aquasecurity / aquasecurity/tracee

Alert when a program tries to access one of Tracee's maps

Open
#617 16 comments 0 reactions 0 assignees View on GitHub
area/ebpf kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

As a security solution, Tracee should protect its own assets from being tampered by another program.
Given a program which has enough privileges (e.g. CAP_SYS_ADMIN or CAP_BPF), it can access and even alter any of Tracee's maps.
Although this kind of attack assumes an attacker which already has dangerous privileges, we can probably mitigate this attack by using one of the following LSM hooks (possibly both):
1. security_bpf (https://elixir.bootlin.com/linux/v4.18.20/source/security/security.c#L1752)
2. security_bpf_map (https://elixir.bootlin.com/linux/v4.18.20/source/security/security.c#L1756)

By attaching to security_bpf_map, we can monitor whenever a non-tracee program tries to access one of our maps and alert when such access happens

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked Linux security_bpf and security_bpf_map hooks and tracing how Tracee owns and identifies its maps. Define the alert behavior for access by a non-Tracee program, then verify that such access is detected without treating Tracee's own accesses as violations.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.