block-copyfail

# 1. تحقق من تفعيل BPF LSM (RHEL CoreOS 9.8 مفعّل افتراضيًا)
oc debug node/<any-node> -- chroot /host cat /sys/kernel/security/lsm
# يجب أن يحتوي على "bpf"

# 2. انشر مساحة الاسم وامنح SCC المميز
oc apply -f daemonset.yaml

# 3. ستبدأ حاويات DaemonSet تلقائيًا على جميع العقد

# 4. تحقق
oc get pods -n block-copyfail     # يجب أن تظهر جميع العقد كـ Running
oc logs -n block-copyfail -l app=block-copyfail
# المتوقع: "block-copyfail: blocker active — all AF_ALG AEAD binds blocked"

oc apply -f test

oc wait pod/cve-test -n cve-2026-31431-test \
  --for=jsonpath='{.status.phase}'=Succeeded --timeout=120s
oc -n cve-2026-31431-test logs -l app=cve-2026-31431-test

=== CVE-2026-31431 Vulnerability Test ===
Target: /usr/bin/su

Original SHA256: 8969560ae8e6e21c6184c1451f59418822ee69dd5d946d71987b55236bbc0feb
Attempting splice + AF_ALG page-cache corruption (160 bytes in 40 chunks)...
After SHA256:    30b0f5b5a054c4df65b48ca792863bf7054b4d793f15f57163792ba6c2b151ae

PAGE CACHE CORRUPTION: YES - /usr/bin/su was modified in the page cache

Attempting to execute corrupted /usr/bin/su ...
  exit code: 0

RESULT: PARTIALLY MITIGATED
  Page-cache corruption succeeded (kernel is vulnerable)
  Privilege escalation blocked (allowPrivilegeEscalation=false)

oc delete namespace cve-2026-31431-test

oc debug node/<any-node> -- chroot /host cat /sys/kernel/security/lsm

lockdown,capability,landlock,yama,selinux,bpf

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: 99-enable-bpf-lsm
spec:
  kernelArguments:
    - lsm=lockdown,capability,selinux,bpf

oc apply -f daemonset.yaml

oc get pods -n block-copyfail -o wide

NAME                   READY   STATUS    AGE   NODE
block-copyfail-2jhzf   1/1     Running   34s   ci-...-master-2
block-copyfail-4dfq7   1/1     Running   34s   ci-...-master-1
block-copyfail-c2ts8   1/1     Running   34s   ci-...-worker-c
block-copyfail-ctblk   1/1     Running   34s   ci-...-worker-a
block-copyfail-m26sx   1/1     Running   34s   ci-...-worker-b
block-copyfail-xsh6d   1/1     Running   34s   ci-...-master-0

oc logs -n block-copyfail -l app=block-copyfail

block-copyfail: blocker active — all AF_ALG AEAD binds blocked

=== CVE-2026-31431 Vulnerability Test ===
Target: /usr/bin/su

Original SHA256: 30b0f5b5a054c4df65b48ca792863bf7054b4d793f15f57163792ba6c2b151ae
Attempting splice + AF_ALG page-cache corruption (160 bytes in 40 chunks)...
  AF_ALG bind failed: [Errno 1] Operation not permitted

RESULT: CANNOT TEST - AF_ALG or splice not available/permitted

oc logs -n block-copyfail -l app=block-copyfail

block-copyfail: blocker active — all AF_ALG AEAD binds blocked
block-copyfail: BLOCKED pid=16777    comm=python3 time=2026-05-01 16:37:23

oc debug node/<any-node> -- chroot /host python3 -c "
import socket
tests = [
    ('aead',     'gcm(aes)'),
    ('aead',     'ccm(aes)'),
    ('aead',     'rfc4106(gcm(aes))'),
    ('hash',     'sha256'),
    ('skcipher', 'cbc(aes)'),
    ('aead',     'authencesn(hmac(sha256),cbc(aes))'),
]
for t, n in tests:
    s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
    try:
        s.bind((t, n))
        print(f'  ALLOWED  {t}/{n}')
    except OSError as e:
        print(f'  BLOCKED  {t}/{n} -- {e}')
    finally:
        s.close()
"

  BLOCKED  aead/gcm(aes) -- [Errno 1] Operation not permitted
  BLOCKED  aead/ccm(aes) -- [Errno 1] Operation not permitted
  BLOCKED  aead/rfc4106(gcm(aes)) -- [Errno 1] Operation not permitted
  ALLOWED  hash/sha256
  ALLOWED  skcipher/cbc(aes)
  BLOCKED  aead/authencesn(hmac(sha256),cbc(aes)) -- [Errno 1] Operation not permitted

block-copyfail/
  block_copyfail.bpf.c     # برنامج نواة BPF (خطاف LSM)
  block_copyfail.c          # محمل مساحة المستخدم (هيكل libbpf)
  block_copyfail.h          # هيكل الأحداث المشترك
  Makefile                  # خط أنابيب البناء
  Dockerfile                # بناء متعدد المراحل
  daemonset.yaml            # مساحة الاسم + ملف DaemonSet
  trigger-test.py           # سكربت تحقق سريع

cd block-copyfail/
podman build -t quay.io/<org>/block-copyfail:latest .
podman push quay.io/<org>/block-copyfail:latest

oc delete -f daemonset.yaml
# أو
oc delete namespace block-copyfail