libs
libs copied to clipboard
falcosecurity
eBPF probes: 32 bit applications support
Hello, Is there a reason why 32 bit syscalls is not supported by eBPF driver ? My test program opens /etc/shadow and normally triggers the alert. But there is no alerts when I compile program as ELF 32-bit (gcc -m32).
Looks like 32 bit calls just skipped by eBPF probe (https://github.com/falcosecurity/libs/blob/master/driver/bpf/probe.c):
if (bpf_in_ia32_syscall()) return 0;
Any reason for that ?
Hi! I think that the issue with compat syscalls is that we don't really support them; we'd need to implement its support. I think that from a security standpoint, we really need that though! I might work on this in my spare time :)
We would be interested in this feature as well. This may be a big security gap.
Yep we know that; that's unfortunate and we must implement its support. I'll try to target 0.33 for this. 0.32 is coming soon and there is no enough time to implement and test it.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
@alexburt Feature is scheduled for Falco 0.36 release and tracked under Falco issue https://github.com/falcosecurity/falco/issues/2472. According to our new roadmap planning we may have 2 libs releases per one Falco release, therefore the feature may land earlier in libs.
Hi,
I would like to understand the root cause that the bpf_in_ia32_syscall was put in the first place, failed to understand it from git blame, 32bit ARCHes are supported by eBPF, can you please elaborate regarding this issue?
@oheifetz - @FedeDP has this item in his queue. The work has not yet started. We will keep everyone updated here if this is ok? Thank you for your patience 🙏