vmware / vmware/photon

Regarding BPF module in Ubuntu Base image

Open
#1,652 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C
Stars
3.2k
Forks
692
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

Hi guys, really sorry that i have to post this here, but i couldnt find an ubuntu repo to ask this question.

We are enrolling defend 4 containers from Elastic Security on K8sS running on VKS 3.5. At first we had photonOS, but due to a missing LSM kernel config, which made enrolling Elastic D4C impossible, we decided to switch to Ubuntu as base image, because in our case monitoring > hardening. Now we are running into the problem that the BPF module is not loaded in the grub startup config. We try to add it in the grub config, but this is overwritten when rebooting the node.

Is there a way to bypass this, since we really need the security monitoring given the huge amount of supply chain attacks these days. Also, if there is a way to add BPF, do you guys know if this would warrent support?

Thanks in advance,

Kind regards

Reproduction steps
  1. install D4C
  2. start node
  3. be sad because half of D4C telemtry is missing and you still can get hacked without you knowing
    ...
Expected behavior
  1. install D4C
  2. start node
  3. be happy because D4C telemetry is complete and you know when you get hacked.
    ...
Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The payload names no repository files or tests. Start with the Ubuntu Base image's GRUB startup configuration and the node boot path described in the reproduction steps; determine whether enabling the BPF module is supported and whether the resulting setup is covered by project support.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, linux, ubuntu
Domain
devops, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.