Regarding BPF module in Ubuntu Base image
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Hi guys, really sorry that i have to post this here, but i couldnt find an ubuntu repo to ask this question.
We are enrolling defend 4 containers from Elastic Security on K8sS running on VKS 3.5. At first we had photonOS, but due to a missing LSM kernel config, which made enrolling Elastic D4C impossible, we decided to switch to Ubuntu as base image, because in our case monitoring > hardening. Now we are running into the problem that the BPF module is not loaded in the grub startup config. We try to add it in the grub config, but this is overwritten when rebooting the node.
Is there a way to bypass this, since we really need the security monitoring given the huge amount of supply chain attacks these days. Also, if there is a way to add BPF, do you guys know if this would warrent support?
Thanks in advance,
Kind regards
Reproduction steps
- install D4C
- start node
- be sad because half of D4C telemtry is missing and you still can get hacked without you knowing
...
Expected behavior
- install D4C
- start node
- be happy because D4C telemetry is complete and you know when you get hacked.
...
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The payload names no repository files or tests. Start with the Ubuntu Base image's GRUB startup configuration and the node boot path described in the reproduction steps; determine whether enabling the BPF module is supported and whether the resulting setup is covered by project support.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, linux, ubuntu
- Domain
- devops, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100