Hey hi all, I try to implement bpf file events tab...
# ebpfs
Sunil Kahalekar
02/27/2023, 6:55 AMHey hi all, I try to implement bpf file events table. Please go through raised PR. Implementations for bpf based file events i.e inclusion of bpf_file_events table for Linux #7947. https://github.com/osquery/osquery/pull/7947
a
alessandrogario
02/27/2023, 11:59 AM
Hello Sunil, we have approved the CI runner and updated title/labels
alessandrogario
02/27/2023, 12:00 PM
Is this part of a larger effort, and is it going to be followed up by additional pull requests?
s
Sunil Kahalekar
02/27/2023, 2:25 PMthanks for your replied. I will take necessary action as required and update my PR soon.
Sunil Kahalekar
02/27/2023, 2:26 PMSame PR modification is Ok or need new additional PR.
a
alessandrogario
02/27/2023, 2:27 PM
Additional changes related to that table are good in the same PR.
alessandrogario
02/27/2023, 2:28 PM
But if there are more complex features planned for this table or future tables, it would need to be discussed in a blueprint issue first
s
Sunil Kahalekar
02/27/2023, 2:32 PMGreat I will get back to you soon. Thanks.
a
alessandrogario
02/27/2023, 2:33 PM
Elaborating more on this: it's unlikely that this can become a file integrity monitoring table comparable to file_events
alessandrogario
02/27/2023, 2:33 PM
The inotify approach performs a lot better than BPF in this specific case, since it does not need to trace many system calls
alessandrogario
02/27/2023, 2:34 PM
Through the inotify watchers, it is possible to know when a file or folder is changed in a compact way
alessandrogario
02/27/2023, 2:35 PM
With the current implementation of BPF (through the ebpfpub library, using system calls) it is not possible to trace write events without causing performance issues
s
Sunil Kahalekar
02/27/2023, 2:36 PMIt is useful for monitoring container-related file activity
a
alessandrogario
02/27/2023, 2:36 PM
The problem in practice is that everything on Linux can go through the generic write() system calls: files, network sockets, even the terminal output
alessandrogario
02/27/2023, 2:37 PM
So it would not be possible to trace much more than just the simple open() (and variants). This means that file_events is still a better choice
s
Sunil Kahalekar
02/27/2023, 2:39 PMfile_events covers docker and container file activity?
a
alessandrogario
02/27/2023, 2:40 PM
It does not, but BPF right now only has limited support for it through the ebpfpub library
alessandrogario
02/27/2023, 2:41 PM
The cgroup id (cid field) is not very useful to determine which container is doing what. it's also not possible to understand whether it's a nested container or not
alessandrogario
02/27/2023, 2:42 PM
The PR is also not compatible with containers, since the configuration function will enumerate files on disk using the host mount namespace
alessandrogario
02/27/2023, 2:43 PM
Containers however are using their own mount namespace, which is not readily accessible to the host (depending on whether the container was started before or after osquery, and on what kind of technology the container runtime is using)
alessandrogario
02/27/2023, 2:45 PM
We do have a better way to approach this (see https://github.com/osquery/osquery/pull/7773), but it's still being worked on (also, it only supports kernels >= 5.4)
alessandrogario
02/27/2023, 2:47 PM
There's a chance the kernel requirement could be lowered using external BTF files but that is something we have yet to explore
5 Views