3
4
5
6
7
8

# From https://github.com/abbat/elfexec/releases 
$ wget https://github.com/abbat/elfexec/releases/download/v0.3/elfexec.x64.glibc.xz
$ chmod u+x elfexec.x64.glib && mv ./elfexec.x64.glibc ./elfexec 
$ echo 'IyEvYmluL3NoCmVjaG8gIkhlbGxvISIK' | base64 -d|./elfexec
Hello!
$ echo 'IyEvYmluL3NoCmVjaG8gIkhlbGxvISIK' | base64 -d
#!/bin/sh
echo "Hello!"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$ sudo docker run --name tracee --rm --privileged --pid=host -v  /boot:/boot:ro -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -e TINI_SUBREAPER=true aquasec/tracee
Loaded signature(s):  [TRC-1 TRC-2 TRC-3 TRC-4 TRC-5 TRC-6 TRC-7]

*** Detection ***  
Time: 2021-09-10T09:10:25Z
Signature ID: TRC-5
Signature: Fileless Execution
Data: map[]
Command: elfexec
Hostname: VM-0-14-ubuntu

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

$ git clone --recursive https://github.com/aquasecurity/tracee.git
$ make bpf DOCKER=1  # --just-print 只是打印，编译完成后可以在 dist 目录中看到编译好的字节码程序
$ ls -hl dist/
total 7.8M
-rw-r--r-- 1 root root 3.1M Sep 10 17:22 tracee.bpf.5_4_132-1_el7_elrepo_x86_64.v0_6_1-1-gce65764.o
-rw-r--r-- 1 root root 4.7M Sep 10 17:22 tracee.bpf.core.o

# 可以通过 TRACEE_BPF_FILE 环境变量指定我们需要加载的 eBPF 程序，这里使用目录 /tmp/tracee

$ sudo docker run --name tracee --rm --privileged --pid=host -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -e TRACEE_BPF_FILE=/tmp/tracee/tracee.bpf.core.o aquasec/tracee

1

$ sudo docker run --name tracee-only --rm --privileged --pid=host -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -v /boot/:/boot tracee  --trace event=execve --output table-verbose --debug|more

1
2
3
4
5
6
7
8
9

Step 3/3 : WORKDIR /tracee
 ---> Using cache
 ---> 5e8a792b8117
Successfully built 5e8a792b8117
Successfully tagged tracee-builder:latest
docker run --rm -v /root/tracee/tracee-ebpf:./ -v /root/tracee/tracee-ebpf:/tracee/tracee-ebpf -w /tracee/tracee-ebpf --entrypoint make tracee-builder KERN_BLD_PATH=/usr/src/kernels/5.4.132-1.el7.elrepo.x86_64 KERN_SRC_PATH=build dist/tracee-ebpf VERSION=v0.6.1-1-gce65764
docker: Error response from daemon: invalid volume specification: '/root/tracee/tracee-ebpf:./': invalid mount config for type "bind": invalid mount path: './' mount path must be absolute.
See 'docker run --help'.
make: *** [dist/tracee-ebpf] Error 125

1
2

+DOCKER_BUILDER_KERN_BLD ?= $(if $(shell readlink -f $(KERN_BLD_PATH)),$(shell readlink -f $(KERN_BLD_PATH)),$(KERN_BLD_PATH))
+DOCKER_BUILDER_KERN_SRC ?= $(if $(shell readlink -f $(KERN_SRC_PATH)),$(shell readlink -f $(KERN_SRC_PATH)),$(KERN_SRC_PATH))

1
2

$ ls -hl /lib/modules/5.4.132-1.el7.elrepo.x86_64/source
lrwxrwxrwx 1 root root 5 Jul 22 15:12 /lib/modules/5.4.132-1.el7.elrepo.x86_64/source -> build

1
2

$ ls -hl /lib/modules/5.4.0-42-generic/build
lrwxrwxrwx 1 root root 39 Jul 10  2020 /lib/modules/5.4.0-42-generic/build -> /usr/src/linux-headers-5.4.0-42-generic

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

$ make docker
docker build --build-arg VERSION=v0.6.1-1-gce65764 -t tracee:latest .
Sending build context to Docker daemon  2.116GB
Step 1/16 : ARG BASE=fat
Step 2/16 : FROM golang:1.16-alpine as builder
ARG BASE=fat

FROM golang:1.16-alpine as builder
RUN apk --no-cache update && apk --no-cache add git clang llvm make gcc libc6-compat coreutils linux-headers musl-dev elfutils-dev libelf-static zlib-static
WORKDIR /tracee

// ...

make: uname: Operation not permitted
make: find: Operation not permitted
make: uname: Operation not permitted
make: /bin/sh: Operation not permitted
mkdir -p dist
make: mkdir: Operation not permitted
make: *** [Makefile:51: dist] Error 127
The command '/bin/sh -c make build VERSION=$VERSION' returned a non-zero code: 2
make: *** [docker] Error 2

1
2

-FROM golang:1.16-alpine as builder
+FROM golang:1.16-alpine3.13 as builder

1
2
3
4
5

# docker run --name tracee --rm --privileged -v /lib/modules/:/lib/modules/:ro -v /usr/src:/usr/src:ro -v /tmp/tracee:/tmp/tracee -it aquasec/tracee:latest
2021/09/07 02:46:41 [INFO]  : Enabled Outputs :
2021/09/07 02:46:41 [INFO]  : Falco Sidekick is up and listening on port 2801
failed to add kprobe 'p:kprobes/psecurity_file_open security_file_open': -17
failed to create kprobe event: -17

1
2
3
4
5
6
7

$ cat /sys/kernel/debug/tracing/kprobe_events
p:kprobes/psecurity_mmap_addr security_mmap_addr
p:kprobes/psecurity_file_mprotect security_file_mprotect
p:kprobes/psecurity_bprm_check security_bprm_check
p:kprobes/pcap_capable cap_capable
p:kprobes/psecurity_inode_unlink security_inode_unlink
p:kprobes/psecurity_file_open security_file_open

1
2
3
4
5

btf_dump.c: In function ‘btf_dump_dump_type_data.isra.24’:
btf_dump.c:2266:5: error: ‘err’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
  if (err < 0)
     ^
cc1: all warnings being treated as errors

1
2
3
4
5
6

// ... 
GOOS=linux GOARCH=amd64 CC=clang CGO_CFLAGS="-I /tracee/tracee-ebpf/dist/libbpf/usr/include" CGO_LDFLAGS="/tracee/tracee-ebpf/dist/libbpf/libbpf.a" go build -tags netgo -v -o dist/tracee-ebpf \
-ldflags "-w -extldflags \"\"-X main.version=v0.6.1-1-gce65764"
go: github.com/aquasecurity/[email protected]: Get "https://proxy.golang.org/github.com/aquasecurity/libbpfgo/@v/v0.2.1-libbpf-0.4.0.mod": dial tcp 142.251.42.241:443: i/o timeout
make: *** [Makefile:59: dist/tracee-ebpf] Error 1
make: *** [dist/tracee-ebpf] Error 2

1

$ docker run --rm -v /usr/src/kernels:/usr/src/kernels/ -v /root/tracee/tracee-ebpf:/tracee/tracee-ebpf -w /tracee/tracee-ebpf --entrypoint make tracee-builder DOCKER_BUILDER_KERN_SRC=/usr/src/kernels/5.4.132-1.el7.elrepo.x86_64 KERN_SRC_PATH=/lib/modules/5.4.132-1.el7.elrepo.x86_64/source KERN_BLD_PATH=/usr/src/kernels/5.4.132-1.el7.elrepo.x86_64 KERN_SRC_PATH=/usr/src/kernels/5.4.132-1.el7.elrepo.x86_64 dist/tracee-ebpf VERSION=v0.6.1-1-gce65764  GOPROXY=https://goproxy.cn

1
2
3
4
5

-go_env := GOOS=linux GOARCH=$(ARCH:x86_64=amd64) CC=$(CMD_CLANG) CGO_CFLAGS="-I $(abspath $(LIBBPF_HEADERS))" CGO_LDFLAGS="$(abspath $(LIBBPF_OBJ))"
+go_env := GOOS=linux GOARCH=$(ARCH:x86_64=amd64) CC=$(CMD_CLANG) CGO_CFLAGS="-I $(abspath $(LIBBPF_HEADERS))" CGO_LDFLAGS="$(abspath $(LIBBPF_OBJ))" GOPROXY=https://goproxy.cn

-	--entrypoint make $(DOCKER_BUILDER) KERN_BLD_PATH=$(DOCKER_BUILDER_KERN_BLD) KERN_SRC_PATH=$(DOCKER_BUILDER_KERN_SRC) $(1)
+	--entrypoint make $(DOCKER_BUILDER) DOCKER_BUILDER_KERN_SRC=$(DOCKER_BUILDER_KERN_SRC) KERN_SRC_PATH=$(KERN_SRC_PATH) KERN_BLD_PATH=$(DOCKER_BUILDER_KERN_BLD) GOPROXY=https://goproxy.cn KERN_SRC_PATH=$(DOCKER_BUILDER_KERN_SRC) $(1)