如何使用 Ebpf 阻止文件打开？

Question

I want to use EBPF and place a probe on the open syscall, so when a user wants to open a certain file I will check its name and if it is the targeted name I will stop it from opening. The only thing is I do not know how to actually achieve this goal.

In addition, I would appreciate if you could specify if a certain solution works with uprobe or root probe. Thanks a lot.

Answer 1

TL;DR. There's currently no way to do this using BPF.

---

There is currently no option in the Linux kernel to enforce policies on syscalls using eBPF. This may change with the introduction of eBPF-based LSMs (Linux Security Modules) though (see Kernel Runtime Security Instrumentation , KRSI — the other BPF security module , and KRSI and proprietary BPF programs ).

You can however enforce policies on syscalls with seccomp-bpf , but it uses cBPF, the old BPF bytecode, instead of eBPF. It is nevertheless not possible to inspect syscall arguments passed by pointers with seccomp-bpf , for security reasons ; so you wouldn't be able to check the name of the file being opened.