↓ 跳过正文
技术溯源 | Tech Origin
  1. 文章列表/

eBPF 驱动的云原生安全监测：从内核可观察到运行时防御

·1227 字·6 分钟
云原生 EBPF 云原生安全 Kubernetes 运行时防护
Elone Yue
作者
Elone Yue
目录

引言
#

随着 Kubernetes 和微服务架构的普及，传统基于 Agent 的安全解决方案正面临性能开销大、维护成本高的问题。eBPF (extended Berkeley Packet Filter) 作为 Linux 内核的革命性特性，为云原生安全提供了全新的技术路径。

本文将演示如何从零开始构建一个基于 eBPF 的运行时安全监测系统。

eBPF 技术概览
#

核心原理
# 

// 简化的 eBPF 程序结构
SEC("kprobe/sys_execve")
int detect_suspicious_exec(struct pt_regs *ctx) {
    // 1. 提取系统调用参数
    const char *filename = (const char *)PT_REGS_PARM1(ctx);
    
    // 2. 安全检查
    if (!validate_pointer(filename)) {
        return 0;
    }
    
    // 3. 事件上报
    struct event_t event = {};
    bpf_probe_read_user_str(event.filename, sizeof(event.filename), filename);
    events.perf_submit(ctx, &event, sizeof(event));
    
    return 0;
}

为什么 eBPF 适合安全？
#

特性 传统 Hook eBPF
性能开销 5-15% <1%
内核版本依赖 高 低 (通过 verifier)
稳定性风险 可能崩溃内核 隔离执行，无法破坏内核
部署复杂度 需要加载模块 用户空间管理

实验环境搭建
#

prerequisites
# 

# 1. 内核版本要求 >= 5.8
uname -r  # 期望输出：5.15.0-xx-generic

# 2. 安装工具链
sudo apt update && sudo apt install -y \
    clang llvm libbpf-dev linux-tools-common \
    linux-tools-generic bpftool

# 3. 验证 eBPF 支持
bpftool feature

Clang/BCC 开发框架
# 

# 使用 BCC 快速原型验证
pip3 install bcc

# 或使用 cilium/ebpf 进行生产级开发
go get github.com/cilium/ebpf@latest

系统调用监控器实现
#

定义数据结构
# 

// event.go
package main

/*
typedef struct event {
    int pid;
    int uid;
    char comm[16];
    char filename[256];
    long timestamp_ns;
} event_t;
*/
import "C"

type Event struct {
    PID       int32
    UID       uint32
    Comm      [16]int8
    Filename  [256]int8
    Timestamp int64
}

eBPF C 代码 (exec_monitor.c)
# 

// Copyright (c) Tech Origin Research Team
// Licensed under MIT License

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>

#define TASK_COMM_LEN 16
#define PATH_MAX 256

struct event {
    __u32 pid;
    __u32 uid;
    __u32 comm[TASK_COMM_LEN];
    char filepath[PATH_MAX];
    __u64 timestamp;
};

struct {
    __uint(type, BPF_MAP_TYPE_PERF_BUFFER);
    __uint(max_entries, 256);
} events SEC(".maps");

// 过滤规则：白名单进程
static const char *whitelist[] = {
    "systemd", "init", "kubelet", "dockerd", "containerd"
};

static inline bool is_whitelisted(const char comm[]) {
    for (int i = 0; i < sizeof(whitelist)/sizeof(whitelist[0]); i++) {
        if (bpf_core_string_equals(whitelist[i], comm)) {
            return true;
        }
    }
    return false;
}

SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(struct trace_event_raw_sys_enter *ctx) {
    u64 current_pid_tgid = bpf_get_current_pid_tgid();
    u32 pid = current_pid_tgid >> 32;
    u32 uid = bpf_get_current_uid_gid();
    
    // 跳过内核线程
    if (pid == 0) return 0;
    
    // 获取进程名
    char comm[TASK_COMM_LEN] = {};
    bpf_get_current_comm(&comm, sizeof(comm));
    
    // 白名单检查
    if (is_whitelisted(comm)) {
        return 0;
    }
    
    // 分配事件结构
    struct event *e = bpf_map_lookup_elem(&events, &pid);
    if (!e) {
        struct event tmp = {};
        tmp.pid = pid;
        tmp.uid = uid;
        bpf_probe_read_kernel(&tmp.comm, sizeof(tmp.comm), &comm);
        
        const char *filename = (const char *)ctx->args[0];
        bpf_probe_read_user_str(&tmp.filepath, sizeof(tmp.filepath), filename);
        tmp.timestamp = bpf_ktime_get_ns();
        
        bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, 
                             &tmp, sizeof(tmp));
    }
    
    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Go 用户空间处理器
# 

// main.go
package main

import (
    "bytes"
    "fmt"
    "log"
    "os"
    "os/signal"
    "syscall"

    "github.com/cilium/ebpf"
    "github.com/cilium/ebpf/link"
    "github.com/cilium/ebpf/perf"
)

//go:generate bpf2go exec_monitor ./bpf/exec_monitor.c -- -I./headers

func main() {
    // 加载 eBPF 程序
    objs := execMonitorObjects{}
    if err := loadExecMonitorObjects(&objs, nil); err != nil {
        log.Fatalf("Loading eBPF objects: %v", err)
    }
    defer objs.Close()

    // 附加到 tracepoint
    tp, err := link.Tracepoint("syscalls", "sys_enter_execve", 
                               objs.ExecMonitorTracepointExecve, nil)
    if err != nil {
        log.Fatalf("Attaching tracepoint: %v", err)
    }
    defer tp.Close()

    // 初始化 PerfBuffer
    reader, err := perf.NewReader(objs.Events, os.Getpagesize())
    if err != nil {
        log.Fatalf("Creating perf buffer: %v", err)
    }
    defer reader.Close()

    fmt.Println("[*] eBPF execve monitor started. Press Ctrl+C to stop.")
    
    // 处理信号
    sig := make(chan os.Signal, 1)
    signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
    
    go func() {
        <-sig
        fmt.Println("\n[*] Shutting down...")
        reader.Close()
    }()

    // 读取事件
    for {
        record, err := reader.Read()
        if err != nil {
            if errors.Is(err, perf.ErrClosed) {
                break
            }
            log.Printf("Reading perf event: %v", err)
            continue
        }

        if record.LostSamples > 0 {
            log.Printf("Lost %d samples", record.LostSamples)
            continue
        }

        // 解析事件
        var event Event
        if err := binary.Read(bytes.NewBuffer(record.RawSample), 
                            binary.LittleEndian, &event); err != nil {
            log.Printf("Parsing event: %v", err)
            continue
        }

        // 输出告警
        fmt.Printf("[%s] PID=%d UID=%d CMD=%s ARGS=%s\n",
            time.Now().Format(time.RFC3339),
            event.PID, event.UID,
            C.GoBytes(unsafe.Pointer(&event.Comm[0]), 16),
            C.GoBytes(unsafe.Pointer(&event.Filepath[0]), 256),
        )
    }
}

容器逃逸检测
#

敏感设备访问监控
#

容器挂载 /dev/mem 或 /dev/kmem 是典型的逃逸前兆。

SEC("kprobe/do_mount")
int check_sensitive_mount(struct pt_regs *ctx) {
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    int tgid = BPF_CORE_READ(task, tgid);
    
    // 仅监控容器内进程 (cgroup ID 判断)
    u64 cgroup_id = bpf_get_current_cgroup_id();
    if (!is_container_cgroup(cgroup_id)) {
        return 0;
    }
    
    const char *dev_name = (const char *)PT_REGS_PARM2(ctx);
    char buf[64];
    bpf_probe_read_user_str(buf, sizeof(buf), dev_name);
    
    // 检测敏感设备
    if (bpf_strncmp(buf, 64, "/dev/mem") == 0 ||
        bpf_strncmp(buf, 64, "/dev/kmem") == 0 ||
        bpf_strncmp(buf, 64, "/dev/port") == 0) {
        
        submit_alert(ALERT_SENSITIVE_MOUNT, tgid, buf);
    }
    
    return 0;
}

ptrace 注入检测
#

攻击者常利用 ptrace 注入恶意代码到容器进程：

struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 10240);
    __type(key, u32);     // target_pid
    __type(value, u64);   // timestamp
} ptrace_tracker SEC(".maps");

SEC("kprobe/sys_ptrace")
int trace_ptrace(struct pt_regs *ctx) {
    long request = PT_REGS_PARM1(ctx);
    
    // 关注 PTRACE_ATTACH 和 PTRACE_POKETEXT
    if (request != PTRACE_ATTACH && request != PTRACE_POKETEXT && 
        request != PTRACE_POKEDATA) {
        return 0;
    }
    
    u32 target_pid = (u32)PT_REGS_PARM2(ctx);
    u64 current_pid = bpf_get_current_pid_tgid() >> 32;
    
    // 跨容器追踪检测
    if (get_container_id(current_pid) != get_container_id(target_pid)) {
        submit_alert(ALERT_CROSS_CONTAINER_PTRACE, 
                    (u32)current_pid, target_pid);
    }
    
    return 0;
}

Cap_NET_RAW 滥用检测
#

恶意的网络扫描或原始包注入通常需要 NET_RAW 能力：

SEC("kprobe/__capable")
int check_net_raw_cap(struct pt_regs *ctx) {
    int cap = (int)PT_REGS_PARM2(ctx);
    
    if (cap != CAP_NET_RAW) {
        return 0;
    }
    
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    const struct cred *cred = BPF_CORE_READ(task, cred);
    const struct user_namespace *ns = BPF_CORE_READ(cred, user_ns);
    
    // 检查是否在非初始 user namespace 中尝试提升能力
    if (ns != init_user_ns) {
        char comm[TASK_COMM_LEN];
        bpf_get_current_comm(&comm, sizeof(comm));
        
        // 记录上下文
        alert_ctx_t ctx = {};
        ctx.capability = CAP_NET_RAW;
        bpf_probe_read_kernel(&ctx.process, sizeof(ctx.process), &comm);
        
        submit_capability_abuse(&ctx);
    }
    
    return 0;
}

高级用例：HTTP 流量深度检测
#

通过拦截 OpenSSL SSL_write 函数，可以实现应用层流量分析：

SEC("uprobe/ssl_write")
int probe_ssl_write(struct pt_regs *ctx) {
    char *buf = (char *)PT_REGS_PARM2(ctx);
    int len = (int)PT_REGS_PARM3(ctx);
    
    if (len > MAX_PAYLOAD_SIZE) {
        return 0;
    }
    
    char payload[MAX_PAYLOAD_SIZE];
    bpf_probe_read_user(&payload, len, buf);
    
    // 简单的 HTTP 关键字检测
    if (bpf_memcmp(payload, len, "POST /api/v1/exfil") == 0 ||
        bpf_memcmp(payload, len, "Authorization: Bearer ") == 0) {
        
        submit_http_alert(payload, len);
    }
    
    return 0;
}

性能优化实践
#

1. 减少 Map 操作
# 

// ❌ 低效：每次事件都查找
SEC("kprobe/sys_execve")
int bad_example(struct pt_regs *ctx) {
    struct event *e = bpf_map_lookup_elem(&events_map, &pid); // 频繁查找
    // ...
}

// ✅ 高效：使用栈上临时变量
SEC("kprobe/sys_execve")
int good_example(struct pt_regs *ctx) {
    struct event tmp = {};  // 栈分配，零开销
    // 填充数据...
    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &tmp, sizeof(tmp));
    return 0;
}

2. 批量事件提交
# 

// 使用 ringbuf 替代 perf_buffer (Linux 5.8+)
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 256 * 1024); // 256KB
} rb SEC(".maps");

SEC("kprobe/sys_call")
int optimized_handler(struct pt_regs *ctx) {
    struct event *e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
    if (!e) return 0;
    
    // 填充...
    
    bpf_ringbuf_submit(e, 0);  // 原子提交
    return 0;
}

3. BTF 类型推断
#

利用 CO-RE (Compile Once Run Everywhere) 消除内核版本差异：

// 使用 LIBBPF 宏自动适配
SEC("kprobe/task_struct_state")
int field_access(struct pt_regs *ctx) {
    struct task_struct *task = (struct task_struct *)PT_REGS_CTX(ctx);
    
    // BPF_CORE_READ 会自动生成重定位信息
    int state = BPF_CORE_READ(task, __state);
    return state;
}

集成到 Kubernetes 集群
#

DaemonSet 部署
# 

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ebpf-security-agent
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: ebpf-security-agent
  template:
    metadata:
      labels:
        app: ebpf-security-agent
    spec:
      containers:
      - name: agent
        image: techorigin/ebpf-sec-agent:v1.0.0
        securityContext:
          privileged: true  # 需要 CAP_BPF + CAP_SYS_TRACER
        volumeMounts:
        - name: bpf-fs
          mountPath: /sys/fs/bpf
        - name: kernel-headers
          mountPath: /usr/src/kernels
      volumes:
      - name: bpf-fs
        hostPath:
          path: /sys/fs/bpf
      - name: kernel-headers
        hostPath:
          path: /usr/src/kernels
      tolerations:
      - effect: NoSchedule
        operator: Exists

告警整合到 SIEM
#

Elastic Search 索引模板
# 

{
  "index_patterns": ["ebpf-alerts-*"],
  "template": {
    "mappings": {
      "properties": {
        "timestamp": { "type": "date" },
        "pid": { "type": "integer" },
        "uid": { "type": "keyword" },
        "process": { "type": "text" },
        "alert_type": { "type": "keyword" },
        "severity": { "type": "integer" },
        "container_id": { "type": "keyword" },
        "namespace": { "type": "keyword" }
      }
    }
  }
}

Grafana 可视化 Dashboard
# 

{
  "dashboard": {
    "title": "eBPF Security Monitor",
    "panels": [
      {
        "title": "Alert Rate Over Time",
        "type": "graph",
        "targets": [{
          "expr": "rate(ebpf_alerts_total[5m])",
          "legendFormat": "{{alert_type}}"
        }]
      },
      {
        "title": "Top Offending Containers",
        "type": "table",
        "targets": [{
          "expr": "topk(10, sum by(container_id) (increase(ebpf_alerts_total[1h])))"
        }]
      }
    ]
  }
}

总结
#

本文展示了如何使用 eBPF 构建一个轻量级但功能强大的云原生安全监测系统。关键要点：

  1. eBPF 提供内核级可观测性而无需修改应用程序或重启系统
  2. 容器逃逸检测需关注敏感设备访问、ptrace 注入、能力滥用等模式
  3. 生产部署需考虑性能优化、错误处理和可维护性

未来研究方向包括：

  • 结合机器学习实时检测异常行为
  • 自动化生成检测规则 (从 CVE/PoC 到 eBPF 程序)
  • WebAssembly + eBPF 混合沙箱架构

参考资源

  1. eBPF Documentation
  2. cilium/ebpf GitHub
  3. BCC Tools
  4. Libbpf-bootstrap: https://github.com/libbpf/libbpf-bootstrap