ProHoster > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > ื‘ื•ืš "BPF ืคึฟืึทืจ ืœื™ื ื•ืงืก ืžืึธื ื™ื˜ืึธืจื™ื ื’"

ื‘ื•ืš "BPF ืคึฟืึทืจ ืœื™ื ื•ืงืก ืžืึธื ื™ื˜ืึธืจื™ื ื’"

ื‘ื•ืš "BPF ืคึฟืึทืจ ืœื™ื ื•ืงืก ืžืึธื ื™ื˜ืึธืจื™ื ื’"ื”ืขืœื, ื›ืึทื‘ืจืึธ ืจืขื–ื™ื“ืึทื ืฅ! ื“ื™ BPF ื•ื•ื™ืจื˜ื•ืขืœ ืžืึทืฉื™ืŸ ืื™ื– ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืžืขืจืกื˜ ื•ื•ื™ื›ื˜ื™ืง ืงืึทืžืคึผืึธื•ื ืึทื ืฅ ืคื•ืŸ ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ. ื–ื™ื™ืŸ ื’ืขื”ืขืจื™ืง ื ื•ืฆืŸ ื•ื•ืขื˜ ืœืึธื–ืŸ ืกื™ืกื˜ืขื ืขื ื“ื–ืฉืึทื ื™ืจื– ืฆื• ื’ืขืคึฟื™ื ืขืŸ ื—ืกืจื•ื ื•ืช ืื•ืŸ ืกืึธืœื•ื•ืข ืืคื™ืœื• ื“ื™ ืžืขืจืกื˜ ืงืึธืžืคึผืœื™ืฆื™ืจื˜ ืคึผืจืึธื‘ืœืขืžืก. ืื™ืจ ื•ื•ืขื˜ ืœืขืจื ืขืŸ ื•ื•ื™ ืฆื• ืฉืจื™ื™ึทื‘ืŸ ืžื’ื™ืœื” ื•ื•ืึธืก ืžืึธื ื™ื˜ืึธืจ ืื•ืŸ ืžืึธื“ื™ืคื™ืฆื™ืจืŸ ื“ื™ ื ืึทื˜ื•ืจ ืคื•ืŸ ื“ื™ ืงืขืจืŸ, ื•ื•ื™ ืฆื• ื‘ืขืฉืึธืœืขื ื™ื ืกื˜ืจื•ืžืขื ื˜ ืงืึธื“ ืฆื• ืžืึธื ื™ื˜ืึธืจ events ืื™ืŸ ื“ื™ ืงืขืจืŸ, ืื•ืŸ ืคื™ืœ ืžืขืจ. David Calavera ืื•ืŸ Lorenzo Fontana ื•ื•ืขื˜ ื”ืขืœืคึฟืŸ ืื™ืจ ื•ืคืฉืœื™ืกืŸ ื“ื™ ืžืึทื›ื˜ ืคื•ืŸ BPF. ื™ืงืกืคึผืึทื ื“ ื“ื™ื™ืŸ ื•ื•ื™ืกืŸ ืคื•ืŸ ืคืึธืจืฉื˜ืขืœื•ื ื’ ืึทืคึผื˜ืึทืžืึทื–ื™ื™ืฉืึทืŸ, ื ืขื˜ื•ื•ืึธืจืงื™ื ื’, ื–ื™ื›ืขืจื”ื™ื™ื˜. - ื ื™ืฆืŸ BPF ืฆื• ืžืึธื ื™ื˜ืึธืจ ืื•ืŸ ืžืึธื“ื™ืคื™ืฆื™ืจืŸ ื“ื™ ื ืึทื˜ื•ืจ ืคื•ืŸ ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ. - ืึทืจื™ื™ึทื ืฉืคึผืจื™ืฆืŸ ืงืึธื“ ืฆื• ืกื™ืงื™ื•ืจืœื™ ืžืึธื ื™ื˜ืึธืจ ืงืขืจืŸ ื’ืขืฉืขืขื ื™ืฉืŸ ืึธืŸ ืจื™ืงืึธืžืคึผื™ืœืข ื“ื™ ืงืขืจืŸ ืึธื“ืขืจ ืจืขื‘ืึธืึธื˜ ื“ื™ ืกื™ืกื˜ืขื. - ื ื™ืฆืŸ ื‘ืึทืงื•ื•ืขื ืงืึธื“ ื‘ื™ื™ืฉืคื™ืœืŸ ืื™ืŸ C, Go ืึธื“ืขืจ Python. - ื ืขืžืขืŸ ืงืึธื ื˜ืจืึธืœ ื“ื•ืจืš ืึธื•ื ื™ื ื’ ื“ื™ BPF ืคึผืจืึธื’ืจืึทื ืœืขื‘ืŸ ืฆื™ืงืœ.

Linux Kernel Security, ื–ื™ื™ึทืŸ ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ืื•ืŸ ืกืขืงืึธืžืคึผ

BPF ื’ื™ื˜ ืึท ืฉื˜ืึทืจืง ื•ื•ืขื’ ืฆื• ืคืึทืจื‘ืจื™ื™ื˜ืขืจืŸ ื“ื™ ืงืขืจืŸ ืึธืŸ ืกืึทืงืจืึทืคื™ื™ืกื™ื ื’ ืคืขืกื˜ืงื™ื™ึทื˜, ื–ื™ื›ืขืจื”ื™ื™ื˜ ืึธื“ืขืจ ื’ื™ื›ืงื™ื™ึทื˜. ืคึฟืึทืจ ื“ืขื ืกื™ื‘ื”, ื“ื™ ืงืขืจืŸ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ื’ืขื“ืึทื ืง ืขืก ื•ื•ืึธืœื˜ ื–ื™ื™ืŸ ืึท ื’ื•ื˜ืข ื’ืขื“ืึทื ืง ืฆื• ื ื•ืฆืŸ ื–ื™ื™ึทืŸ ื•ื•ืขืจืกืึทื˜ื™ืœืึทื˜ื™ ืฆื• ืคึฟืึทืจื‘ืขืกืขืจืŸ ืคึผืจืึธืฆืขืก ืืคื’ืขื–ื•ื ื“ืขืจื˜ืงื™ื™ื˜ ืื™ืŸ Secomp ื“ื•ืจืš ื™ืžืคึผืœืึทืžืขื ื™ื ื’ Secomp ืคื™ืœื˜ืขืจืก ื’ืขืฉื˜ื™ืฆื˜ ื“ื•ืจืš BPF ืžื’ื™ืœื”, ืื•ื™ืš ื‘ืืงืื ื˜ ื•ื•ื™ Secomp BPF. ืื™ืŸ ื“ืขื ืงืึทืคึผื™ื˜ืœ ืžื™ืจ ื•ื•ืขืœืŸ ื“ืขืจืงืœืขืจืŸ ื•ื•ืึธืก Secommp ืื™ื– ืื•ืŸ ื•ื•ื™ ืขืก ืื™ื– ื’ืขื ื™ืฆื˜. ื“ืขืจื ืึธืš ืื™ืจ ื•ื•ืขื˜ ืœืขืจื ืขืŸ ื•ื•ื™ ืฆื• ืฉืจื™ื™ึทื‘ืŸ Secomp ืคื™ืœื˜ืขืจืก ื ื™ืฆืŸ BPF ืžื’ื™ืœื”. ื“ืขืจื ืึธืš, ืžื™ืจ ื•ื•ืขืœืŸ ืงื•ืงืŸ ืื™ืŸ ื“ื™ ื’ืขื‘ื•ื™ื˜-ืื™ืŸ BPF ื›ื•ืงืก ื•ื•ืึธืก ื–ืขื ืขืŸ ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืื™ืŸ ื“ื™ ืงืขืจืŸ ืคึฟืึทืจ ืœื™ื ื•ืงืก ื–ื™ื›ืขืจื”ื™ื™ื˜ ืžืึทื“ื–ืฉื•ืœื–.

ืœื™ื ื•ืงืก ืกืขืงื•ืจื™ื˜ื™ ืžืึธื“ื•ืœืขืก (LSM) ื–ืขื ืขืŸ ืึท ืคืจื™ื™ืžื•ื•ืขืจืง ื•ื•ืึธืก ื’ื™ื˜ ืึท ื’ืึทื ื’ ืคื•ืŸ ืคืึทื ื’ืงืฉืึทื ื– ื•ื•ืึธืก ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื ื•ืฆื˜ ืฆื• ื™ื ืกื˜ืจื•ืžืขื ื˜ ืคืึทืจืฉื™ื“ืŸ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืžืึธื“ืขืœืก ืื•ื™ืฃ ืึท ืกื˜ืึทื ื“ืขืจื“ื™ื™ื–ื“ ืฉื˜ื™ื™ื’ืขืจ. LSM ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื’ืœื™ื™ึทืš ืื™ืŸ ื“ื™ ืงืขืจืŸ ืžืงื•ืจ ื‘ื•ื™ื, ืึทื–ืึท ื•ื•ื™ ืึทืคึผืคึผืึทืจืžืึธืจ, SELinux ืื•ืŸ Tomoyo.

ืœืึธืžื™ืจ ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ ื“ื™ืกืงื•ื˜ื™ืจืŸ ื“ื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืคื•ืŸ ืœื™ื ื•ืงืก.

ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–

ื“ื™ ืขืกืึทื ืก ืคื•ืŸ ืœื™ื ื•ืงืก ืก ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืื™ื– ืึทื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื’ืขื‘ืŸ ืึทืŸ ืึทื ืคึผืจื™ื•ื•ื™ืœื™ื“ื–ืฉื“ ืคึผืจืึธืฆืขืก ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ืึท ื–ื™ื›ืขืจ ืึทืจื‘ืขื˜, ืึธื‘ืขืจ ืึธืŸ ื ื™ืฆืŸ ืกื•ื™ื“ ืคึฟืึทืจ ื“ืขื ืฆื•ื•ืขืง, ืึธื“ืขืจ ืึทื ื“ืขืจืฉ ืžืึทื›ืŸ ื“ืขื ืคึผืจืึธืฆืขืก ืคึผืจื™ื•ื•ืœื™ื“ื–ืฉื“, ืจื™ื“ื•ืกื™ื ื’ ื“ื™ ืžืขื’ืœืขื›ืงื™ื™ื˜ ืคื•ืŸ ื‘ืึทืคืึทืœืŸ ืื•ืŸ ืœืึธื–ืŸ ื“ืขื ืคึผืจืึธืฆืขืก ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ื–ื™ื›ืขืจ ื˜ืึทืกืงืก. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื•ื™ื‘ ื“ื™ื™ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื“ืึทืจืฃ ืฆื• ืขืคึฟืขื ืขืŸ ืึท ืคึผืจื™ื•ื•ืœื™ื“ื–ืฉื“ ืคึผืึธืจื˜, ื–ืึธื’ืŸ 80, ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ืœื•ื™ืคืŸ ื“ืขื ืคึผืจืึธืฆืขืก ื•ื•ื™ ื•ื•ืึธืจืฆืœ, ืื™ืจ ืงืขื ืขืŸ ืคืฉื•ื˜ ื’ืขื‘ืŸ ืขืก ื“ื™ CAP_NET_BIND_SERVICE ืคื™ื™ื™ืงื™ื™ื˜.

ื‘ืึทื˜ืจืึทื›ื˜ืŸ ืึท ื’ื™ื™ืŸ ืคึผืจืึธื’ืจืึทื ืžื™ื˜ืŸ ื ืึธืžืขืŸ main.go:

package main
import (
            "net/http"
            "log"
)
func main() {
     log.Fatalf("%v", http.ListenAndServe(":80", nil))
}

ื“ืขืจ ืคึผืจืึธื’ืจืึทื ืกืขืจื•ื•ืขืก ืึท ื”ื˜ื˜ืคึผ ืกืขืจื•ื•ืขืจ ืื•ื™ืฃ ืคึผืึธืจื˜ 80 (ื“ืึธืก ืื™ื– ืึท ืคึผืจื™ื•ื•ืœื™ื“ื–ืฉื“ ืคึผืึธืจื˜). ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ ืžื™ืจ ืœื•ื™ืคืŸ ืขืก ืžื™ื“ ื ืึธืš ื–ืึทืžืœื•ื ื’:

$ go build -o capabilities main.go
$ ./capabilities

ืึธื‘ืขืจ, ื–ื™ื ื˜ ืžื™ืจ ื’ืขื‘ืŸ ื ื™ืฉื˜ ื•ื•ืึธืจืฆืœ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–, ื“ืขืจ ืงืึธื“ ื•ื•ืขื˜ ื•ื•ืึทืจืคืŸ ืึท ื˜ืขื•ืช ื•ื•ืขืŸ ื‘ื™ื™ื ื“ื™ื ื’ ื“ื™ ืคึผืึธืจื˜:

2019/04/25 23:17:06 listen tcp :80: bind: permission denied
exit status 1

ืงืึทืคึผืฉ (ืฉืึธืœ ืคืึทืจื•ื•ืึทืœื˜ืขืจ) ืื™ื– ืึท ื’ืขืฆื™ื™ึทื’ ื•ื•ืึธืก ืœื•ื™ืคื˜ ืึท ืฉืึธืœ ืžื™ื˜ ืึท ืกืคึผืขืฆื™ืคื™ืฉ ื’ืึทื ื’ ืคื•ืŸ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–.

ืื™ืŸ ื“ืขื ืคืึทืœ, ื•ื•ื™ ืฉื•ื™ืŸ ื“ืขืจืžืื ื˜, ืึทื ืฉื˜ืึธื˜ ืฆื• ื’ืขื‘ืŸ ืคื•ืœ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜, ืื™ืจ ืงืขื ืขืŸ ื’ืขื‘ืŸ ืคึผืจื™ื•ื•ืœื™ื“ื–ืฉื“ ืคึผืึธืจื˜ ื‘ื™ื™ื ื“ื™ื ื’ ื“ื•ืจืš ืคึผืจืึทื•ื•ื™ื™ื“ื™ื ื’ ื“ื™ cap_net_bind_service ืคื™ื™ื™ืงื™ื™ื˜ ืฆื•ื–ืึทืžืขืŸ ืžื™ื˜ ืึทืœืฅ ื•ื•ืึธืก ืื™ื– ืฉื•ื™ืŸ ืื™ืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื. ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืžื™ืจ ืงืขื ืขืŸ ืึทืจื™ื™ึทื ื ืขืžืขืŸ ืื•ื ื“ื–ืขืจ ืคึผืจืึธื’ืจืึทื ืื™ืŸ ืงืึทืคึผืฉ:

# capsh --caps='cap_net_bind_service+eip cap_setpcap,cap_setuid,cap_setgid+ep' 
   --keep=1 --user="nobody" 
   --addamb=cap_net_bind_service -- -c "./capabilities"

ื–ืืœ ืก ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื“ืขื ืงืึธืœืขืงื˜ื™ื•ื• ืึท ื‘ื™ืกืœ.

  • ืงืึทืคึผืฉ - ื ื•ืฆืŸ ืงืึทืคึผืฉ ื•ื•ื™ ืึท ืฉืึธืœ.
  • โ€”caps='cap_net_bind_service+eip cap_setpcap,cap_setuid,cap_setgid+ep' - ื–ื™ื ื˜ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ื•ื™ืฉืŸ ื“ืขื ื‘ืึทื ื™ืฆืขืจ (ืžื™ืจ ื˜ืึธืŸ ื ื™ืฉื˜ ื•ื•ืขืœืŸ ืฆื• ืœื•ื™ืคืŸ ื•ื•ื™ ื•ื•ืึธืจืฆืœ), ืžื™ืจ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ cap_net_bind_service ืื•ืŸ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ืึทืงื˜ืฉืึทื•ื•ืึทืœื™ ื˜ื•ื™ืฉืŸ ื“ื™ ื‘ืึทื ื™ืฆืขืจ ืฉื™ื™ึทืŸ ืคึฟื•ืŸ ื•ื•ืึธืจืฆืœ ืฆื• ืงื™ื™ื ืขืจ, ื ื™ื™ืžืœื™ cap_setuid ืื•ืŸ cap_setgid.
  • -ืงืขืคึผ = 1 - ืžื™ืจ ื•ื•ื™ืœืŸ ืฆื• ื”ืึทืœื˜ืŸ ื“ื™ ืื™ื ืกื˜ืึทืœื™ืจืŸ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื•ื•ืขืŸ ืกื•ื•ื™ื˜ืฉื™ื ื’ ืคื•ืŸ ื“ื™ ื•ื•ืึธืจืฆืœ ื—ืฉื‘ื•ืŸ.
  • โ€” ื‘ืึทื ื™ืฆืขืจ = "ืงื™ื™ื ืขืจ" โ€” ื“ืขืจ ืกื•ืฃ ื‘ืึทื ื™ืฆืขืจ ื•ื•ืึธืก ืœื•ื™ืคืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื ื•ื•ืขื˜ ื–ื™ื™ืŸ ืงื™ื™ื ืขืจ.
  • โ€”addamb=cap_net_bind_service โ€” ืฉื˜ืขืœืŸ ื“ื™ ืงืœื™ืจื™ื ื’ ืคื•ืŸ ืคึฟืึทืจื‘ื•ื ื“ืขื ืข ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื ืึธืš ืกื•ื•ื™ื˜ืฉื™ื ื’ ืคื•ืŸ ื•ื•ืึธืจืฆืœ ืžืึธื“ืข.
  • - C "./ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–" - ื ืึธืจ ืœื•ื™ืคืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื.

ืœื™ื ื’ืงื˜ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื–ืขื ืขืŸ ืึท ืกืคึผืขืฆื™ืขืœ ืกืึธืจื˜ ืคื•ืŸ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื•ื•ืึธืก ื–ืขื ืขืŸ ื™ื ื›ืขืจืึทื˜ื™ื“ ื“ื•ืจืš ืงื™ื ื“ ืžื’ื™ืœื” ื•ื•ืขืŸ ื“ื™ ืงืจืึทื ื˜ ืคึผืจืึธื’ืจืึทื ืขืงืกืึทืงื™ื•ืฅ ื–ื™ื™ ื ื™ืฆืŸ ืขืงืกืขืงื•ื•ืข (). ื‘ืœื•ื™ื– ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื•ื•ืึธืก ื–ืขื ืขืŸ ืขืจืœื•ื™ื‘ื˜ ืฆื• ื–ื™ื™ืŸ ืคืืจื‘ื•ื ื“ืŸ, ืึธื“ืขืจ ืื™ืŸ ืื ื“ืขืจืข ื•ื•ืขืจื˜ืขืจ, ื•ื•ื™ ืกื•ื•ื™ื•ื•ืข ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–, ืงืขื ืขืŸ ื–ื™ื™ืŸ ื™ื ื›ืขืจืึทื˜ื™ื“.

ืื™ืจ ืžื™ืกื˜ืึธืžืข ื•ื•ืึทื ื“ืขืจื™ื ื’ ื•ื•ืึธืก +eip ืžื™ื˜ืœ ื ืึธืš ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืื™ืŸ ื“ื™ --caps ืึธืคึผืฆื™ืข. ื“ื™ ืคืœืึทื’ืก ื–ืขื ืขืŸ ื’ืขื ื™ืฆื˜ ืฆื• ื‘ืึทืฉืœื™ืกืŸ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜:

-ืžื•ื–ืŸ ื–ื™ื™ืŸ ืึทืงื˜ื™ื•ื•ื™ื™ื˜ื™ื“ (ืคึผ);

- ื‘ื ื™ืžืฆื ืคึฟืึทืจ ื ื•ืฆืŸ (E);

-ืงืขื ืขืŸ ื–ื™ื™ืŸ ื™ื ื›ืขืจืึทื˜ื™ื“ ื“ื•ืจืš ืงื™ื ื“ ืคึผืจืึทืกืขืกืึทื– (ืื™ืš).

ื–ื™ื ื˜ ืžื™ืจ ื•ื•ื™ืœืŸ ืฆื• ื ื•ืฆืŸ cap_net_bind_service, ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื˜ืึธืŸ ื“ืึธืก ืžื™ื˜ ื“ื™ E ืคืึธืŸ. ื“ืขืจื ืึธืš ืžื™ืจ ื•ื•ืขืœืŸ ืึธื ื”ื™ื™ื‘ืŸ ื“ื™ ืฉืึธืœ ืื™ืŸ ื“ื™ ื‘ืึทืคึฟืขืœ. ื“ืึธืก ื•ื•ืขื˜ ืœื•ื™ืคืŸ ื“ื™ ื‘ื™ื™ื ืขืจื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืื•ืŸ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืฆื™ื™ื›ืŸ ืขืก ืžื™ื˜ ื“ื™ i ืคืึธืŸ. ืฆื•ื ืกื•ืฃ, ืžื™ืจ ื•ื•ืขืœืŸ ืึทื– ื“ื™ ืฉื˜ืจื™ืš ื–ืึธืœ ื–ื™ื™ืŸ ืขื ื™ื™ื‘ืึทืœื“ (ืžื™ืจ ื”ืื‘ืŸ ื“ืึธืก ืึธืŸ ื˜ืฉืึทื ื’ื™ื ื’ ื“ื™ UID) ืžื™ื˜ ืคึผ. ืขืก ืงื•ืงื˜ ื•ื•ื™ cap_net_bind_service+eip.

ืื™ืจ ืงืขื ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ืจืขื–ื•ืœื˜ืึทื˜ ืžื™ื˜ ss. ืœืึธืžื™ืจ ืคืึทืจืงื™ืจืฆืŸ ื“ื™ ืจืขื–ื•ืœื˜ืึทื˜ ืึท ื‘ื™ืกืœ ืฆื• ืคึผืึทืกื™ืง ืื•ื™ืฃ ื“ืขื ื‘ืœืึทื˜, ืึธื‘ืขืจ ืขืก ื•ื•ืขื˜ ื•ื•ื™ื™ึทื–ืŸ ื“ื™ ืคึฟืึทืจื‘ื•ื ื“ืŸ ืคึผืึธืจื˜ ืื•ืŸ ื‘ืึทื ื™ืฆืขืจ ืฉื™ื™ึทืŸ ืื ื“ืขืจืข ื•ื•ื™ 0, ืื™ืŸ ื“ืขื ืคืึทืœ 65:

# ss -tulpn -e -H | cut -d' ' -f17-
128 *:80 *:*
users:(("capabilities",pid=30040,fd=3)) uid:65534 ino:11311579 sk:2c v6only:0

ืื™ืŸ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ ืžื™ืจ ื’ืขื•ื•ื™ื™ื ื˜ ืงืึทืคึผืฉ, ืึธื‘ืขืจ ืื™ืจ ืงืขื ืขืŸ ืฉืจื™ื™ึทื‘ืŸ ืึท ืฉืึธืœ ืžื™ื˜ ืœื™ื‘ืงืึทืคึผ. ืคึฟืึทืจ ืžืขืจ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข, ื–ืขืŸ ืžืขื ื˜ืฉ 3 libcap.

ื•ื•ืขืŸ ืฉืจื™ื™ื‘ืŸ ืžื’ื™ืœื”, ืึธืคื˜ ื“ื™ ื“ืขื•ื•ืขืœืึธืคึผืขืจ ืงืขืŸ ื ื™ืฉื˜ ื•ื•ื™ืกืŸ ืื™ืŸ ืฉื˜ื™ื™ึทื’ืŸ ืึทืœืข ื“ื™ ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ื•ื•ืึธืก ื“ื™ ืคึผืจืึธื’ืจืึทื ื“ืึทืจืฃ ืื™ืŸ ื“ื™ ืœื•ื™ืคืŸ ืฆื™ื™ื˜; ื“ืขืจืฆื•, ื“ื™ ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ืงืขืŸ ื˜ื•ื™ืฉืŸ ืื™ืŸ ื ื™ื™ึทืข ื•ื•ืขืจืกื™ืขืก.

ืฆื• ื‘ืขืกืขืจ ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื“ื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืคื•ืŸ ืื•ื ื“ื–ืขืจ ืคึผืจืึธื’ืจืึทื, ืžื™ืจ ืงืขื ืขืŸ ื ืขืžืขืŸ ื“ื™ BCC ื˜ื•ื™ื’ืขื•ื•ื“ื™ืง ื’ืขืฆื™ื™ึทื’, ื•ื•ืึธืก ืฉื˜ืขืœื˜ ื“ื™ ืงืคึผืจืึธื‘ืข ืคึฟืึทืจ ื“ื™ cap_capable ืงืขืจืŸ ืคื•ื ืงืฆื™ืข:

/usr/share/bcc/tools/capable
TIME      UID  PID   TID   COMM               CAP    NAME           AUDIT
10:12:53 0 424     424     systemd-udevd 12 CAP_NET_ADMIN         1
10:12:57 0 1103   1101   timesync        25 CAP_SYS_TIME         1
10:12:57 0 19545 19545 capabilities       10 CAP_NET_BIND_SERVICE 1

ืžื™ืจ ืงืขื ืขืŸ ื“ืขืจื’ืจื™ื™ื›ืŸ ื“ื™ ื–ืขืœื‘ืข ื–ืึทืš ื“ื•ืจืš ื ื™ืฆืŸ bpftrace ืžื™ื˜ ืึท ืื™ื™ืŸ-ืœื™ื ืขืจ ืงืคึผืจืึธื‘ืข ืื™ืŸ ื“ื™ cap_capable ืงืขืจืŸ ืคื•ื ืงืฆื™ืข:

bpftrace -e 
   'kprobe:cap_capable {
      time("%H:%M:%S ");
      printf("%-6d %-6d %-16s %-4d %dn", uid, pid, comm, arg2, arg3);
    }' 
    | grep -i capabilities

ื“ืึธืก ื•ื•ืขื˜ ืจืขื–ื•ืœื˜ืึทื˜ ืขืคึผืขืก ื•ื•ื™ ื“ื™ ืคืืœื’ืขื ื“ืข ืื•ื™ื‘ ื“ื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืคื•ืŸ ืื•ื ื“ื–ืขืจ ืคึผืจืึธื’ืจืึทื ื–ืขื ืขืŸ ืขื ื™ื™ื‘ืึทืœื“ ื ืึธืš kprobe:

12:01:56 1000 13524 capabilities 21 0
12:01:56 1000 13524 capabilities 21 0
12:01:56 1000 13524 capabilities 21 0
12:01:56 1000 13524 capabilities 12 0
12:01:56 1000 13524 capabilities 12 0
12:01:56 1000 13524 capabilities 12 0
12:01:56 1000 13524 capabilities 12 0
12:01:56 1000 13524 capabilities 10 1

ื“ื™ ืคื™ื ืคื˜ ื–ื™ื™ึทืœ ืื™ื– ื“ื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืึทื– ื“ืขืจ ืคึผืจืึธืฆืขืก ื“ืึทืจืฃ, ืื•ืŸ ื–ื™ื ื˜ ื“ืขื ืจืขื–ื•ืœื˜ืึทื˜ ื›ื•ืœืœ ื ื™ื˜-ืึธื“ื™ื˜ืข ื’ืขืฉืขืขื ื™ืฉืŸ, ืžื™ืจ ื–ืขืŸ ืึทืœืข ื ื™ื˜-ืึธื“ื™ื˜ ื˜ืฉืขืงืก ืื•ืŸ ืœืขืกืึธืฃ ื“ื™ ืคืืจืœืื ื’ื˜ ืคื™ื™ื™ืงื™ื™ื˜ ืžื™ื˜ ื“ื™ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืคืึธืŸ (ืœืขืฆื˜ืข ืื™ืŸ ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜) ืฉื˜ืขืœืŸ ืฆื• 1. Capability ืื™ื™ื ืขืจ ื•ื•ืึธืก ืžื™ืจ ื–ืขื ืขืŸ ืื™ื ื˜ืขืจืขืกื™ืจื˜ ืื™ืŸ ืื™ื– CAP_NET_BIND_SERVICE, ืขืก ืื™ื– ื“ื™ืคื™ื™ื ื“ ื•ื•ื™ ืึท ืงืขืกื™ื™ื“ืขืจื“ื™ืง ืื™ืŸ ื“ื™ ืงืขืจืŸ ืžืงื•ืจ ืงืึธื“ ืื™ืŸ ื“ืขืจ ื˜ืขืงืข ืึทืจื™ื™ึทื ื ืขืžืขืŸ/uapi/linux/ability.h ืžื™ื˜ ื™ื™ื“ืขื ืึทืคื™ื™ื“ 10:

/* Allows binding to TCP/UDP sockets below 1024 */
/* Allows binding to ATM VCIs below 32 */
#define CAP_NET_BIND_SERVICE 10<source lang="go">

ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ื–ืขื ืขืŸ ืึธืคื˜ ืขื ื™ื™ื‘ืึทืœื“ ื‘ื™ื™ ืจื•ื ื˜ื™ืžืข ืคึฟืึทืจ ืงืึทื ื˜ื™ื™ื ืขืจื– ืึทื–ืึท ื•ื•ื™ runC ืึธื“ืขืจ Docker ืฆื• ืœืึธื–ืŸ ื–ื™ื™ ืœื•ื™ืคืŸ ืื™ืŸ ืึทื ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉื“ ืžืึธื“ืข, ืึธื‘ืขืจ ื–ื™ื™ ื–ืขื ืขืŸ ื‘ืœื•ื™ื– ืขืจืœื•ื™ื‘ื˜ ื“ื™ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืฆื• ืœื•ื™ืคืŸ ืจื•ื‘ึฟ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–. ื•ื•ืขืŸ ืึท ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืจื™ืงื•ื•ื™ื™ืขืจื– ื–ื™ื›ืขืจ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–, Docker ืงืขื ืขืŸ ืฆื•ืฉื˜ืขืœืŸ ื–ื™ื™ ืžื™ื˜ --cap-add:

docker run -it --rm --cap-add=NET_ADMIN ubuntu ip link add dummy0 type dummy

ื“ืขืจ ื‘ืึทืคึฟืขืœ ื•ื•ืขื˜ ื’ืขื‘ืŸ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ ื“ื™ CAP_NET_ADMIN ืคื™ื™ื™ืงื™ื™ื˜, ืึทืœืึทื•ื™ื ื’ ืขืก ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ืึท ื ืขืฅ ืœื™ื ืง ืฆื• ืœื™ื™ื’ืŸ ื“ื™ Dummy0 ืฆื•ื‘ื™ื ื“.

ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืึธืคึผื˜ื™ื™ืœื•ื ื’ ื•ื•ื™ื™ื–ื˜ ื•ื•ื™ ืฆื• ื ื•ืฆืŸ ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ืึทื–ืึท ื•ื•ื™ ืคึฟื™ืœื˜ืจื™ืจื•ื ื’, ืึธื‘ืขืจ ื ื™ืฆืŸ ืึท ืึทื ื“ืขืจืฉ ื˜ืขื›ื ื™ืง ื•ื•ืึธืก ืึทืœืึทื•ื– ืื•ื ื“ื– ืฆื• ืคึผืจืึธื’ืจืึทืžืžืึทื˜ื™ืง ื™ื ืกื˜ืจื•ืžืขื ื˜ ืื•ื ื“ื–ืขืจ ืื™ื™ื’ืขื ืข ืคื™ืœื˜ืขืจืก.

Secomp

Secomp ืฉื˜ื™ื™ื˜ ืคึฟืึทืจ Secure Computing ืื•ืŸ ืื™ื– ืึท ื–ื™ื›ืขืจื”ื™ื™ื˜ ืฉื™ื›ื˜ืข ื™ืžืคึผืœืึทืžืขื ืึทื“ ืื™ืŸ ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ ื•ื•ืึธืก ืึทืœืึทื•ื– ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ืฆื• ืคื™ืœื˜ืขืจ ื–ื™ื›ืขืจ ืกื™ืกื˜ืขื ืจื•ืคื˜. ื›ืึธื˜ืฉ Secommp ืื™ื– ืคืึทืจื’ืœื™ื™ึทื›ืœืขืš ืื™ืŸ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื– ืฆื• ืœื™ื ื•ืงืก, ื–ื™ื™ืŸ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ืคื™ืจืŸ ื–ื™ื›ืขืจ ืกื™ืกื˜ืขื ืจื•ืคื˜ ืžืื›ื˜ ืขืก ืคื™ืœ ืžืขืจ ืคืœืขืงืกืึทื‘ืึทืœ ืงืึทืžืคึผืขืจื“ ืžื™ื˜ ื–ื™ื™.

Secomp ืื•ืŸ Linux ืคึฟืขื™ึดืงื™ื™ื˜ืŸ ื–ืขื ืขืŸ ื ื™ืฉื˜ ืžื™ื•ื˜ืฉื•ืึทืœื™ ื•ื™ืกืฉืœื™ืกื™ืง ืื•ืŸ ื–ืขื ืขืŸ ืึธืคื˜ ื’ืขื ื™ืฆื˜ ืฆื•ื–ืึทืžืขืŸ ืฆื• ื ื•ืฅ ืคื•ืŸ ื‘ื™ื™ื“ืข ืึทืคึผืจืึธื•ื˜ืฉื™ื–. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื™ืจ ื–ืืœ ื•ื•ืขืœืŸ ืฆื• ื’ืขื‘ืŸ ืึท ืคึผืจืึธืฆืขืก ื“ื™ CAP_NET_ADMIN ืคื™ื™ื™ืงื™ื™ื˜ ืึธื‘ืขืจ ื ื™ืฉื˜ ืœืึธื–ืŸ ืขืก ืฆื• ืึธื ื ืขืžืขืŸ ื›ืึธืœืขืœ ืงืึทื ืขืงืฉืึทื ื–, ื‘ืœืึทืงื™ื ื’ ื“ื™ ืึธื ื ืขืžืขืŸ ืื•ืŸ ืึธื ื ืขืžืขืŸ4 ืกื™ืกื˜ืขื ืงืึทืœืœืก.

ื“ื™ Secomp ืคึฟื™ืœื˜ืจื™ืจื•ื ื’ ืื•ืคึฟืŸ ืื™ื– ื‘ืื–ื™ืจื˜ ืื•ื™ืฃ BPF ืคื™ืœื˜ืขืจืก ืึทืคึผืขืจื™ื™ื˜ื™ื ื’ ืื™ืŸ ื“ื™ SECCOMP_MODE_FILTER ืžืึธื“ืข, ืื•ืŸ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืคึฟื™ืœื˜ืจื™ืจื•ื ื’ ืื™ื– ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื™ืŸ ื“ื™ ื–ืขืœื‘ืข ื•ื•ืขื’ ื•ื•ื™ ืคึฟืึทืจ ืคึผืึทืงื™ืฅ.

ืกืขืงืึธืžืคึผ ืคื™ืœื˜ืขืจืก ื–ืขื ืขืŸ ืœืึธื•ื“ื™ื“ ืžื™ื˜ ืคึผืจืงื˜ืœ ื“ื•ืจืš ื“ื™ PR_SET_SECCOMP ืึธืคึผืขืจืึทืฆื™ืข. ื“ื™ ืคื™ืœื˜ืขืจืก ื ืขืžืขืŸ ื“ื™ ืคืึธืจืขื ืคื•ืŸ ืึท BPF ืคึผืจืึธื’ืจืึทื ื•ื•ืึธืก ืื™ื– ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืคึฟืึทืจ ื™ืขื“ืขืจ ืกืขืงืึธืžืคึผ ืคึผืึทืงืึทื˜ ืจืขืคึผืจื™ื–ืขื ื˜ื™ื“ ื“ื•ืจืš ื“ื™ ืกืขืงืงืึธืžืคึผ_ื“ืึทื˜ืึท ืกื˜ืจื•ืงื˜ื•ืจ. ื“ื™ ืกื˜ืจื•ืงื˜ื•ืจ ื›ึผื•ืœืœ ื“ื™ ืจืขืคึฟืขืจืขื ืฅ ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ, ืึท ื˜ื™ื™ึทื˜ืœ ืฆื• ืคึผืจืึทืกืขืกืขืจ ืื™ื ืกื˜ืจื•ืงืฆื™ืขืก ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ, ืื•ืŸ ืึท ืžืึทืงืกื™ืžื•ื ืคื•ืŸ ื–ืขืงืก ืกื™ืกื˜ืขื ืจื•ืคืŸ ืึทืจื’ื•ืžืขื ื˜ืŸ, ืื•ื™ืกื’ืขื“ืจื™ืงื˜ ื•ื•ื™ uint64.

ื“ืึธืก ืื™ื– ื•ื•ื™ ื“ื™ secomp_data ืกื˜ืจื•ืงื˜ื•ืจ ืงื•ืงื˜ ื•ื•ื™ ืคึฟื•ืŸ ื“ื™ ืงืขืจืŸ ืžืงื•ืจ ืงืึธื“ ืื™ืŸ ื“ื™ linux/secomp.h ื˜ืขืงืข:

struct seccomp_data {
int nr;
      __u32 arch;
      __u64 instruction_pointer;
      __u64 args[6];
};

ื•ื•ื™ ืื™ืจ ืงืขื ืขืŸ ื–ืขืŸ ืคึฟื•ืŸ ื“ืขื ืกื˜ืจื•ืงื˜ื•ืจ, ืžื™ืจ ืงืขื ืขืŸ ืคื™ืœื˜ืขืจ ื“ื•ืจืš ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ, ื–ื™ื™ึทืŸ ืึทืจื’ื•ืžืขื ื˜ืŸ ืึธื“ืขืจ ืึท ืงืึธืžื‘ื™ื ืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ื‘ื™ื™ื“ืข.

ื ืึธืš ื‘ืืงื•ืžืขืŸ ื™ืขื“ืขืจ ืกืขืงืึธืžืคึผ ืคึผืึทืงืึทื˜, ื“ืขืจ ืคื™ืœื˜ืขืจ ืžื•ื–ืŸ ื“ื•ืจื›ืคื™ืจืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืฆื• ืžืึทื›ืŸ ืึท ืœืขืฆื˜ ื‘ืึทืฉืœื•ืก ืื•ืŸ ื–ืึธื’ืŸ ื“ื™ ืงืขืจืŸ ื•ื•ืึธืก ืฆื• ื˜ืึธืŸ ื•ื•ื™ื™ึทื˜ืขืจ. ื“ื™ ืœืขืฆื˜ ื‘ืึทืฉืœื•ืก ืื™ื– ืื•ื™ืกื’ืขื“ืจื™ืงื˜ ื“ื•ืจืš ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืฆื•ืจื™ืงืงื•ืžืขืŸ ื•ื•ืึทืœื•ืขืก (ืกื˜ืึทื˜ื•ืก ืงืึธื•ื“ื–).

- SECCOMP_RET_KILL_PROCESS - ืงื™ืœื– ื“ื™ ื’ืื ืฆืข ืคึผืจืึธืฆืขืก ื’ืœื™ื™ืš ื ืึธืš ืคื™ืœื˜ืขืจื™ื ื’ ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ื•ื•ื™ื™ึทืœ ืคื•ืŸ ื“ืขื.

- SECCOMP_RET_KILL_THREAD - ื˜ืขืจืžืึทื ื™ื™ืฅ ื“ืขื ืงืจืึทื ื˜ ืคืึธื“ืขื ื’ืœื™ื™ืš ื ืึธืš ืคื™ืœื˜ืขืจื™ื ื’ ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ื•ื•ื™ื™ึทืœ ืคื•ืŸ ื“ืขื.

- SECCOMP_RET_KILL - ืึทืœื™ืึทืก ืคึฟืึทืจ SECCOMP_RET_KILL_THREAD, ืœื™ื ืงืก ืคึฟืึทืจ ืฆื•ืจื™ืง ืงืึทืžืคึผืึทื˜ืึทื‘ื™ืœืึทื˜ื™.

- SECCOMP_RET_TRAP - ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ืคึผืจืึธื•ื›ื™ื‘ืึทื˜ืึทื“, ืื•ืŸ ื“ื™ SIGSYS (ืฉืœืขื›ื˜ ืกื™ืกื˜ืขื ืจื•ืคืŸ) ืกื™ื’ื ืึทืœ ืื™ื– ื’ืขืฉื™ืงื˜ ืฆื• ื“ื™ ืึทืจื‘ืขื˜ ื•ื•ืึธืก ืจื•ืคื˜ ืขืก.

- SECCOMP_RET_ERRNO - ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ื ื™ืฉื˜ ืขืงืกืึทืงื™ื•ื˜ืึทื“, ืื•ืŸ ื˜ื™ื™ืœ ืคื•ืŸ ื“ื™ SECCOMP_RET_DATA ืคื™ืœื˜ืขืจ ืฆื•ืจื™ืงืงื•ืžืขืŸ ื•ื•ืขืจื˜ ืื™ื– ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ืฆื• ื‘ืึทื ื™ืฆืขืจ ืคึผืœืึทืฅ ื•ื•ื™ ื“ื™ ืขืจืจื ืึธ ื•ื•ืขืจื˜. ื“ืขืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ื’ืจื•ื ื˜ ืคื•ืŸ ื“ื™ ื˜ืขื•ืช, ืคืึทืจืฉื™ื“ืขื ืข ืขืจืจื ืึธ ื•ื•ืึทืœื•ืขืก ื–ืขื ืขืŸ ืื•ืžื’ืขืงืขืจื˜. ื ืจืฉื™ืžื” ืคื•ืŸ ื˜ืขื•ืช ื ื•ืžืขืจืŸ ืื™ื– ืฆื•ื’ืขืฉื˜ืขืœื˜ ืื™ืŸ ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืึธืคึผื˜ื™ื™ืœื•ื ื’.

- SECCOMP_RET_TRACE - ื’ืขื•ื•ื™ื™ื ื˜ ืฆื• ื’ืขื‘ื  ืฆื• ื•ื•ื™ืกืŸ ื“ื™ ืคึผื˜ืจืึทืกืข ื˜ืจื™ื™ืกืขืจ ื ื™ืฆืŸ - PTRACE_O_TRACESECCOMP ืฆื• ื™ื ื˜ืขืจืกืขืคึผื˜ ื•ื•ืขืŸ ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืฆื• ื–ืขืŸ ืื•ืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ืขื ืคึผืจืึธืฆืขืก. ืื•ื™ื‘ ืึท ื˜ืจื™ื™ืกืขืจ ืื™ื– ื ื™ืฉื˜ ืงืึธื ื ืขืงื˜ืขื“, ืึท ื˜ืขื•ืช ืื™ื– ืื•ืžื’ืขืงืขืจื˜, ืขืจืจื ืึธ ืื™ื– ื‘ืึทืฉื˜ื™ืžื˜ ืฆื• -ENOSYS, ืื•ืŸ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ื ื™ืฉื˜ ืขืงืกืึทืงื™ื•ื˜ืึทื“.

- SECCOMP_RET_LOG - ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ืจื™ื–ืึทืœื•ื•ื“ ืื•ืŸ ืœืึธื’ื“.

- SECCOMP_RET_ALLOW - ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื™ื– ืคืฉื•ื˜ ืขืจืœื•ื™ื‘ื˜.

ptrace ืื™ื– ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ ืฆื• ื™ื ืกื˜ืจื•ืžืขื ื˜ ื˜ืจื™ื™ืกื™ื ื’ ืžืขืงืึทื ื™ื–ืึทืžื– ืื™ืŸ ืึท ืคึผืจืึธืฆืขืก ื’ืขืจื•ืคึฟืŸ ื˜ืจืึทืกืขืข, ืžื™ื˜ ื“ื™ ืคื™ื™ื™ืงื™ื™ื˜ ืฆื• ืžืึธื ื™ื˜ืึธืจ ืื•ืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื“ืขื ืคึผืจืึธืฆืขืก. ื“ื™ ืฉืคึผื•ืจ ืคึผืจืึธื’ืจืึทื ืงืขื ืขืŸ ื™ืคืขืงื˜ื™ื•ื•ืœื™ ื”ืฉืคึผืขื” ื“ืขืจ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืื•ืŸ ืžืึธื“ื™ืคื™ืฆื™ืจืŸ ื“ื™ ื–ื™ืงืึธืจืŸ ืจืขื“ื–ืฉื™ืกื˜ืขืจื– ืคื•ืŸ ื˜ืจืึทืกืขืข. ืื™ืŸ ื“ื™ Secomp ืงืึธื ื˜ืขืงืกื˜, ptrace ืื™ื– ื’ืขื ื™ืฆื˜ ื•ื•ืขืŸ ื˜ืจื™ื’ืขืจื“ ื“ื•ืจืš ื“ื™ SECCOMP_RET_TRACE ืกื˜ืึทื˜ื•ืก ืงืึธื“, ืึทื–ื•ื™ ื“ื™ ื˜ืจื™ื™ืกืขืจ ืงืขื ืขืŸ ืคืึทืจืžื™ื™ึทื“ืŸ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืคื•ืŸ ืขืงืกืึทืงื™ื•ื˜ื™ื ื’ ืื•ืŸ ื™ื ืกื˜ืจื•ืžืขื ื˜ ื–ื™ื™ืŸ ืื™ื™ื’ืขื ืข ืœืึธื’ื™ืง.

ืื•ื™ืกืงืœื™ื™ึทื‘ืŸ ื“ื™ ื˜ืขื•ืช

ืคื•ืŸ ืฆื™ื™ื˜ ืฆื• ืฆื™ื™ื˜, ื•ื•ืขืŸ ืื™ืจ ืึทืจื‘ืขื˜ ืžื™ื˜ Secomp, ืื™ืจ ื•ื•ืขื˜ ื˜ืจืขืคืŸ ืคืึทืจืฉื™ื“ืŸ ืขืจืจืึธืจืก, ื•ื•ืึธืก ื–ืขื ืขืŸ ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื“ื•ืจืš ืึท ืฆื•ืจื™ืงืงืขืจ ื•ื•ืขืจื˜ ืคื•ืŸ ื˜ื™ืคึผ SECCOMP_RET_ERRNO. ืฆื• ื‘ืึทืจื™ื›ื˜ ืึท ื˜ืขื•ืช, ื“ื™ ืกืขืงืงืึธืžืคึผ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื•ื•ืขื˜ ืฆื•ืจื™ืงืงื•ืžืขืŸ -1 ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ 0.

ื“ื™ ืคืืœื’ืขื ื“ืข ืขืจืจืึธืจืก ื–ืขื ืขืŸ ืžืขื’ืœืขืš:

- ืึทืงืกืขืก - ื“ืขืจ ืงืึทืœืœืขืจ ืื™ื– ื ื™ืฉื˜ ืขืจืœื•ื™ื‘ื˜ ืฆื• ืžืึทื›ืŸ ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ. ื“ืขื ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ ื›ืึทืคึผืึทื ื– ื•ื•ื™ื™ึทืœ ืขืก ื˜ื•ื˜ ื ื™ืฉื˜ ื”ืึธื‘ืŸ CAP_SYS_ADMIN ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ืึธื“ืขืจ no_new_privs ืื™ื– ื ื™ืฉื˜ ื‘ืึทืฉื˜ื™ืžื˜ ื ื™ืฆืŸ prctl (ืžื™ืจ ื•ื•ืขืœืŸ ืจืขื“ืŸ ื•ื•ืขื’ืŸ ื“ืขื ืฉืคึผืขื˜ืขืจ);

- EFAULT - ื“ื™ ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ืึทืจื’ื•ืžืขื ื˜ืŸ (ืึทืจื’ืก ืื™ืŸ ื“ื™ ืกืขืงืงืึธืžืคึผ_ื“ืึทื˜ืึท ืกื˜ืจื•ืงื˜ื•ืจ) ื˜ืึธืŸ ื ื™ื˜ ื”ืึธื‘ืŸ ืึท ื’ื™ืœื˜ื™ืง ืึทื“ืจืขืก;

- EINVAL - ืขืก ืงืขืŸ ื–ื™ื™ืŸ ืคื™ืจ ืกื™ื‘ื•ืช ื“ืึธ:

-ื“ื™ ื’ืขื‘ืขื˜ืŸ ืึธืคึผืขืจืึทืฆื™ืข ืื™ื– ืื•ืžื‘ืึทืงืึทื ื˜ ืึธื“ืขืจ ื ื™ืฉื˜ ื’ืขืฉื˜ื™ืฆื˜ ื“ื•ืจืš ื“ื™ ืงืขืจืŸ ืื™ืŸ ื“ื™ ืงืจืึทื ื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ;

-ื“ื™ ืกืคึผืขืกื™ืคื™ืขื“ ืคืœืึทื’ืก ื–ืขื ืขืŸ ื ื™ืฉื˜ ื’ื™ืœื˜ื™ืง ืคึฟืึทืจ ื“ื™ ื’ืขื‘ืขื˜ืŸ ืึธืคึผืขืจืึทืฆื™ืข;

-ืึธืคึผืขืจืึทืฆื™ืข ื›ื•ืœืœ BPF_ABS, ืึธื‘ืขืจ ืขืก ื–ืขื ืขืŸ ืคึผืจืึธื‘ืœืขืžืก ืžื™ื˜ ื“ื™ ืกืคึผืขืกื™ืคื™ืขื“ ืคืึธื˜ืึธ, ื•ื•ืึธืก ืงืขืŸ ื™ืงืกื™ื“ ื“ื™ ื’ืจื™ื™ืก ืคื•ืŸ ื“ื™ ืกืขืงืงืึธืžืคึผ_ื“ืึทื˜ืึท ืกื˜ืจื•ืงื˜ื•ืจ;

-ื“ื™ ื ื•ืžืขืจ ืคื•ืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ืฆื• ื“ื™ ืคื™ืœื˜ืขืจ ื™ืงืกื™ื“ื– ื“ื™ ืžืึทืงืกื™ืžื•ื;

- ENOMEM - ื ื™ื˜ ื’ืขื ื•ื’ ื–ื›ึผืจื•ืŸ ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื;

- EOPNOTSUPP - ื“ื™ ืึธืคึผืขืจืึทืฆื™ืข ื”ืื˜ ืื ื’ืขื•ื•ื™ื–ืŸ ืึทื– ืžื™ื˜ SECCOMP_GET_ACTION_AVAIL ื“ื™ ืึทืงืฆื™ืข ืื™ื– ื‘ื ื™ืžืฆื, ืึธื‘ืขืจ ื“ืขืจ ืงืขืจืŸ ืฉื˜ื™ืฆื˜ ื ื™ืฉื˜ ืงืขืจื˜ ืื™ืŸ ืึทืจื’ื•ืžืขื ื˜ืŸ;

- ESRCH - ืึท ืคึผืจืึธื‘ืœืขื ืื™ื– ืคืืจื’ืขืงื•ืžืขืŸ ื•ื•ืขืŸ ืกื™ื ื’ืงืจืึทื ื™ื™ื–ื™ื ื’ ืืŸ ืื ื“ืขืจ ื˜ื™ื™ึทืš;

- ENOSYS - ืขืก ืื™ื– ืงื™ื™ืŸ ื˜ืจื™ื™ืกืขืจ ืึทื˜ืึทื˜ืฉื˜ ืฆื• ื“ื™ SECCOMP_RET_TRACE ืงืึทืžืฃ.

prctl ืื™ื– ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ ื•ื•ืึธืก ืึทืœืึทื•ื– ืึท ื‘ืึทื ื™ืฆืขืจ-ืคึผืœืึทืฅ ืคึผืจืึธื’ืจืึทื ืฆื• ืžืึทื ื™ืคึผื•ืœื™ืจืŸ (ืฉื˜ืขืœืŸ ืื•ืŸ ื‘ืึทืงื•ืžืขืŸ) ืกืคึผืขืฆื™ืคื™ืฉ ืึทืกืคึผืขืงืฅ ืคื•ืŸ ืึท ืคึผืจืึธืฆืขืก, ืึทื–ืึท ื•ื•ื™ ื‘ื™ื™ื˜ืข ืขื ื“ื ืึทืก, ืคืึธื“ืขื ื ืขืžืขืŸ, ื–ื™ื›ืขืจ ืงืึทืžืคึผื™ืึทื˜ื™ื™ืฉืึทืŸ ืžืึธื“ืข (Secomp), ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–, ืคึผืขืจืฃ ื’ืขืฉืขืขื ื™ืฉืŸ, ืขื˜ืง.

Secommp ืงืขืŸ ื•ื™ืกืงื•ืžืขืŸ ื•ื•ื™ ืึท ื–ืึทืžื“ืงืึทืกื˜ืŸ ื˜ืขื›ื ืึธืœืึธื’ื™ืข ืคึฟืึทืจ ืื™ืจ, ืึธื‘ืขืจ ื“ืึธืก ืื™ื– ื ื™ืฉื˜. Secommp ืื™ื– ืึท ื ื•ืฆืŸ ื•ื•ืึธืก ืึทืœืึทื•ื– ื ื™ืฆืขืจืก ืฆื• ืึทื ื˜ื•ื•ื™ืงืœืขืŸ ืึท ื–ืึทืžื“ืงืึทืกื˜ืŸ ืžืขืงืึทื ื™ื–ืึทื. ืื™ืฆื˜ ืœืึธื–ืŸ ืก ืงื•ืง ื•ื•ื™ ื‘ืึทื ื™ืฆืขืจ ื™ื ื˜ืขืจืึทืงืฉืึทืŸ ืžื’ื™ืœื” ื–ืขื ืขืŸ ื‘ืืฉืืคืŸ ืžื™ื˜ ืึท ืคื™ืœื˜ืขืจ ื’ืขืจื•ืคึฟืŸ ื’ืœื™ื™ึทืš ื“ื•ืจืš ื“ื™ Secommp ืกื™ืกื˜ืขื ืจื•ืคืŸ.

ื‘ื™ื™ืฉืคึผื™ืœ ืคื•ืŸ BPF Secommp ืคื™ืœื˜ืขืจ

ื“ืึธ ืžื™ืจ ื•ื•ืขืœืŸ ื•ื•ื™ื™ึทื–ืŸ ื•ื•ื™ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ื“ื™ ืฆื•ื•ื™ื™ ืึทืงืฉืึทื ื– ื“ื™ืกืงืึทืกื˜ ืคืจื™ืขืจ, ื ื™ื™ืžืœื™:

- ืžื™ืจ ื•ื•ืขืœืŸ ืฉืจื™ื™ึทื‘ืŸ ืึท Secomp BPF ืคึผืจืึธื’ืจืึทื, ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ื•ื•ื™ ืึท ืคื™ืœื˜ืขืจ ืžื™ื˜ ืคืึทืจืฉื™ื“ืขื ืข ืฆื•ืจื™ืงืงื•ืžืขืŸ ืงืึธื•ื“ื– ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ื“ื™ืกื™ื–ืฉืึทื ื– ื’ืขืžืื›ื˜;

- ืœืึธื“ืŸ ื“ื™ ืคื™ืœื˜ืขืจ ืžื™ื˜ prctl.

ืขืจืฉื˜ืขืจ ืื™ืจ ื“ืึทืจืคึฟืŸ ื›ืขื“ืขืจื– ืคื•ืŸ ื“ื™ ื ืึธืจืžืึทืœ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืื•ืŸ ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ:

#include <errno.h>
#include <linux/audit.h>
#include <linux/bpf.h>
#include <linux/filter.h>
#include <linux/seccomp.h>
#include <linux/unistd.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/prctl.h>
#include <unistd.h>

ืื™ื™ื“ืขืจ ืื™ืจ ืคึผืจื•ึผื•ื•ื˜ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ, ืžื™ืจ ืžื•ื–ืŸ ืขื ืฉื•ืจ ืึทื– ื“ืขืจ ืงืขืจืŸ ืื™ื– ืงืึทืžืคึผื™ื™ืœื“ ืžื™ื˜ CONFIG_SECCOMP ืื•ืŸ CONFIG_SECCOMP_FILTER ืฉื˜ืขืœืŸ ืฆื• ื™. ืื•ื™ืฃ ืึท ืืจื‘ืขื˜ืŸ ืžืึทืฉื™ืŸ ืื™ืจ ืงืขื ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ืขื ื•ื•ื™ ื“ืึธืก:

cat /proc/config.gz| zcat | grep -i CONFIG_SECCOMP

ื“ื™ ืจืขืฉื˜ ืคื•ืŸ ื“ื™ ืงืึธื“ ืื™ื– ืึท ืฆื•ื•ื™ื™-ื˜ื™ื™ืœ install_filter ืคื•ื ืงืฆื™ืข. ื“ืขืจ ืขืจืฉื˜ืขืจ ื˜ื™ื™ืœ ื›ึผื•ืœืœ ืื•ื ื“ื–ืขืจ ืจืฉื™ืžื” ืคื•ืŸ BPF ืคึฟื™ืœื˜ืจื™ืจื•ื ื’ ื™ื ืกื˜ืจืึทืงืฉืึทื ื–:

static int install_filter(int nr, int arch, int error) {
  struct sock_filter filter[] = {
    BPF_STMT(BPF_LD + BPF_W + BPF_ABS, (offsetof(struct seccomp_data, arch))),
    BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, arch, 0, 3),
    BPF_STMT(BPF_LD + BPF_W + BPF_ABS, (offsetof(struct seccomp_data, nr))),
    BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, nr, 0, 1),
    BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | (error & SECCOMP_RET_DATA)),
    BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),
  };

ื“ื™ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ื–ืขื ืขืŸ ื‘ืึทืฉื˜ื™ืžื˜ ืžื™ื˜ ื“ื™ BPF_STMT ืื•ืŸ BPF_JUMP ืžืึทืงืจืึธืก ื“ื™ืคื™ื™ื ื“ ืื™ืŸ ื“ื™ ืœื™ื ื•ืงืก / ืคื™ืœื˜ืขืจ.ื” ื˜ืขืงืข.
ื–ืืœ ืก ื’ื™ื™ืŸ ื“ื•ืจืš ื“ื™ ื™ื ืกื˜ืจืึทืงืฉืึทื ื–.

- BPF_STMT(BPF_LD + BPF_W + BPF_ABS (offsetof(struct secomp_data, arch))) - ื“ื™ ืกื™ืกื˜ืขื ืœืึธื•ื“ื– ืื•ืŸ ืึทืงื™ื•ืžื™ืึทืœื™ื™ืฅ ืคึฟื•ืŸ BPF_LD ืื™ืŸ ื“ื™ ืคืึธืจืขื ืคื•ืŸ ื“ื™ ื•ื•ืึธืจื˜ BPF_W, ืคึผืึทืงืึทื˜ ื“ืึทื˜ืŸ ืื™ื– ืœื™ื’ืŸ ืื™ืŸ ืึท ืคืึทืจืคืขืกื˜ื™ืงื˜ ืคืึธื˜ืึธ BPF_ABS.

- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, ืึทืจื˜ืฉ, 0, 3) - ื˜ืฉืขืงืก ื ื™ืฆืŸ BPF_JEQ ืฆื™ ื“ื™ ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ ื•ื•ืขืจื˜ ืื™ืŸ ื“ื™ BPF_K ืึทืงื™ื•ืžื™ืึทืœืึทื˜ืึธืจ ืงืขืกื™ื™ื“ืขืจื“ื™ืง ืื™ื– ื’ืœื™ื™ึทืš ืฆื• ืึทืจื˜ืฉ. ืื•ื™ื‘ ืึทื–ื•ื™, ื“ื–ืฉืึทืžืคึผืก ื‘ื™ื™ึท ืคืึธื˜ืึธ 0 ืฆื• ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืœื™ืžืขื“, ืึทื ื“ืขืจืฉ ื“ื–ืฉืึทืžืคึผืก ื‘ื™ื™ึท ืคืึธื˜ืึธ 3 (ืื™ืŸ ื“ืขื ืคืึทืœ) ืฆื• ื•ื•ืึทืจืคืŸ ืึท ื˜ืขื•ืช ื•ื•ื™ื™ึทืœ ืึทืจื˜ืฉ ื˜ื•ื˜ ื ื™ืฉื˜ ื’ืœื™ื™ึทื›ืŸ.

- BPF_STMT(BPF_LD + BPF_W + BPF_ABS (offsetof(struct secomp_data, nr))) - ืœืึธื“ืŸ ืื•ืŸ ืึทืงื™ื•ืžื™ืึทืœื™ื™ืฅ ืคึฟื•ืŸ BPF_LD ืื™ืŸ ื“ื™ ืคืึธืจืขื ืคื•ืŸ ื“ื™ ื•ื•ืึธืจื˜ BPF_W, ื•ื•ืึธืก ืื™ื– ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื ื•ืžืขืจ ืงืึทื ื˜ื™ื™ื ื“ ืื™ืŸ ื“ื™ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืคืึธื˜ืึธ ืคื•ืŸ BPF_ABS.

- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, nr, 0, 1) - ืงืึทืžืคึผืขืจื– ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื ื•ืžืขืจ ืžื™ื˜ ื“ื™ ื•ื•ืขืจื˜ ืคื•ืŸ ื“ื™ ื ื•ืžืขืจ ื•ื•ืขืจื™ืึทื‘ืึทืœ. ืื•ื™ื‘ ื–ื™ื™ ื–ืขื ืขืŸ ื’ืœื™ื™ึทืš, ืžืึทืš ืื•ื™ืฃ ืฆื• ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืœื™ืžืขื“ ืื•ืŸ ื“ื™ืกื™ื™ื‘ืึทืœ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ, ืึทื ื“ืขืจืฉ ืึทืœืึทื•ื– ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืžื™ื˜ SECCOMP_RET_ALLOW.

- BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | (ื˜ืขื•ืช & SECCOMP_RET_DATA)) - ื˜ืขืจืžืึทื ื™ื™ืฅ ื“ื™ ืคึผืจืึธื’ืจืึทื ืžื™ื˜ BPF_RET ืื•ืŸ ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜ ื˜ืจืื’ื˜ ืึท ื˜ืขื•ืช SECCOMP_RET_ERRNO ืžื™ื˜ ื“ื™ ื ื•ืžืขืจ ืคื•ืŸ ื“ื™ ื˜ืขื•ืช ื‘ื™ื™ึทื˜ืขื•ื•ื“ื™ืง.

- BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW) - ื˜ืขืจืžืึทื ื™ื™ืฅ ื“ื™ ืคึผืจืึธื’ืจืึทื ืžื™ื˜ BPF_RET ืื•ืŸ ืึทืœืึทื•ื– ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืฆื• ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืžื™ื˜ SECCOMP_RET_ALLOW.

SECCOMP ืื™ื– CBPF
ืื™ืจ ืงืขืŸ ื–ื™ื™ืŸ ื•ื•ืึทื ื“ืขืจื™ื ื’ ื•ื•ืึธืก ืึท ืจืฉื™ืžื” ืคื•ืŸ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืื™ื– ื’ืขื ื™ืฆื˜ ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ืึท ืงืึธืžืคึผื™ืœืขื“ ELF ื›ื™ื™ืคืขืฅ ืึธื“ืขืจ ืึท JIT ืงืึธืžืคึผื™ืœืขื“ C ืคึผืจืึธื’ืจืึทื.

ืขืก ื–ืขื ืขืŸ ืฆื•ื•ื™ื™ ืกื™ื‘ื•ืช ืคึฟืึทืจ ื“ืขื.

โ€ข ืขืจืฉื˜ืขืจ, Secomp ื ื™ืฆื˜ cBPF (ืงืœืึทืกื™ืฉ BPF) ืื•ืŸ ื ื™ื˜ eBPF, ื•ื•ืึธืก ืžื™ื˜ืœ: ืขืก ื”ืื˜ ืงื™ื™ืŸ ืจืขื“ื–ืฉื™ืกื˜ืขืจื–, ืึธื‘ืขืจ ื‘ืœื•ื™ื– ืึทืŸ ืึทืงื™ื•ืžื™ืึทืœืึทื˜ืึธืจ ืฆื• ืงืจืึธื ื“ื™ ืœืขืฆื˜ืข ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ื™ ื›ืขื–ืฉื‘ืŸ, ื•ื•ื™ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขื–ืขืŸ ืื™ืŸ ื“ืขื ื‘ื™ื™ึทืฉืคึผื™ืœ.

โ€ข ืจื’ืข, Secomp ืึทืงืกืขืคึผืฅ ืึท ืึธื ื•ื•ื™ื™ึทื– ืฆื• ืึท ืžืขื ื’ืข ืคื•ืŸ โ€‹โ€‹BPF ืื™ื ืกื˜ืจื•ืงืฆื™ืขืก ื’ืœื™ื™ึทืš ืื•ืŸ ื’ืึธืจื ื™ืฉื˜ ืึทื ื“ืขืจืฉ. ื“ื™ ืžืึทืงืจืึธืก ื•ื•ืึธืก ืžื™ืจ ื”ืึธื‘ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ืคืฉื•ื˜ ื”ืขืœืคึฟืŸ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื“ื™ ื™ื ืกื˜ืจืึทืงืฉืึทื ื– ืื•ื™ืฃ ืึท ืคึผืจืึธื’ืจืึทืžื™ืกื˜-ืคืจื™ื™ึทื ื“ืœืขืš ื•ื•ืขื’.

ืื•ื™ื‘ ืื™ืจ ื“ืึทืจืคึฟืŸ ืžืขืจ ื”ื™ืœืฃ ืฆื• ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื“ืขื ืคึฟืึทืจื–ืึทืžืœื•ื ื’, ื‘ืึทื˜ืจืึทื›ื˜ืŸ ื“ื™ ืคึผืกืขื•ื•ื“ืึธืงืึธื“ืข ื•ื•ืึธืก ื˜ื•ื˜ ื“ื™ ื–ืขืœื‘ืข ื–ืึทืš:

if (arch != AUDIT_ARCH_X86_64) {
    return SECCOMP_RET_ALLOW;
}
if (nr == __NR_write) {
    return SECCOMP_RET_ERRNO;
}
return SECCOMP_RET_ALLOW;

ื ืึธืš ื“ื™ืคื™ื™ื ื™ื ื’ ื“ื™ ืคื™ืœื˜ืขืจ ืงืึธื“ ืื™ืŸ ื“ื™ socket_filter ืกื˜ืจื•ืงื˜ื•ืจ, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื“ืขืคื™ื ื™ืจืŸ ืึท sock_fprog ืžื™ื˜ ื“ื™ ืงืึธื“ ืื•ืŸ ื“ื™ ืงืึทืœืงื™ืึทืœื™ื™ื˜ื™ื“ ืœืขื ื’ ืคื•ืŸ ื“ื™ ืคื™ืœื˜ืขืจ. ื“ื™ ื“ืึทื˜ืŸ ืกื˜ืจื•ืงื˜ื•ืจ ืื™ื– ื“ืืจืฃ ื•ื•ื™ ืึทืŸ ืึทืจื’ื•ืžืขื ื˜ ืฆื• ื“ืขืจืงืœืขืจืŸ ื“ืขื ืคึผืจืึธืฆืขืก ืฆื• ืœื•ื™ืคืŸ ืฉืคึผืขื˜ืขืจ:

struct sock_fprog prog = {
   .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
   .filter = filter,
};

ืขืก ืื™ื– ื‘ืœื•ื™ื– ืื™ื™ืŸ ื–ืึทืš ืฆื• ื˜ืึธืŸ ืื™ืŸ ื“ื™ install_filter ืคื•ื ืงืฆื™ืข - ืœืึธื“ืŸ ื“ื™ ืคึผืจืึธื’ืจืึทื ื–ื™ืš! ืฆื• ื˜ืึธืŸ ื“ืึธืก, ืžื™ืจ ื ื•ืฆืŸ prctl, ื’ืขื ื•ืžืขืŸ PR_SET_SECCOMP ื•ื•ื™ ืึทืŸ ืึธืคึผืฆื™ืข ืฆื• ืึทืจื™ื™ึทืŸ ื–ื™ื›ืขืจ ืงืึทืžืคึผื™ื•ื˜ื™ื ื’ ืžืึธื“ืข. ื“ืขืจื ืึธืš ืžื™ืจ ื–ืึธื’ืŸ ื“ื™ ืžืึธื“ืข ืฆื• ืžืึทืกืข ื“ื™ ืคื™ืœื˜ืขืจ ื ื™ืฆืŸ SECCOMP_MODE_FILTER, ื•ื•ืึธืก ืื™ื– ืงืึทื ื˜ื™ื™ื ื“ ืื™ืŸ ื“ื™ ืคึผืจืึธื’ ื‘ื™ื™ึทื˜ืขื•ื•ื“ื™ืง ืคื•ืŸ ื˜ื™ืคึผ sock_fprog:

  if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
    perror("prctl(PR_SET_SECCOMP)");
    return 1;
  }
  return 0;
}

ืฆื•ื ืกื•ืฃ, ืžื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืื•ื ื“ื–ืขืจ ื™ื ืกื˜ืึทืœืœ_ืคื™ืœื˜ืขืจ ืคึฟื•ื ืงืฆื™ืข, ืึธื‘ืขืจ ืคืจื™ืขืจ ืžื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื ื•ืฆืŸ prctl ืฆื• ืฉื˜ืขืœืŸ PR_SET_NO_NEW_PRIVS ืคึฟืึทืจ ื“ื™ ืงืจืึทื ื˜ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืื•ืŸ ื“ืขืจืžื™ื˜ ื•ื™ืกืžื™ื™ื“ืŸ ื“ื™ ืกื™ื˜ื•ืึทืฆื™ืข ื•ื•ื• ืงื™ื ื“ ืคึผืจืึทืกืขืกืึทื– ื‘ืึทืงื•ืžืขืŸ ืžืขืจ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ื•ื•ื™ ื–ื™ื™ืขืจ ืขืœื˜ืขืจืŸ. ืžื™ื˜ ื“ืขื, ืžื™ืจ ืงืขื ืขืŸ ืžืึทื›ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข prctl ืจื•ืคื˜ ืื™ืŸ ื“ื™ install_filter ืคื•ื ืงืฆื™ืข ืึธืŸ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜.

ืื™ืฆื˜ ืžื™ืจ ืงืขื ืขืŸ ืจื•ืคืŸ ื“ื™ install_filter ืคื•ื ืงืฆื™ืข. ืœืึธืžื™ืจ ืคืึทืจืฉืคึผืึทืจืŸ ืึทืœืข ืฉืจื™ื™ื‘ืŸ ืกื™ืกื˜ืขื ืจื•ืคื˜ ืฉื™ื™ึทื›ื•ืช ืฆื• ื“ื™ X86-64 ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ ืื•ืŸ ื ืึธืจ ื’ืขื‘ืŸ ืึท ื“ืขืจืœื•ื™ื‘ืขื ื™ืฉ ื•ื•ืึธืก ื‘ืœืึทืงืก ืึทืœืข ืคืจื•ื•ื•ืŸ. ื ืึธืš ื™ื ืกื˜ืึธืœื™ื ื’ ื“ื™ ืคื™ืœื˜ืขืจ, ืžื™ืจ ืคืึธืจื–ืขืฆืŸ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืžื™ื˜ ื“ืขืจ ืขืจืฉื˜ืขืจ ืึทืจื’ื•ืžืขื ื˜:

int main(int argc, char const *argv[]) {
  if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
   perror("prctl(NO_NEW_PRIVS)");
   return 1;
  }
   install_filter(__NR_write, AUDIT_ARCH_X86_64, EPERM);
  return system(argv[1]);
 }

ืœืืžื™ืจ ืื ื”ื™ื™ื‘ืขืŸ. ืฆื• ืฆื•ื ื•ื™ืคื ืขืžืขืŸ ืื•ื ื“ื–ืขืจ ืคึผืจืึธื’ืจืึทื ืžื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืึธื“ืขืจ ืงืœืึทื ื’ ืึธื“ืขืจ ื’ืงืง, ืึธื“ืขืจ ื•ื•ืขื’ ืขืก ืก ื ืึธืจ ืงืึทืžืคึผื™ื™ืœื™ื ื’ ื“ื™ main.c ื˜ืขืงืข ืึธืŸ ืกืคึผืขืฆื™ืขืœ ืึธืคึผืฆื™ืขืก:

clang main.c -o filter-write

ื•ื•ื™ ืฉื•ื™ืŸ ืื ื’ืขื•ื•ื™ื–ืŸ, ืžื™ืจ ื”ืึธื‘ืŸ ืืคื’ืขืฉื˜ืขืœื˜ ืึทืœืข ืื™ื™ื ืกืŸ ืื™ืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื. ืฆื• ืคึผืจื•ื‘ื™ืจืŸ ื“ืขื ืื™ืจ ื“ืึทืจืคึฟืŸ ืึท ืคึผืจืึธื’ืจืึทื ื•ื•ืึธืก ืึทื•ื˜ืคึผื•ืฅ ืขืคึผืขืก - ืขืก ืžื™ื™ื ื˜ ื•ื•ื™ ืึท ื’ื•ื˜ ืงืึทื ื“ื™ื“ืึทื˜. ืื–ื•ื™ ืคื™ืจื˜ ื–ื™ ื–ื™ืš ื’ืขื•ื•ืขื ืœื™ืš:

ls -la
total 36
drwxr-xr-x 2 fntlnz users 4096 Apr 28 21:09 .
drwxr-xr-x 4 fntlnz users 4096 Apr 26 13:01 ..
-rwxr-xr-x 1 fntlnz users 16800 Apr 28 21:09 filter-write
-rw-r--r-- 1 fntlnz users 19 Apr 28 21:09 .gitignore
-rw-r--r-- 1 fntlnz users 1282 Apr 28 21:08 main.c

ื•ื•ื•ื ื“ืขืจืœืขืš! ื“ืึธ ืก ื•ื•ื™ ื ื™ืฆืŸ ืื•ื ื“ื–ืขืจ ืจืึทืคึผืขืจ ืคึผืจืึธื’ืจืึทื ืงื•ืงื˜ ื•ื•ื™: ืžื™ืจ ืคืฉื•ื˜ ืคืึธืจืŸ ื“ื™ ืคึผืจืึธื’ืจืึทื ืžื™ืจ ื•ื•ื™ืœืŸ ืฆื• ืคึผืจื•ื‘ื™ืจืŸ ื•ื•ื™ ื“ืขืจ ืขืจืฉื˜ืขืจ ืึทืจื’ื•ืžืขื ื˜:

./filter-write "ls -la"

ื•ื•ืขืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“, ื“ืขื ืคึผืจืึธื’ืจืึทื ื˜ืจืื’ื˜ ื’ืึธืจ ืœื™ื™ื“ื™ืง ืจืขื–ื•ืœื˜ืึทื˜. ืึธื‘ืขืจ, ืžื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืกื˜ืจืึทืกืข ืฆื• ื–ืขืŸ ื•ื•ืึธืก ืื™ื– ื’ืขืฉืขืขื ื™ืฉ:

strace -f ./filter-write "ls -la"

ื“ืขืจ ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื“ืขืจ ืึทืจื‘ืขื˜ ืื™ื– ื–ื™ื™ืขืจ ืคืึทืจืงื™ืจืฆื˜, ืึธื‘ืขืจ ื“ื™ ืงืึธืจืึทืกืคึผืึทื ื“ื™ื ื’ ื˜ื™ื™ืœ ืคื•ืŸ ืขืก ื•ื•ื™ื™ื–ื˜ ืึทื– ืจืขืงืึธืจื“ืก ื–ืขื ืขืŸ ืืคื’ืขืฉื˜ืขืœื˜ ืžื™ื˜ ื“ื™ EPERM ื˜ืขื•ืช - ื“ื™ ื–ืขืœื‘ืข ื•ื•ืึธืก ืžื™ืจ ืงืึทื ืคื™ื’ื™ืขืจื“. ื“ืขื ืžื™ื˜ืœ ืึทื– ื“ืขืจ ืคึผืจืึธื’ืจืึทื ื˜ื•ื˜ ื ื™ืฉื˜ ืจืขื–ื•ืœื˜ืึทื˜ ืขืคึผืขืก ื•ื•ื™ื™ึทืœ ืขืก ืงืขืŸ ื ื™ืฉื˜ ืึทืงืกืขืก ื“ื™ ืฉืจื™ื™ึทื‘ืŸ ืกื™ืกื˜ืขื ืจื•ืคืŸ:

[pid 25099] write(2, "ls: ", 4) = -1 EPERM (Operation not permitted)
[pid 25099] write(2, "write error", 11) = -1 EPERM (Operation not permitted)
[pid 25099] write(2, "n", 1) = -1 EPERM (Operation not permitted)

ืื™ืฆื˜ ืื™ืจ ืคึฟืึทืจืฉื˜ื™ื™ืŸ ื•ื•ื™ Secomp BPF ืึทืจื‘ืขื˜ ืื•ืŸ ื”ืึธื‘ืŸ ืึท ื’ื•ื˜ืข ื’ืขื“ืึทื ืง ืคื•ืŸ ื•ื•ืึธืก ืื™ืจ ืงืขื ืขืŸ ื˜ืึธืŸ ืžื™ื˜ ืื™ื. ืึธื‘ืขืจ ื•ื•ืึธืœื˜ ืื™ืจ ื ื™ืฉื˜ ื•ื•ื™ ืฆื• ื“ืขืจื’ืจื™ื™ื›ืŸ ื“ื™ ื–ืขืœื‘ืข ื–ืึทืš ืžื™ื˜ eBPF ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ cBPF ืฆื• ื›ืึทืจื ื™ืก ื–ื™ื™ืŸ ืคื•ืœ ืžืึทื›ื˜?

ื•ื•ืขืŸ ืื™ืจ ื˜ืจืึทื›ื˜ืŸ ื•ื•ืขื’ืŸ eBPF ืžื’ื™ืœื”, ืจื•ื‘ึฟ ืžืขื ื˜ืฉืŸ ื˜ืจืึทื›ื˜ืŸ ืึทื– ื–ื™ื™ ืคืฉื•ื˜ ืฉืจื™ื™ึทื‘ืŸ ื–ื™ื™ ืื•ืŸ ืžืึทืกืข ื–ื™ื™ ืžื™ื˜ ืึทื“ืžื™ื ื™ืกื˜ืจืึทื˜ืึธืจ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–. ื›ืึธื˜ืฉ ื“ื™ ื•ื™ืกื–ืึธื’ื•ื ื’ ืื™ื– ื‘ื›ืœืœ ืืžืช, ื“ื™ ืงืขืจืŸ ื™ืžืคึผืœืึทืžืึทื ืฅ ืึท ื’ืึทื ื’ ืคื•ืŸ ืžืขืงืึทื ื™ื–ืึทืžื– ืฆื• ื‘ืึทืฉื™ืฆืŸ eBPF ืึทื‘ื“ื–ืฉืขืงืฅ ืื™ืŸ ืคืึทืจืฉื™ื“ืŸ ืœืขื•ื•ืขืœืก. ื“ื™ ืžืขืงืึทื ื™ื–ืึทืžื– ื–ืขื ืขืŸ ื’ืขืจื•ืคืŸ BPF LSM ื˜ืจืึทืคึผืก.

BPF LSM ื˜ืจืึทืคึผืก

ืฆื• ืฆื•ืฉื˜ืขืœืŸ ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ-ืคืจื™ื™ึท ืžืึธื ื™ื˜ืึธืจื™ื ื’ ืคื•ืŸ ืกื™ืกื˜ืขื ื’ืขืฉืขืขื ื™ืฉืŸ, LSM ื™ืžืคึผืœืึทืžืึทื ืฅ ื“ืขืจ ื‘ืึทื’ืจื™ืฃ ืคื•ืŸ ื˜ืจืึทืคึผืก. ื ืงืจื•ืง ืจื•ืคืŸ ืื™ื– ื˜ืขืงื ื™ืงืœื™ ืขื ืœืขืš ืฆื• ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ, ืึธื‘ืขืจ ืื™ื– ืกื™ืกื˜ืขื ืคืจื™ื™ึท ืื•ืŸ ื™ื ืึทื’ืจื™ื™ื˜ื™ื“ ืžื™ื˜ ื“ื™ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ. LSM ื’ื™ื˜ ืึท ื ื™ื™ึทืข ื‘ืึทื’ืจื™ืฃ ืื™ืŸ ื•ื•ืึธืก ืึท ืึทื‘ืกื˜ืจืึทืงืฆื™ืข ืฉื™ื›ื˜ืข ืงืขื ืขืŸ ื”ืขืœืคึฟืŸ ื•ื™ืกืžื™ื™ื“ืŸ ืคึผืจืึธื‘ืœืขืžืก ื•ื•ืขืŸ ืื™ืจ ื”ืึทื ื“ืœืขืŸ ืžื™ื˜ ืกื™ืกื˜ืขื ืจื•ืคื˜ ืื•ื™ืฃ ืคืึทืจืฉื™ื“ืขื ืข ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจื–.

ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ืฉืจื™ื™ื‘ืŸ, ื“ืขืจ ืงืขืจืŸ ื”ืื˜ ื–ื™ื‘ืŸ ื›ื•ืงืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ BPF ืžื’ื™ืœื”, ืื•ืŸ SELinux ืื™ื– ื“ืขืจ ื‘ืœื•ื™ื– ื’ืขื‘ื•ื™ื˜-ืื™ืŸ LSM ื•ื•ืึธืก ื™ืžืคึผืœืึทืžืึทื ืฅ ื–ื™ื™.

ื“ืขืจ ืžืงื•ืจ ืงืึธื“ ืคึฟืึทืจ ื“ื™ ื˜ืจืึทืคึผืก ืื™ื– ืœื™ื’ืŸ ืื™ืŸ ื“ื™ ืงืขืจืŸ ื‘ื•ื™ื ืื™ืŸ ื“ืขืจ ื˜ืขืงืข include/linux/security.h:

extern int security_bpf(int cmd, union bpf_attr *attr, unsigned int size);
extern int security_bpf_map(struct bpf_map *map, fmode_t fmode);
extern int security_bpf_prog(struct bpf_prog *prog);
extern int security_bpf_map_alloc(struct bpf_map *map);
extern void security_bpf_map_free(struct bpf_map *map);
extern int security_bpf_prog_alloc(struct bpf_prog_aux *aux);
extern void security_bpf_prog_free(struct bpf_prog_aux *aux);

ื™ืขื“ืขืจ ืคื•ืŸ ื–ื™ื™ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขืจื•ืคึฟืŸ ืื™ืŸ ืคืึทืจืฉื™ื“ืขื ืข ืกื˜ืึทื’ืขืก ืคื•ืŸ ื“ื•ืจื›ืคื™ืจื•ื ื’:

- security_bpf - ืคึผืขืจืคืึธืจืžื– ืึทืŸ ืขืจืฉื˜ ื˜ืฉืขืง ืคื•ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ BPF ืกื™ืกื˜ืขื ืจื•ืคื˜;

- security_bpf_map - ื˜ืฉืขืงืก ื•ื•ืขืŸ ื“ืขืจ ืงืขืจืŸ ืงืขืจื˜ ืึท ื˜ืขืงืข ื“ื™ืกืงืจื™ืคึผื˜ืึธืจ ืคึฟืึทืจ ื“ื™ ืžืึทืคึผืข;

- security_bpf_prog - ื˜ืฉืขืงืก ื•ื•ืขืŸ ื“ืขืจ ืงืขืจืŸ ืงืขืจื˜ ืึท ื˜ืขืงืข ื“ื™ืกืงืจื™ืคึผื˜ืึธืจ ืคึฟืึทืจ ื“ื™ eBPF ืคึผืจืึธื’ืจืึทื;

- security_bpf_map_alloc - ื˜ืฉืขืงืก ืฆื™ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคืขืœื“ ืื™ืŸ BPF ืžืึทืคึผืก ืื™ื– ื™ื ื™ื˜ื™ืึทืœื™ื™ื–ื“;

- security_bpf_map_free - ื˜ืฉืขืงืก ืฆื™ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคืขืœื“ ืื™ื– ืงืœื™ืจื“ ืื™ืŸ BPF ืžืึทืคึผืก;

- security_bpf_prog_alloc - ื˜ืฉืขืงืก ืฆื™ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคืขืœื“ ืื™ื– ื™ื ื™ื˜ื™ืึทืœื™ื™ื–ื“ ืื™ืŸ BPF ืžื’ื™ืœื”;

- security_bpf_prog_free - ื˜ืฉืขืงืก ืฆื™ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคืขืœื“ ืื™ื– ืงืœื™ืจื“ ืื™ืŸ BPF ืžื’ื™ืœื”.

ืื™ืฆื˜, ื•ื•ืขืŸ ืžื™ืจ ื–ืขืŸ ืึทืœืข ื“ืขื, ืžื™ืจ ืคึฟืึทืจืฉื˜ื™ื™ืŸ: ื“ืขืจ ื’ืขื“ืึทื ืง ื”ื™ื ื˜ืขืจ LSM BPF ื™ื ื˜ืขืจืกืขืคึผื˜ืึธืจืก ืื™ื– ืึทื– ื–ื™ื™ ืงืขื ืขืŸ ืฆื•ืฉื˜ืขืœืŸ ืฉื•ืฅ ืฆื• ื™ืขื“ืขืจ eBPF ืึทื‘ื“ื–ืฉืขืงื˜, ื™ื ืฉื•ืจื™ื ื’ ืึทื– ื‘ืœื•ื™ื– ื™ืขื ืข ืžื™ื˜ ื“ื™ ืฆื•ื ืขืžืขืŸ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ืงืขื ืขืŸ ื“ื•ืจื›ืคื™ืจืŸ ืึทืคึผืขืจื™ื™ืฉืึทื ื– ืื•ื™ืฃ ืงืึทืจื“ืก ืื•ืŸ ืžื’ื™ืœื”.

ืงื™ืฆืขืจ

ื–ื™ื›ืขืจื”ื™ื™ื˜ ืื™ื– ื ื™ืฉื˜ ืขืคึผืขืก ืื™ืจ ืงืขื ืขืŸ ื™ื ืกื˜ืจื•ืžืขื ื˜ ืื™ืŸ ืึท ืื™ื™ืŸ-ื’ืจื™ื™ืก-ืคื™ืฅ-ืึทืœืข ื•ื•ืขื’ ืคึฟืึทืจ ืึทืœืฅ ืื™ืจ ื•ื•ื™ืœืŸ ืฆื• ื‘ืึทืฉื™ืฆืŸ. ืขืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ืฆื• ืงืขื ืขืŸ ืฆื• ื‘ืึทืฉื™ืฆืŸ ืกื™ืกื˜ืขืžืขืŸ ืื™ืŸ ืคืึทืจืฉื™ื“ืขื ืข ืœืขื•ื•ืขืœืก ืื•ืŸ ืื™ืŸ ืคืึทืจืฉื™ื“ืขื ืข ื•ื•ืขื’ืŸ. ื’ืœื•ื™ื‘ืŸ ืขืก ืึธื“ืขืจ ื ื™ืฉื˜, ื“ืขืจ ื‘ืขืกื˜ืขืจ ื•ื•ืขื’ ืฆื• ื‘ืึทื•ื•ืึธืจืขื ืขืŸ ืึท ืกื™ืกื˜ืขื ืื™ื– ืฆื• ืึธืจื’ืึทื ื™ื–ื™ืจืŸ ืคืึทืจืฉื™ื“ืขื ืข ืœืขื•ื•ืขืœืก ืคื•ืŸ ืฉื•ืฅ ืคื•ืŸ ืคืึทืจืฉื™ื“ืขื ืข ืฉื˜ืขืœืขืก, ืึทื–ื•ื™ ืึทื– ืจื™ื“ื•ืกื™ื ื’ ื“ื™ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคื•ืŸ ืื™ื™ืŸ ืžื“ืจื’ื” ื˜ื•ื˜ ื ื™ืฉื˜ ืœืึธื–ืŸ ืึทืงืกืขืก ืฆื• ื“ื™ ื’ืื ืฆืข ืกื™ืกื˜ืขื. ื“ื™ ื”ืึทืจืฅ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ื”ืึธื‘ืŸ ื’ืขื˜ืืŸ ืึท ื’ืจื•ื™ืก ืึทืจื‘ืขื˜ ืฆื• ื’ืขื‘ืŸ ืื•ื ื“ื– ืึท ืกื›ื•ื ืคื•ืŸ ืคืึทืจืฉื™ื“ืขื ืข ืœื™ื™ึทืขืจืก ืื•ืŸ ื˜ืึธื•ื˜ืคึผื•ื™ื ืฅ. ืžื™ืจ ื”ืึธืคืŸ ืึทื– ืžื™ืจ ื”ืึธื‘ืŸ ื’ืขื’ืขื‘ืŸ ืื™ืจ ืึท ื’ื•ื˜ืข ืคืืจืฉื˜ืื ื“ ืคื•ืŸ ื•ื•ืึธืก ืœื™ื™ึทืขืจืก ื–ืขื ืขืŸ ืื•ืŸ ื•ื•ื™ ืฆื• ื ื•ืฆืŸ BPF ืžื’ื™ืœื” ืฆื• ืึทืจื‘ืขื˜ืŸ ืžื™ื˜ ื–ื™ื™.

ื•ื•ืขื’ืŸ ืžื—ื‘ืจื™ื

ื“ื•ื“ ืงืึทืœืึทื•ื•ืขืจ ืื™ื– ื“ื™ CTO ืื™ืŸ Netlify. ืขืจ ื”ืึธื˜ ื’ืขืืจื‘ืขื˜ ืื™ืŸ ื“ืึธืงืขืจ ืฉื˜ื™ืฆืŸ ืื•ืŸ ืงืึทื ื˜ืจื™ื‘ื™ื•ื˜ื™ื“ ืฆื• ื“ืขืจ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืคื•ืŸ Runc, Go ืื•ืŸ BCC ืžื›ืฉื™ืจื™ื, ื•ื•ื™ ื’ืขื–ื•ื ื˜ ื•ื•ื™ ืื ื“ืขืจืข ืึธืคึฟืŸ ืžืงื•ืจ ืคึผืจืึทื“ื–ืฉืขืงืก. ื‘ืึทื•ื•ื•ืกื˜ ืคึฟืึทืจ ื–ื™ื™ืŸ ืึทืจื‘ืขื˜ ืื•ื™ืฃ ื“ืึธืงืขืจ ืคึผืจืึทื“ื–ืฉืขืงืก ืื•ืŸ ืึทื ื˜ื•ื•ื™ืงืœื•ื ื’ ืคื•ืŸ ื“ื™ ื“ืึธืงืงืขืจ ืคึผืœื•ื’ื™ืŸ ื™ืงืึธื•ืกื™ืกื˜ืึทื. ื“ื•ื“ ืื™ื– ื–ื™ื™ืขืจ ืœื™ื™ึทื“ื ืฉืึทืคื˜ืœืขืš ื•ื•ืขื’ืŸ ืคืœืึทื ื’ืจืึทืคืก ืื•ืŸ ืื™ื– ืฉื˜ืขื ื“ื™ืง ื–ื•ื›ื˜ ืฆื• ืึทืคึผื˜ืึทืžื™ื™ื– ืคืึธืจืฉื˜ืขืœื•ื ื’.

ืœืึธืจืขื ื–ืึธ ืคืึธื ื˜ืึทื ืึท ืึทืจื‘ืขื˜ ืื•ื™ืฃ ื“ื™ ืึธืคึฟืŸ ืžืงื•ืจ ืžืึทื ืฉืึทืคึฟื˜ ื‘ื™ื™ Sysdig, ื•ื•ื• ืขืจ ืื™ื– ื‘ืคึฟืจื˜ ืคืึธื•ืงื™ืกื˜ ืื•ื™ืฃ Falco, ืึท ืงืœืึธื•ื“ ื ืึทื˜ื™ื•ื•ืข ืงืึทืžืคึผื™ื•ื˜ื™ื ื’ ื•ื•ื™ืงื™ืคึผืขื“ื™ืข ืคึผืจื•ื™ืขืงื˜ ื•ื•ืึธืก ื’ื™ื˜ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ื–ื™ื›ืขืจื”ื™ื™ื˜ ืื•ืŸ ืึทื ืึทืžืึทืœื™ ื“ื™ื˜ืขืงืฉืึทืŸ ื“ื•ืจืš ืึท ืงืขืจืŸ ืžืึธื“ื•ืœืข ืื•ืŸ eBPF. ืขืจ ืื™ื– ืœื™ื™ึทื“ื ืฉืึทืคื˜ืœืขืš ื•ื•ืขื’ืŸ ืคื•ื ืื ื“ืขืจื’ืขื˜ื™ื™ืœื˜ ืกื™ืกื˜ืขืžืขืŸ, ื•ื•ื™ื™ื›ื•ื•ืืจื’ ื“ื™ืคื™ื™ื ื“ ื ืขื˜ื•ื•ืึธืจืงื™ื ื’, ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ ืื•ืŸ ืคืึธืจืฉื˜ืขืœื•ื ื’ ืึทื ืึทืœื™ืกื™ืก.

ยป ืžืขืจ ื“ืขื˜ืึทื™ืœืก ื•ื•ืขื’ืŸ ื“ืขื ื‘ื•ืš ืงืขื ืขืŸ ื–ื™ื™ืŸ ื’ืขืคึฟื•ื ืขืŸ ืื™ืŸ ืึทืจื•ื™ืกื’ืขื‘ืขืจ ืก ื•ื•ืขื‘ื–ื™ื™ึทื˜ืœ
ยป ื˜ื™ืฉ ืคื•ืŸ ืื™ื ื”ืึทืœื˜
ยป ืขืงืกืกืขืจืคึผื˜

ืคึฟืึทืจ Khabrozhiteley 25% ืึทืจืึธืคึผืจืขื›ืขื ืขืŸ ืžื™ื˜ ืงื•ืคึผืึธืŸ - ืœื™ื ื•ืงืก

ื‘ื™ื™ ืฆืึธืœื•ื ื’ ืคื•ืŸ ื“ื™ ืคึผืึทืคึผื™ืจ ื•ื•ืขืจืกื™ืข ืคื•ืŸ โ€‹โ€‹ื“ืขื ื‘ื•ืš, ืึทืŸ ืขืœืขืงื˜ืจืึธื ื™ืฉ ื‘ื•ืš ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขืฉื™ืงื˜ ื“ื•ืจืš E- ืคึผืึธืกื˜.

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’