Awesome

Ebpfguard

Ebpfguard is a library for managing Linux security policies. It is based on LSM hooks, but without necessity to write any kernel modules or eBPF programs directly. It allows to write policies in Rust (or YAML) in user space.

It's based on eBPF and Aya library, but takes away the need to use them directly.

Usage example

Deny mount operation for all users.

    const BPF_MAPS_PATH: &str = "/sys/fs/bpf/example_sb_mount";

    // Create a directory where ebpfguard policy manager can store its BPF
    // objects (maps).
    std::fs::create_dir_all(BPF_MAPS_PATH)?;

    // Create a policy manager.
    let mut policy_manager = PolicyManager::new(BPF_MAPS_PATH)?;

    // Attach the policy manager to the mount LSM hook.
    let mut sb_mount = policy_manager.attach_sb_mount()?;

    // Get the receiver end of the alerts channel (for the `file_open` LSM
    // hook).
    let mut sb_mount_rx = sb_mount.alerts().await?;

    // Define policies which deny mount operations for all processes (except
    // for the specified subject, if defined).
    sb_mount
        .add_policy(SbMount {
            subject: PolicySubject::All,
            allow: false,
        })
        .await?;

    if let Some(alert) = sb_mount_rx.recv().await {
        info!(
            "sb_mount alert: pid={} subject={}",
            alert.pid, alert.subject
        );
    }

Imports and cargo file are available in example source code. For more check out examples doc.

Supported LSM hooks

LSM hooks supported by Ebpfguard are:

• bprm_check_security
• file_open
• sb_mount
• sb_remount
• sb_umount
• socket_bind
• socket_connect
• task_fix_setuid

Prerequisites

Check prerequisites doc to set up your environment.

Development

Check development doc for compillation and testing commands.

Get in touch

Thank you for using Ebpfguard. Please feel welcome to participate in the Deepfence community.

• Deepfence Community Website
• <img src="https://img.shields.io/badge/slack-@deepfence-brightgreen.svg?logo=slack"> Got a question, need some help? Find the Deepfence team on Slack
• Got a feature request or found a bug? Raise an issue

• Find out more at deepfence.io

License

Ebpfguard's userspace part is licensed under Apache License, version 2.0.

eBPF programs inside ebpfguard-ebpf directory are licensed under GNU General Public License, version 2.