Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

helpers/osinfo: add security lockdown type detection #103

Merged
merged 1 commit into from
Jan 10, 2022
Merged

helpers/osinfo: add security lockdown type detection #103

merged 1 commit into from
Jan 10, 2022

Conversation

rafaeldtinoco
Copy link
Contributor

This allows user to check '/sys/kernel/security/lockdown' status.

@rafaeldtinoco
Copy link
Contributor Author

rafaeldtinoco commented Jan 6, 2022

@grantseltzer this is the feature that will be added to tracee:

// kernel lockdown check

lockdown, err := helpers.Lockdown()
if err != nil {
	return err
}
if lockdown == helpers.CONFIDENTIALITY {
	return fmt.Errorf("kernel lockdown is set to 'confidentiality', can't load eBPF programs.")
}
if debug {
	fmt.Fprintf(os.Stdout, "OSInfo: Security Lockdown is '%v'\n", lockdown)
}

After we're able to compile tracee with libbpfgo HEAD.

It will fix: aquasecurity/tracee#295

Copy link
Contributor

@grantseltzer grantseltzer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not familiar with lockdown mode at all, but the content of my file looks like this:

[*] cat /sys/kernel/security/lockdown
[none] integrity confidentiality

Where do you find the schema for this file? Is it the same on every distribution?

helpers/osinfo.go Outdated Show resolved Hide resolved
helpers/osinfo.go Show resolved Hide resolved
This allows user to check '/sys/kernel/security/lockdown' status.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants