Kernel-Level Runtime Security via eBPF for Container Threat Detection

// monitor.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

// Define a common event structure for different syscalls
struct event {
    u32 host_pid;
    u32 host_ppid;
    u64 mnt_ns;
    char comm[16];
    char filename[256];
    u8 event_type; // 1 for exec, 2 for open
};

// Ring buffer for sending events to user space. This is preferred over perf buffers
// for high-throughput scenarios due to better performance and no data overwrites.
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024); // 256 KB
} rb SEC(".maps");

// Optional: a hash map to track suspicious PIDs if we were doing more complex correlation
// struct {
//     __uint(type, BPF_MAP_TYPE_HASH);
//     __uint(max_entries, 8192);
//     __type(key, u32);
//     __type(value, u8); // 1 = suspicious
// } suspicious_pids SEC(".maps");

// Force emitting struct event into the ELF.
const struct event *unused __attribute__((unused));

// Helper to get mount namespace ID for container identification
static __always_inline u64 get_mnt_ns_id(struct task_struct *task) {
#ifdef BPF_CORE_READ
    // CO-RE compatible way
    return BPF_CORE_READ(task, nsproxy, mnt_ns, ns.inum);
#else
    // Fallback for older kernels without full CO-RE/BTF
    struct nsproxy *nsproxy;
    struct mnt_namespace *mnt_ns;
    bpf_probe_read_kernel(&nsproxy, sizeof(nsproxy), &task->nsproxy);
    bpf_probe_read_kernel(&mnt_ns, sizeof(mnt_ns), &nsproxy->mnt_ns);
    return mnt_ns->ns.inum;
#endif
}

// Attach to the tracepoint for the execve syscall
SEC("tracepoint/syscalls/sys_enter_execve")
int tracepoint__sys_enter_execve(struct trace_event_raw_sys_enter* ctx) {
    struct event *e;
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();

    // Reserve space on the ring buffer for our event
    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
    if (!e) {
        return 0;
    }

    // Populate the event structure
    e->host_pid = pid;
    e->host_ppid = BPF_CORE_READ(task, real_parent, tgid);
    e->mnt_ns = get_mnt_ns_id(task);
    e->event_type = 1;

    bpf_get_current_comm(&e->comm, sizeof(e->comm));
    
    // Read the filename argument from the syscall context
    const char *filename_ptr = (const char *)ctx->args[0];
    bpf_probe_read_user_str(&e->filename, sizeof(e->filename), filename_ptr);

    // Submit the event to the ring buffer
    bpf_ringbuf_submit(e, 0);

    return 0;
}

// Attach to the tracepoint for the openat syscall
SEC("tracepoint/syscalls/sys_enter_openat")
int tracepoint__sys_enter_openat(struct trace_event_raw_sys_enter* ctx) {
    struct event *e;
    u64 id = bpf_get_current_pid_tgid();
    u32 pid = id >> 32;
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    
    // For this example, we only care about specific files.
    // In a real system, filtering should be more dynamic, perhaps via another map.
    const char *filename_ptr = (const char *)ctx->args[1];
    char filename_buf[256];
    bpf_probe_read_user_str(&filename_buf, sizeof(filename_buf), filename_ptr);

    // KERNEL-SIDE FILTERING: This is critical for performance.
    // Do not send every openat event to user space.
    if (bpf_strncmp(filename_buf, 11, "/etc/shadow") != 0 &&
        bpf_strncmp(filename_buf, 10, "/etc/hosts") != 0 &&
        bpf_strncmp(filename_buf, 11, "/etc/passwd") != 0) {
        return 0;
    }

    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
    if (!e) {
        return 0;
    }

    e->host_pid = pid;
    e->host_ppid = BPF_CORE_READ(task, real_parent, tgid);
    e->mnt_ns = get_mnt_ns_id(task);
    e->event_type = 2;
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
    bpf_probe_read_user_str(&e->filename, sizeof(e->filename), filename_ptr);

    bpf_ringbuf_submit(e, 0);

    return 0;
}

char LICENSE[] SEC("license") = "GPL";

// main.go
package main

import (
	"bytes"
	"encoding/binary"
	"errors"
	"log"
	"os"
	"os/signal"
	"syscall"

	"github.com/cilium/ebpf/link"
	"github.com/cilium/ebpf/ringbuf"
	"github.com/cilium/ebpf/rlimit"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc clang -cflags "-O2 -g -Wall -Werror" bpf monitor.c -- -I./headers

// Event represents the data structure sent from the eBPF program.
// It must match the C struct exactly.
type Event struct {
	HostPid    uint32
	HostPpid   uint32
	MntNs      uint64
	Comm       [16]byte
	Filename   [256]byte
	EventType  uint8
}

func main() {
	// Subscribe to signals for graceful shutdown.
	stopper := make(chan os.Signal, 1)
	signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)

	// Allow the eBPF loader to use locked memory.
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatal(err)
	}

	// Load pre-compiled programs and maps into the kernel.
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("loading objects: %v", err)
	}
	defer objs.Close()

	// Attach the execve tracepoint program.
	execLink, err := link.Tracepoint("syscalls", "sys_enter_execve", objs.TracepointSysEnterExecve, nil)
	if err != nil {
		log.Fatalf("attaching execve tracepoint: %v", err)
	}
	defer execLink.Close()

	// Attach the openat tracepoint program.
	openLink, err := link.Tracepoint("syscalls", "sys_enter_openat", objs.TracepointSysEnterOpenat, nil)
	if err != nil {
		log.Fatalf("attaching openat tracepoint: %v", err)
	}
	defer openLink.Close()

	log.Println("Successfully loaded and attached eBPF programs. Waiting for events...")

	// Open a reader from the ring buffer map.
	rd, err := ringbuf.NewReader(objs.Rb)
	if err != nil {
		log.Fatalf("opening ringbuf reader: %v", err)
	}
	defer rd.Close()

	// Start a goroutine to handle program shutdown.
	go func() {
		<-stopper
		log.Println("Received signal, exiting...")
		if err := rd.Close(); err != nil {
			log.Fatalf("closing ringbuf reader: %v", err)
		}
	}()

	var event Event
	for {
		record, err := rd.Read()
		if err != nil {
			if errors.Is(err, ringbuf.ErrClosed) {
				log.Println("Ring buffer closed.")
				return
			}
			log.Printf("error reading from ring buffer: %s", err)
			continue
		}

		// Parse the raw data into our Go struct.
		if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {
			log.Printf("parsing ringbuf event: %s", err)
			continue
		}

		// Apply detection logic here.
		processEvent(event)
	}
}

// processEvent is where we implement our detection logic and correlation.
func processEvent(event Event) {
	comm := string(bytes.TrimRight(event.Comm[:], "\x00"))
	filename := string(bytes.TrimRight(event.Filename[:], "\x00"))

	switch event.EventType {
	case 1: // execve
		log.Printf("[EXEC] PID: %d, PPID: %d, Comm: %s, Filename: %s, MntNS: %d",
			event.HostPid, event.HostPpid, comm, filename, event.MntNs)

		// ADVANCED LOGIC: Check if a web server process is spawning a shell.
		if (comm == "nginx" || comm == "apache2") && (filename == "/bin/sh" || filename == "/bin/bash") {
			log.Printf("*** HIGH SEVERITY ALERT: Web server '%s' (PID: %d) spawned a shell '%s' in MntNS %d ***",
				comm, event.HostPid, filename, event.MntNs)
		}
	case 2: // openat
		log.Printf("[OPEN] PID: %d, PPID: %d, Comm: %s, Filename: %s, MntNS: %d",
			event.HostPid, event.HostPpid, comm, filename, event.MntNs)
		
		// Here, you would correlate this with previous events.
		// For example, check if this PID was recently flagged for spawning a shell.
		log.Printf("*** MEDIUM SEVERITY ALERT: Process '%s' (PID: %d) accessed sensitive file '%s' in MntNS %d ***",
			comm, event.HostPid, filename, event.MntNs)
	}
}

// A struct for the aggregation map key
struct file_access_key {
    u32 pid;
    char filename[64];
};

// The aggregation map
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 10240);
    __type(key, struct file_access_key);
    __type(value, u64); // count
} file_access_counts SEC(".maps");

// Inside the openat tracepoint...
SEC("tracepoint/syscalls/sys_enter_openat")
int tracepoint__sys_enter_openat(...) {
    // ... get pid and filename ...
    struct file_access_key key = {};
    key.pid = pid;
    bpf_probe_read_user_str(&key.filename, sizeof(key.filename), filename_ptr);

    // Atomically increment the counter for this key
    u64 *count = bpf_map_lookup_elem(&file_access_counts, &key);
    if (count) {
        __sync_fetch_and_add(count, 1);
    } else {
        u64 init_val = 1;
        bpf_map_update_elem(&file_access_counts, &key, &init_val, BPF_ANY);
    }
    return 0;
}

// A map that holds references to other eBPF programs
struct {
    __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
    __uint(max_entries, 5);
    __type(key, u32);
    __type(value, u32);
} prog_array SEC(".maps");

// In the main probe...
SEC("tracepoint/syscalls/sys_enter_execve")
int main_prog(...) {
    // ... some initial checks ...

    if (is_suspicious) {
        // Jump to the program at index 0 in the prog_array map
        bpf_tail_call(ctx, &prog_array, 0);
    }
    return 0;
}

// A specialized handler for suspicious execs
SEC("tracepoint/special_handler")
int special_handler(...) {
    // ... do more detailed analysis ...
    return 0;
}