5 ms·

EBPFGuard: a Rust Library Mitigation of Threats Using LSM Hooks

49 points by noboruma 3y ago

wyldfire 3y ago
Rust and eBPF? nice! If there were a way to get some WASM in there too it would be a truly impressive feat ;)
- df-sandman137 3y ago
  Its coming soon..
LinuxBender 3y ago
[flagged]
- nightpool 3y ago
  And you posted this because.....? You think that this person's blog is trying to steal your data from Carbon, a well known code screenshot sharing tool? What data would Carbon even have to be able to steal?
- tptacek 3y ago
  Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.
_8j50 3y ago
Linux is so weird with its approach to security. So many prevention tools and LSMs but it is the easiest platform for post exploitation. For one a lot of effort goes into stopping you from getting root but all if it revolves around the sysadmin not making one of many mistakes and even as root, instead of having a sane way of signing kernel modules by a trusted party (distro), they take great pains to make it hard to do bad stuff like preventing hooks and other things being used by LKMs. Linux security is architected by really smart figures that are mentally stuck on ideologies and silver bullets, don't get me wrong, if setup right Linux is difficult for attackers but that rarely ever happens. There are too many "well if a threat actor can do that then you have bigger problems" type of oldschool legacy thinking. What I really want in Linux is good defaults that treat users as infants playing with scisssors. Get over the whole "centralized anything is bad" b.s., and for distros to have good monitoring tools. Detection deserves more priority than prevention. Imagine having all the difficult to tune LKM rules, auditd,etc... play nice with each other and alert visually on the desktop and insist on you giving them your email or whatever so the distro managed alerting servers can alert you on stuff. On windows even when I disable defender it secretly monitors stuff and re-enables some features when it sees weird things (and MS would even alert your people if you are an enterprise customer and it is a serious threat) and it can be one of the hardesr hurdles to overcome. To fully disable defender or AV, you have to exploit a vulnerable signed driver, on linux just rm -rf stuff and unload it as root because "if they have root, you have bigger problems" Nothing against this tool, at least they seem to have detection (alerting?) in mind as well from what I skimmed.
- LinuxBender 3y ago
  What I really want in Linux is good defaults I agree with the sentiment but experience tells me that Linux would have poor adoption should that become the case. I have implemented secure defaults via OS images in different environments from Dev to Staging to Production and in all environments any mitigating control that was not specified in a customer contract was backed out eventually with exception of the PCI environment. But in spirit I agree and miss the security controls and defaults that were in OpenVMS. Those controls made it into NT but were mostly all opened up by default to improve adoption. I had the same challenges getting SELinux deployed everywhere. People that strayed far from defaults and application best practices would shake their fists at it and in some places it was set permissive. There are even non security defaults such as over-commit that were adjusted to improve adoption by developers and became the basis of OOM circular arguments across the internet.
- lima 3y ago
  What I really want in Linux is good defaults that treat users as infants playing with scisssors Sounds like you want Chromium OS :-) Fully open source, Linux-based, and it's hardened to the point where neither the user, nor an attacker, can execute any abitrary code outside a sandbox without a Chrome and/or Linux 0day. You even get VMs with seamless Wayland-based desktop integration with a normal Linux distro inside, and you can create multiple VMs if you have different security levels. If you enable crash reporting, Google will find and triage crashes for you and would quite possibly catch buggy exploits, and maybe tell you about it. But, this is very far from what most people want in a Linux distro.
- josephcsible 3y ago
  The reason I use Linux and not Windows is that I like that it doesn't work in any of the ways you want your OS to work. I want my OS to treat me like a responsible adult, not like I'm an infant running with scissors.
  - _8j50 3y ago
    That's what I mean about terrible undying ideologies plaguing Linux. I get it, I feel the same way too but what you don't get is most humans can't painstakingly configure Linux to be secure. What you end up having is something worse than Windows, a system where because you think you are "responsible" it is secure, your false sense of security as a result will cause you more harm. What I want is for Linux to have good and secure defaults that assume I am an infant with scissors but then if I want to change that and stab myself with a scissor, it lets me do so in the most efficient way possible.
nathants 3y ago
is ebpf for lsm a good idea? if i’m using custom lsm rules, i want them baked into the kernel and impossible to disable without replacing the kernel.
qubit0ne 3y ago
https://github.com/vishpat/oxidize-ebpf https://github.com/vishpat/oxidize-ebpf Some more examples of Rust and eBPF

49 points by noboruma 3y ago

wyldfire 3y ago

Rust and eBPF? nice! If there were a way to get some WASM in there too it would be a truly impressive feat ;)

df-sandman137 3y ago
Its coming soon..

LinuxBender 3y ago

[flagged]

nightpool 3y ago
And you posted this because.....? You think that this person's blog is trying to steal your data from Carbon, a well known code screenshot sharing tool? What data would Carbon even have to be able to steal?
tptacek 3y ago
Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

_8j50 3y ago

Linux is so weird with its approach to security. So many prevention tools and LSMs but it is the easiest platform for post exploitation. For one a lot of effort goes into stopping you from getting root but all if it revolves around the sysadmin not making one of many mistakes and even as root, instead of having a sane way of signing kernel modules by a trusted party (distro), they take great pains to make it hard to do bad stuff like preventing hooks and other things being used by LKMs. Linux security is architected by really smart figures that are mentally stuck on ideologies and silver bullets, don't get me wrong, if setup right Linux is difficult for attackers but that rarely ever happens. There are too many "well if a threat actor can do that then you have bigger problems" type of oldschool legacy thinking. What I really want in Linux is good defaults that treat users as infants playing with scisssors. Get over the whole "centralized anything is bad" b.s., and for distros to have good monitoring tools. Detection deserves more priority than prevention. Imagine having all the difficult to tune LKM rules, auditd,etc... play nice with each other and alert visually on the desktop and insist on you giving them your email or whatever so the distro managed alerting servers can alert you on stuff. On windows even when I disable defender it secretly monitors stuff and re-enables some features when it sees weird things (and MS would even alert your people if you are an enterprise customer and it is a serious threat) and it can be one of the hardesr hurdles to overcome. To fully disable defender or AV, you have to exploit a vulnerable signed driver, on linux just rm -rf stuff and unload it as root because "if they have root, you have bigger problems" Nothing against this tool, at least they seem to have detection (alerting?) in mind as well from what I skimmed.

LinuxBender 3y ago
What I really want in Linux is good defaults I agree with the sentiment but experience tells me that Linux would have poor adoption should that become the case. I have implemented secure defaults via OS images in different environments from Dev to Staging to Production and in all environments any mitigating control that was not specified in a customer contract was backed out eventually with exception of the PCI environment. But in spirit I agree and miss the security controls and defaults that were in OpenVMS. Those controls made it into NT but were mostly all opened up by default to improve adoption. I had the same challenges getting SELinux deployed everywhere. People that strayed far from defaults and application best practices would shake their fists at it and in some places it was set permissive. There are even non security defaults such as over-commit that were adjusted to improve adoption by developers and became the basis of OOM circular arguments across the internet.
lima 3y ago
What I really want in Linux is good defaults that treat users as infants playing with scisssors Sounds like you want Chromium OS :-) Fully open source, Linux-based, and it's hardened to the point where neither the user, nor an attacker, can execute any abitrary code outside a sandbox without a Chrome and/or Linux 0day. You even get VMs with seamless Wayland-based desktop integration with a normal Linux distro inside, and you can create multiple VMs if you have different security levels. If you enable crash reporting, Google will find and triage crashes for you and would quite possibly catch buggy exploits, and maybe tell you about it. But, this is very far from what most people want in a Linux distro.
josephcsible 3y ago
The reason I use Linux and not Windows is that I like that it doesn't work in any of the ways you want your OS to work. I want my OS to treat me like a responsible adult, not like I'm an infant running with scissors.
- _8j50 3y ago
  That's what I mean about terrible undying ideologies plaguing Linux. I get it, I feel the same way too but what you don't get is most humans can't painstakingly configure Linux to be secure. What you end up having is something worse than Windows, a system where because you think you are "responsible" it is secure, your false sense of security as a result will cause you more harm. What I want is for Linux to have good and secure defaults that assume I am an infant with scissors but then if I want to change that and stab myself with a scissor, it lets me do so in the most efficient way possible.

nathants 3y ago

is ebpf for lsm a good idea? if i’m using custom lsm rules, i want them baked into the kernel and impossible to disable without replacing the kernel.

qubit0ne 3y ago

https://github.com/vishpat/oxidize-ebpf https://github.com/vishpat/oxidize-ebpf Some more examples of Rust and eBPF