Enhancing Security with eBPF: Use Cases Explored

#include <linux/bpf.h>
#include <linux/types.h>
#include <linux/ptrace.h>

SEC("kprobe/security_sys_execve")
int bpf_sys_execve(struct pt_regs *ctx) {
    pid_t pid = bpf_get_current_pid_tgid() >> 32;
    
    if (pid == target_pid) {
        bpf_kern_panic();
    }
    
    return 0;
}

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

SEC("filter")
int bpf_filter(struct __sk_buff *skb) {
    struct ethhdr *eth = bpf_hdr_pointer(skb);
    struct iphdr *ip = (struct iphdr *)(eth + 1);

    if (ip->saddr < start_ip || ip->saddr > end_ip) {
        return XDP_DROP;
    }
    
    return XDP_PASS;
}

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

SEC("kprobe/tcp_v4_connect")
int bpf_tcp_connect(struct pt_regs *ctx) {
    struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx);
    struct iphdr *iph = (struct iphdr *)skb_network_header(sk->sk_skb); 
    
    if (ntohl(iph->daddr) == suspicious_ip) {
        bpf_printk("Suspicious outgoing connection detected from container!");
    }
    
    return 0;
}

#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>

SEC("filter")
int block_outbound_network(struct __sk_buff *skb) {
    struct ethhdr *eth = bpf_hdr_pointer(skb);
    struct iphdr *ip = (struct iphdr *)(eth + 1);
    
    if (ip->daddr != whitelist_ip) {
        bpf_skb_drop(skb);
        return XDP_DROP;
    }
    
    return XDP_PASS;
}