search

exein-io / pulsar

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.
https://pulsar.sh
Other
905 stars 51 forks source link

Use bpf-helper `bpf_d_path()` when available #170

Closed MatteoNardi closed 1 year ago

MatteoNardi commented 1 year ago

The bpf-helper bpf_d_path, available since kernel 5.10, would be a better alternative to our path extraction code, as it would remove the MAX_COMPONENTS limitation.

It only works with BTF enabled eBPF programs (kfuncs would be ok, kprobes would not) and a subset of LSM hooks. See https://github.com/torvalds/linux/blob/76f598ba7d8e2bfb4855b5298caedd5af0c374a8/kernel/trace/bpf_trace.c#L936-L947

We should research if we can make use of it.

MatteoNardi commented 1 year ago

The set of "sleepable" LSM hook points is quite limited. In particular it doesn't contain the CONFIG_SECURITY_PATH hooks we use.

Even for kfuncs it's limited to the whitelisted list.