aquasecurity / aquasecurity/tracee
Alert when a program tries to access one of Tracee's maps
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
As a security solution, Tracee should protect its own assets from being tampered by another program.
Given a program which has enough privileges (e.g. CAP_SYS_ADMIN or CAP_BPF), it can access and even alter any of Tracee's maps.
Although this kind of attack assumes an attacker which already has dangerous privileges, we can probably mitigate this attack by using one of the following LSM hooks (possibly both):
1. security_bpf (https://elixir.bootlin.com/linux/v4.18.20/source/security/security.c#L1752)
2. security_bpf_map (https://elixir.bootlin.com/linux/v4.18.20/source/security/security.c#L1756)
By attaching to security_bpf_map, we can monitor whenever a non-tracee program tries to access one of our maps and alert when such access happens
Contributor guide
Research direction
Start by reading the linked Linux security_bpf and security_bpf_map hooks and tracing how Tracee owns and identifies its maps. Define the alert behavior for access by a non-Tracee program, then verify that such access is detected without treating Tracee's own accesses as violations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100