tetragon: detect execve of anonymous binaries #499

tixxdz · 2022-10-20T17:14:06Z

Detect execution of anonymous binaries, these are binaries that are not linked on a filesystem, where nlink is zero.

An anonymous shared memory file
https://man7.org/linux/man-pages/man7/shm_overview.7.html.
An anonymous file obtained with memfd API
https://man7.org/linux/man-pages/man2/memfd_create.2.html.
Or it was deleted from the file system.

"process_exec": {
   "process": {
      "binary_properties": {
        "file": {
           "inode": {
              "number": "182698",
              "links": 0
            }
         }
      }
   }
}

bpf/process/bpf_execve_bprm_check.c

jrfastab · 2022-10-21T18:25:13Z

Other than comment about pid for map key. LGTM.

tixxdz · 2022-10-22T22:46:41Z

Other than comment about pid for map key. LGTM.

Ok updated fixed all, but also removed that empty "info": {} , now entries that don't have: "inode.initialized == 1 && inode.nlinks == 0" will not have any displayed info field.

{
  "process_exec": {
    "process": {
      "exec_id": "OjYwMjQ1NTcxNTg2MDU6MTA5MzY2",
      "pid": 109366,
      "uid": 1000,
      "cwd": "/home/tixxdz/work/station/code/src/github.com/tixxdz/tetragon",
      "binary": "/proc/self/fd/3",
      "flags": "execve",
      "start_time": "2022-10-22T22:22:13.554073460Z",
      "auid": 1000,
      "parent_exec_id": "OjYwMjQ1NTYwNjA2ODI6MTA5MzY2",
      "info": {
        "inode": {
          "deleted": true
        }
      }
    },
    "parent": {
      "exec_id": "OjYwMjQ1NTYwNjA2ODI6MTA5MzY2",
      "pid": 109366,
      "uid": 1000,
      "cwd": "/home/tixxdz/work/station/code/src/github.com/tixxdz/tetragon",
      "binary": "/usr/bin/memfdloader",
      "arguments": "/bin/true",
      "flags": "execve clone",
      "start_time": "2022-10-22T22:22:13.552976581Z",
      "auid": 1000,
      "parent_exec_id": "OjExMjc0MDAwMDAwMDA6MTA0MTU=",
      "refcnt": 2
    }
  },
  "time": "2022-10-22T22:22:13.554073906Z"
}

pkg/sensors/exec/exec_test.go

bpf/process/bpf_execve_event.c

tixxdz · 2022-11-30T11:12:30Z

Don't merge yet, I will convert it to follow base execve v6.0 kernel versions

kkourt · 2022-12-12T12:35:43Z

Don't merge yet, I will convert it to follow base execve v6.0 kernel versions

Moving to draft, then. Thanks!

tixxdz · 2023-03-17T10:48:24Z

This pr introduces:

"process_exec": {
    "process": {
      "info": {
        "inode": {
          "deleted": true
        }
      }

The info is meant to be generic type that includes extra fields about the process context, and it can be easily filtered out from output by process_exec.process.info so users won't see it; also only set when the inode.delete==true.

However after some thinking and in context of integrity measurement, and also given how we correlate the process_exec to a container/pod by tracking pids<=>cgroups<=>container/pod , it seems we should include more information about the file system information inside the process_exec.
As an example a container could execute a good measurement that belongs to another scope (another container, host). Including more fs information should help users to track back and correlate the necessary fs and mount information. Simply adding an inode won't help here, it is too simplistic...

Better plan this in a long term; so we can include in the process_exec:

more info about the file system
mount ids so we correlate the execution against the mounts of host, container => then mark the execution a scope (outside of container)
File measurement digest
Appraising the file measurement and mark a boolean field good or bad
Inode related information , including the information that is being offered by this PR
This all should be better planned.

netlify · 2024-01-18T17:33:16Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`00701c9`
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/65b24cb50c8962000864665f
😎 Deploy Preview	https://deploy-preview-499--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

tixxdz · 2024-01-18T17:38:04Z

After we have introduced the binary_properties let's use this to put the new "file" that's FileProperties and its inode information if the executed binary is anonymous.

Update:
Detect execution of anonymous binaries, these are binaries that are not linked on a filesystem, where nlink is zero.

An anonymous shared memory file
https://man7.org/linux/man-pages/man7/shm_overview.7.html.
An anonymous file obtained with memfd API
https://man7.org/linux/man-pages/man2/memfd_create.2.html.
Or it was deleted from the file system.

"process_exec": {
   "process": {
      "binary_properties": {
        "file": {
           "inode": {
              "number": "182698",
              "links": 0
            }
         }
      }
   }
}

tixxdz · 2024-01-18T17:38:28Z

Reviving this

api/v1/tetragon/tetragon.proto

bpf/process/bpf_execve_bprm_commit_creds.c

tpapagian · 2024-01-24T08:51:25Z

pkg/sensors/exec/exec_test.go

+				WithBinaryProperties(ec.NewBinaryPropertiesChecker().
+					WithFile(ec.NewFilePropertiesChecker().
+						WithInode(ec.NewInodeChecker().
+							WithLinks(0),


Inode would be != 0 here, right? Does it make sense to check that as well? As we have an fd to that, a variant of stat should do that. I haven't tested it but I believe that it should work.

Indeed makes sense ;-)

pkg/sensors/exec/exec_test.go

tpapagian · 2024-01-24T08:58:21Z

Thanks! I have added some comments. Nothing very difficult to change, but good to have these as well before merging.

tixxdz · 2024-01-24T17:35:05Z

Thanks! I have added some comments. Nothing very difficult to change, but good to have these as well before merging.

@tpapagian much appreciated for the review ;-) ! all comments handled , let's see if green

tpapagian

Other than a small comment, this LGTM. Thanks!

pkg/sensors/exec/exec_test.go

This will reference the kernel 'file'. We will use it for the proces_exec.binary_properties to report the executed file and its inode in case the binary is: 1. An anonymous shared memory file https://man7.org/linux/man-pages/man7/shm_overview.7.html. 2. An anonymous file obtained with memfd API https://man7.org/linux/man-pages/man2/memfd_create.2.html. 3. Or it was deleted from the file system. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

We pass the binary inode information in case the binary is not linked or anonymous. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

This is the case of: 1. An anonymous shared memory file https://man7.org/linux/man-pages/man7/shm_overview.7.html. 2. An anonymous file obtained with memfd API https://man7.org/linux/man-pages/man2/memfd_create.2.html. 3. Or it was deleted from the file system. Example event: "process_exec": { "process": { "binary_properties": { "file": { "inode": { "number": "182698", "links": 0 } } } } } Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

This tests if the execution of memfd is catched by binary_properties.file.inode.links = 0 Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

This detects execution of deleted binaries. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

tixxdz requested a review from a team as a code owner October 20, 2022 17:14

tixxdz requested review from kevsecurity and jrfastab October 20, 2022 17:14

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from 35a558f to e00a126 Compare October 21, 2022 16:11

jrfastab reviewed Oct 21, 2022

View reviewed changes

bpf/process/bpf_execve_bprm_check.c Outdated Show resolved Hide resolved

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch 2 times, most recently from 79a754d to f93d878 Compare October 22, 2022 22:33

kkourt reviewed Oct 31, 2022

View reviewed changes

pkg/sensors/exec/exec_test.go Outdated Show resolved Hide resolved

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from 21301ee to 04e5c89 Compare October 31, 2022 17:31

kkourt reviewed Nov 2, 2022

View reviewed changes

bpf/process/bpf_execve_event.c Outdated Show resolved Hide resolved

bpf/process/bpf_execve_event.c Outdated Show resolved Hide resolved

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch 2 times, most recently from 2542c08 to d61d1f9 Compare November 9, 2022 10:50

kkourt added the needs-rebase This PR needs to be rebased because it has merge conflicts. label Nov 23, 2022

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from d61d1f9 to 25d52f2 Compare November 25, 2022 15:40

tixxdz removed the needs-rebase This PR needs to be rebased because it has merge conflicts. label Nov 25, 2022

tixxdz mentioned this pull request Nov 30, 2022

tetragon: base execve sensor improvements #570

Closed

2 tasks

kkourt marked this pull request as draft December 12, 2022 12:35

alban mentioned this pull request Aug 2, 2023

[RFE] trace exec: add new fields for: from memfd, upper layer, writable, unlinked inspektor-gadget/inspektor-gadget#1913

Closed

6 tasks

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from 25d52f2 to 2f26be8 Compare January 18, 2024 17:32

tixxdz added the release-note/major This PR introduces major new functionality label Jan 18, 2024

tixxdz changed the title ~~tetragon: detect execve of unlinked inodes~~ tetragon: detect execve of anonymous binaries Jan 18, 2024

tixxdz marked this pull request as ready for review January 18, 2024 17:39

tixxdz requested a review from tpapagian January 22, 2024 08:59

tpapagian reviewed Jan 24, 2024

View reviewed changes

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from 2f26be8 to f63d488 Compare January 24, 2024 17:34

tpapagian approved these changes Jan 25, 2024

View reviewed changes

pkg/sensors/exec/exec_test.go Outdated Show resolved Hide resolved

tixxdz added 5 commits January 25, 2024 12:49

bpf: support passing binary inode information

123183e

We pass the binary inode information in case the binary is not linked or anonymous. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

tests: add tests to check exec of deleted inodes

c973bec

This tests if the execution of memfd is catched by binary_properties.file.inode.links = 0 Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

tests: exec an unlinked fd through fexecve

00701c9

This detects execution of deleted binaries. Signed-off-by: Djalal Harouni <tixxdz@gmail.com>

tixxdz force-pushed the pr/tixxdz/execve-unlinked-inodes branch from f63d488 to 00701c9 Compare January 25, 2024 11:57

tixxdz merged commit 1f92a2f into main Jan 25, 2024
42 checks passed

tixxdz deleted the pr/tixxdz/execve-unlinked-inodes branch January 25, 2024 14:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

tetragon: detect execve of anonymous binaries #499

tetragon: detect execve of anonymous binaries #499

tixxdz commented Oct 20, 2022 •

edited

Loading

jrfastab commented Oct 21, 2022

tixxdz commented Oct 22, 2022

tixxdz commented Nov 30, 2022

kkourt commented Dec 12, 2022

tixxdz commented Mar 17, 2023

netlify bot commented Jan 18, 2024 •

edited

Loading

tixxdz commented Jan 18, 2024

tixxdz commented Jan 18, 2024

tpapagian Jan 24, 2024

tixxdz Jan 24, 2024

tpapagian commented Jan 24, 2024

tixxdz commented Jan 24, 2024

tpapagian left a comment

tetragon: detect execve of anonymous binaries #499

tetragon: detect execve of anonymous binaries #499

Conversation

tixxdz commented Oct 20, 2022 • edited Loading

jrfastab commented Oct 21, 2022

tixxdz commented Oct 22, 2022

tixxdz commented Nov 30, 2022

kkourt commented Dec 12, 2022

tixxdz commented Mar 17, 2023

netlify bot commented Jan 18, 2024 • edited Loading

✅ Deploy Preview for tetragon ready!

tixxdz commented Jan 18, 2024

tixxdz commented Jan 18, 2024

tpapagian Jan 24, 2024

Choose a reason for hiding this comment

tixxdz Jan 24, 2024

Choose a reason for hiding this comment

tpapagian commented Jan 24, 2024

tixxdz commented Jan 24, 2024

tpapagian left a comment

Choose a reason for hiding this comment

tixxdz commented Oct 20, 2022 •

edited

Loading

netlify bot commented Jan 18, 2024 •

edited

Loading