-
Notifications
You must be signed in to change notification settings - Fork 367
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat : process arguments matching #1869
base: main
Are you sure you want to change the base?
Conversation
895a6a7
to
3f3c89c
Compare
e57f369
to
d68e9cd
Compare
c361643
to
ed83a17
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
BPFLSM enforcer not starting, here's the error message -
2024-11-12 10:39:53.824274 ERROR error creating kubearmor_arguments_map: creating map: map create: argument list too long (without BTF k/v) github.com/kubearmor/KubeArmor/KubeArmor/log.Err /usr/src/KubeArmor/KubeArmor/log/logger.go:103 github.com/kubearmor/KubeArmor/KubeArmor/feeder.(*Feeder).Errf /usr/src/KubeArmor/KubeArmor/feeder/feeder.go:446 github.com/kubearmor/KubeArmor/KubeArmor/enforcer/bpflsm.NewBPFEnforcer /usr/src/KubeArmor/KubeArmor/enforcer/bpflsm/enforcer.go:111 github.com/kubearmor/KubeArmor/KubeArmor/enforcer.selectLsm /usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:106 github.com/kubearmor/KubeArmor/KubeArmor/enforcer.NewRuntimeEnforcer /usr/src/KubeArmor/KubeArmor/enforcer/runtimeEnforcer.go:175 github.com/kubearmor/KubeArmor/KubeArmor/core.(*KubeArmorDaemon).InitRuntimeEnforcer /usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:292 github.com/kubearmor/KubeArmor/KubeArmor/core.KubeArmor /usr/src/KubeArmor/KubeArmor/core/kubeArmor.go:548 main.main /usr/src/KubeArmor/KubeArmor/main.go:79 runtime.main /usr/local/go/src/runtime/proc.go:271 2024-11-12 10:39:53.824329 INFO Error Initialising BPF-LSM Enforcer, Cleaning Up
Environment -
- K8s -> EKS
- Container Runtime -> containerd://1.7.22
- Kernel Version -> 5.10.227-219.884.amzn2.x86_64
- Operating system -> Amazon Linux 2
cb148bc
to
187a3c4
Compare
c7cad50
to
54be4d0
Compare
9aaa760
to
5cd6b06
Compare
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
2b074ad
to
2d58b0a
Compare
Signed-off-by: Aryan-sharma11 <aryan1126.sharma@gmail.com>
2d58b0a
to
8ff629d
Compare
Purpose of PR?:
This PR Introduces argument based matching for processes.
###Design

Maps

bpf maps
in user space we will keep track of arguments list using
Policy example
new BPF maps added
ArgsStore
=> to store commandline argumentsCmdArgsBuf
=> to store value for ArgsStore mapkubearmor_arguments
=> to store the arguments provided with the policyargs_bufK
=> to store key for kubearmor_arguments mapBenchmarking
-- current stable
https://hackmd.io/@aryan1126/H1B_gLyZ1x
-- with process args matching
https://hackmd.io/@aryan1126/ryq0xIy-kl
Does this PR introduce a breaking change?
If the changes in this PR are manually verified, list down the scenarios covered::
Additional information for reviewer? :
Mention if this PR is part of any design or a continuation of previous PRs
Checklist:
<type>(<scope>): <subject>