Detect attacks where they happen: in the Linux kernel

probes/src/exec.bpf.c

// SPDX-License-Identifier: GPL-2.0
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

char LICENSE[] SEC("license") = "GPL";

struct event {
    u32 pid;
    u32 ppid;
    u32 uid;
    char filename[128];
};

struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024);
} events SEC(".maps");

/* Report execs that run as root. Everything else is dropped here, in the
   kernel — no ring buffer slot, no userspace wakeup, no egress, no bill. */
static __always_inline bool should_report(struct task_struct *task)
{
    return BPF_CORE_READ(task, cred, euid.val) == 0;
}

SEC("tp_btf/sched_process_exec")
int BPF_PROG(on_exec, struct task_struct *task,
             pid_t old_pid, struct linux_binprm *bprm)
{
    struct event *e;

    if (!should_report(task))
        return 0;

    e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
    if (!e)
        return 0;

    e->pid  = BPF_CORE_READ(task, tgid);
    e->ppid = BPF_CORE_READ(task, real_parent, tgid);
    e->uid  = BPF_CORE_READ(task, cred, uid.val);
    bpf_probe_read_kernel_str(e->filename, sizeof(e->filename),
                              BPF_CORE_READ(bprm, filename));

    bpf_ringbuf_submit(e, 0);
    return 0;
}

agent/src/main.rs

// Userspace half. The probe above fills a ring buffer; this drains it.
// Rust rather than C because this process runs privileged on every host —
// a use-after-free here is a root-level use-after-free.
use aya::{maps::RingBuf, programs::BtfTracePoint, Btf, EbpfLoader};
use tokio::io::{unix::AsyncFd, Interest};

#[repr(C)]
struct Event {
    pid: u32,
    ppid: u32,
    uid: u32,
    filename: [u8; 128],
}

#[tokio::main(flavor = "current_thread")]
async fn main() -> anyhow::Result<()> {
    let btf = Btf::from_sys_fs()?;
    let mut bpf = EbpfLoader::new()
        .btf(Some(&btf))
        .load(aya::include_bytes_aligned!("../../probes/exec.bpf.o"))?;

    let program: &mut BtfTracePoint = bpf.program_mut("on_exec").unwrap().try_into()?;
    program.load("sched_process_exec", &btf)?;
    program.attach()?;

    let ring = RingBuf::try_from(bpf.take_map("events").unwrap())?;
    // SAFETY: the RingBuf owns the map's fd and keeps it open, unchanged, for
    // as long as this AsyncFd lives — the contract register() asks for.
    let mut events = unsafe { AsyncFd::register_with_interest(ring, Interest::READABLE) }
        .map_err(std::io::Error::from)?;

    loop {
        // Sleep until the kernel has written something. next() on its own
        // returns None the moment the buffer is empty, which would end the
        // loop — and the agent — on the first quiet millisecond.
        let mut ready = events.readable_mut().await?;
        let ring = ready.get_inner_mut();

        while let Some(item) = ring.next() {
            // The record is raw bytes from the kernel: copy it out rather
            // than cast a reference, and cut the path at its first NUL.
            let e: Event = unsafe { std::ptr::read_unaligned(item.as_ptr().cast()) };
            let len = e.filename.iter().position(|&b| b == 0).unwrap_or(e.filename.len());

            println!(
                "{}",
                serde_json::json!({
                    "pid": e.pid,
                    "ppid": e.ppid,
                    "uid": e.uid,
                    "exe": String::from_utf8_lossy(&e.filename[..len]),
                })
            );
        }
        ready.clear_ready();
    }
}