Dynamic Userspace Seccomp integration in userspace || kernel raw tracepoint over sched and fork process info replicating tracepoint enforced seccomp dynamic policies

[Synarcs]

• Currently for older kernel the security framework uses the kernel socket cgroup skb egres layer that is over kernel socket layer for each cgroup to get task comm and process information to be passed to kernel TC via pinned shared map.
• Similarly the kernel TC layer over the classless root qdisc uses this or fetches task struct info if the kernel support it as bpf kfunc or uses the map to get shared per packet process
• All the required maps are cleaned via kernel tracepoint over process sched events,

However the pid_tgid from bpf helpers does not return parent process, and its not safe or not patched in kernel to support fetching complete task struct when processing the packet from skb in kernel datapath. hence currently forks and thread spawn in thread group is not restricted to potentially bypass the kernel eBPF program security for data exfiltration.

Fixess

• The userspace once a process detected malicious, the node agent in userspace must be aided with eBPF maps from raw tracepoint injected tracking parent process for different process.

Option 1:

• Let the kernel tracepoint enforce fork limitation if found malicious with a SIGKILL once detected malicious and exceed exfiltration thresholds (work similar to seccomp DENY policies) but done from userspace.
• Let userspace agent dynamcally injet seccomp filter for the process matching the child fork and thread spawn syscalls to restruct the process and anyways the kernel tracepoint will clean the ebpf map if process terminate before, else the agent will kill the process and clean the maps.

[Synarcs]

The tested implementation focus on Option1 via integration with kernel raw tracepoint layer to find child forks for each malicious process over seccomp from userspace agent to add on other process which may not work accurately if the process is inside a container or inside a pod bootstrapped and cgroups managed by containerd on the host.
Hence, better every security tracing of forks for malicious detected process be inside kernel facilitated via eBPF hooks over process scheduler tracepoint hooks.