KRIe

KRIe 是一个研究项目，旨在通过 eBPF 检测 Linux 内核漏洞利用。KRIe 远非万无一失的策略：从 eBPF 相关的限制到可能依赖被攻破内核来发出安全事件的后利用检测，显然，一个动机明确的攻击者最终能够绕过它。尽管如此，该项目的目标是让攻击者的日子更难过，并最终阻止现成的漏洞利用在易受攻击的内核上生效。

KRIe 使用 CO-RE（一次编译，到处运行）开发，因此兼容大量内核版本。如果你的内核未导出 BTF 调试信息，KRIe 将尝试从 BTFHub 自动下载。如果你的内核在 BTFHub 上不可用，但你已经能够手动生成内核的 BTF 数据，你可以在配置文件中提供它（见下文）。

系统要求

本项目在 Ubuntu Focal 20.04（Linux 内核 5.15）上开发，并已在更早的版本（如 Ubuntu Bionic 18.04，Linux 内核 4.15）上测试。

golang 1.18+
（可选）内核头文件应安装在 lib/modules/$(uname -r) 中，否则请更新 Makefile 中的位置。
（可选）clang 和 llvm 14.0.6+

可选字段仅在重新编译 eBPF 程序时需要。

构建

由于 KRIe 使用 CO-RE 构建，你通常不需要重新编译 eBPF 程序。不过，如果你仍然想重新编译 eBPF 程序，可以使用以下命令：

# ~ make build-ebpf

构建 KRIE，运行：

# ~ make build

安装 KRIE（复制到 /usr/bin/krie），运行：

# ~ make install

快速开始

KRIe 需要以 root 身份运行。运行 sudo krie -h 获取帮助。

# ~ krie -h
Usage:
  krie [flags]

Flags:
      --config string   KRIe config file (default "./cmd/krie/run/config/default_config.yaml")
  -h, --help            help for krie

配置

## Log level, options are: panic, fatal, error, warn, info, debug or trace
log_level: debug

## JSON output file, leave empty to disable JSON output.
output: "/tmp/krie.json"

## BTF information for the current kernel in .tar.xz format (required only if KRIE isn't able to locate it by itself)
vmlinux: ""

## events configuration
events:
  ## action taken when an init_module event is detected
  init_module: log

  ## action taken when an delete_module event is detected
  delete_module: log

  ## action taken when a bpf event is detected
  bpf: log

  ## action taken when a bpf_filter event is detected
  bpf_filter: log

  ## action taken when a ptrace event is detected
  ptrace: log

  ## action taken when a kprobe event is detected
  kprobe: log

  ## action taken when a sysctl event is detected
  sysctl:
    action: log

    ## Default settings for sysctl programs (kernel 5.2+ only)
    sysctl_default:
      block_read_access: false
      block_write_access: false

    ## Custom settings for sysctl programs (kernel 5.2+ only)
    sysctl_parameters:
      kernel/yama/ptrace_scope:
        block_write_access: true
      kernel/ftrace_enabled:
        override_input_value_with: "1\n"

  ## action taken when a hooked_syscall_table event is detected
  hooked_syscall_table: log

  ## action taken when a hooked_syscall event is detected
  hooked_syscall: log

  ## kernel_parameter event configuration
  kernel_parameter:
    action: log
    periodic_action: log
    ticker: 1 # sends at most one event every [ticker] second(s)
    list:
      - symbol: system/kprobes_all_disarmed
        expected_value: 0
        size: 4
      #      - symbol: system/selinux_state
      #        expected_value: 256
      #        size: 2

      # sysctl
      - symbol: system/ftrace_dump_on_oops
        expected_value: 0
        size: 4
      - symbol: system/kptr_restrict
        expected_value: 0
        size: 4
      - symbol: system/randomize_va_space
        expected_value: 2
        size: 4
      - symbol: system/stack_tracer_enabled
        expected_value: 0
        size: 4
      - symbol: system/unprivileged_userns_clone
        expected_value: 0
        size: 4
      - symbol: system/unprivileged_userns_apparmor_policy
        expected_value: 1
        size: 4
      - symbol: system/sysctl_unprivileged_bpf_disabled
        expected_value: 1
        size: 4
      - symbol: system/ptrace_scope
        expected_value: 2
        size: 4
      - symbol: system/sysctl_perf_event_paranoid
        expected_value: 2
        size: 4
      - symbol: system/kexec_load_disabled
        expected_value: 1
        size: 4
      - symbol: system/dmesg_restrict
        expected_value: 1
        size: 4
      - symbol: system/modules_disabled
        expected_value: 0
        size: 4
      - symbol: system/ftrace_enabled
        expected_value: 1
        size: 4
      - symbol: system/ftrace_disabled
        expected_value: 0
        size: 4
      - symbol: system/sysctl_protected_fifos
        expected_value: 1
        size: 4
      - symbol: system/sysctl_protected_hardlinks
        expected_value: 1
        size: 4
      - symbol: system/sysctl_protected_regular
        expected_value: 2
        size: 4
      - symbol: system/sysctl_protected_symlinks
        expected_value: 1
        size: 4
      - symbol: system/sysctl_unprivileged_userfaultfd
        expected_value: 0
        size: 4

  ## action to check when a register_check fails on a sensitive kernel space hook point
  register_check: log

文档

KRIe 的第一个版本在 BlackHat 2022 的简报中公布：Return to Sender - Detecting Kernel Exploits with eBPF

许可证

Golang 代码采用 Apache 2.0 许可证。
eBPF 程序采用 GPL v2 许可证。

krie

最受欢迎

KRIe

系统要求

构建

快速开始

配置

文档

许可证