Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update synflood ignore_ref; add clean object to validate against #315

Merged
merged 2 commits into from
Jul 2, 2024
Merged

Update synflood ignore_ref; add clean object to validate against #315

merged 2 commits into from
Jul 2, 2024

Conversation

egibs
Copy link
Member

@egibs egibs commented Jul 2, 2024 •
edited
Loading

Relates to: #289

Old $ignore_ref:

/bincapz # go run . --min-level 3 /bincapz/samples/Linux/clean/tracer.o.aarch64
/bincapz/samples/Linux/clean/tracer.o.aarch64 [🚨 CRITICAL]
---------------------------------------------------------------------------------
RISK  KEY       DESCRIPTION                                            EVIDENCE
---------------------------------------------------------------------------------
CRIT  net/ddos  Performs DDoS (distributed denial of service) attacks  synflood
---------------------------------------------------------------------------------

New:

/bincapz # go run . --min-level 3 /bincapz/samples/Linux/clean/tracer.o.aarch64
/bincapz #

No net/ddos references in the co-re or parent epbf directories either:

/bincapz # go run . --min-level 3 /opt/datadog-agent/embedded/share/system-probe/ebpf/co-re/
/bincapz #
/bincapz # go run . --min-level 3 /opt/datadog-agent/embedded/share/system-probe/ebpf/
/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/conntrack.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/offsetguess-test.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/oom-kill.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/runtime-security.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/shared-libraries.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/tcp-queue-length.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/tracer.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime/usm.c [🔥 HIGH]
------------------------------------------------------------------------------------
RISK  KEY                   DESCRIPTION                       EVIDENCE
------------------------------------------------------------------------------------
HIGH  kernel/symbol/lookup  access unexported kernel symbols  kallsyms_lookup_name
------------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security-fentry.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security-syscall-wrapper.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

/opt/datadog-agent/embedded/share/system-probe/ebpf/runtime-security.o [🚨 CRITICAL]
-----------------------------------------------------------------------------------
RISK  KEY                        DESCRIPTION                             EVIDENCE
-----------------------------------------------------------------------------------
CRIT  evasion/fake/process/name  Pretends to be a kworker kernel thread  kworker
-----------------------------------------------------------------------------------

@egibs
Update synflood ignore_ref; add clean object to validate against
1933a4b 
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
@egibs egibs requested a review from tstromberg July 2, 2024 14:35
@tstromberg tstromberg merged commit 8a4d35d into chainguard-dev:main Jul 2, 2024
6 checks passed
@egibs egibs deleted the more-datadog-synflood-tweaks branch July 19, 2024 13:20
@egibs egibs mentioned this pull request Jul 29, 2024
Closed
9 tasks
egibs added a commit to egibs/malcontent that referenced this pull request Aug 5, 2024
@egibs
Update synflood ignore_ref; add clean object to validate against (cha…
274fda9 
…inguard-dev#315)

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
egibs added a commit to egibs/malcontent that referenced this pull request Sep 25, 2024
@egibs
Update synflood ignore_ref; add clean object to validate against (cha…
0c48a38 
…inguard-dev#315)

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tstromberg tstromberg tstromberg approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@egibs @tstromberg