Support for BPF-LSM for policy enforcement

[nyrahul]

Feature Request

Currently, KubeArmor supports AppArmor for policy enforcement. SELinux has several limitations on what can be achieved from enforcement point of view.

The new LSM on the corner, the BPF-LSM shows a lot of promise. It essentially will allow KubeArmor to insert eBPF bytecode at LSM hooks. BPF-LSM could do away with the limitations of AppArmor, SELinux internal policy constructs and allow for flexible way of enforcing user-specified policies on containers/hosts.

Why BPF-LSM for KubeArmor?

• BPF-LSM can improve coverage for KubeAmor on platforms not supporting AppArmor
• BPF-LSM is a stackable LSM .. which means we can use BPF-LSM in parallel with existing AppArmor, SELinux. KubeArmor will read events from any LSM and couple it with k8s metadata for alerts/telemetry purpose (this is already supported).
• Most of the latest images supporting kernel version > 5.10 already have inbuilt support for BPF-LSM

The primary limitation with BPF-LSM is that it is supported only with latest kernel versions.

Task list:

• Network based rules
• File/Process based rules
• fromSource based rules
• defaultPosture and namespace based posture
• wildcard support
• Deployment: EKS Bottlerocket
• Deployment: EKS AL2
• System tests
• Ability to enforce policies generated by discovery-engine
• Host based policies

Is your feature request related to a problem? Please describe the use case.
The primary use-case is to get better coverage and more flexible policy engine.

Describe the solution you'd like
A detailed design document needs to be prepared for handling this.

Which images from cloud providers currently support BPF-LSM?

• EKS Amazon Linux 2
• EKS Bottlerocket
• Ubuntu 20.10 images across EKS/GKE

CC: @daemon1024 @weirdwiz @nam-jaehyun

[JeongyoonMoon]

Can I work on this? I could start on December 20, 2021. I have experience in LSM eBPF while implementing a research prototype with @nam-jaehyun.

[nyrahul]

Can I work on this? I could start on December 20, 2021. I have experience in LSM eBPF while implementing a research prototype with @nam-jaehyun.

Thank you for the interest. Currently, we are in the phase of analyzing whether BPF LSM can be used for existing policy constructs that are presently fulfilled by AppArmor. @weirdwiz, can you share the analysis xls and may be we can split up the analysis work? WDYT? @nam-jaehyun @weirdwiz

[weirdwiz]

Spreadsheets containing different POCs

[JeongyoonMoon]

Thank you for the reply. Ok, then please let me know when the analysis ends. I want to participate in the analysis, but I have to focus on other things until December 20, 2021.

[nyrahul]

The design document used for BPF-LSM.