eBPF Runtime Protection

1// FlowLink eBPF: Process Monitor (aya 0.13)
2use aya::{programs::KProbe, BpfLoader};
3use aya_log::BpfLogger;
4
5let mut bpf = BpfLoader::new()
6    .set_global("AGENT_PID", &agent_pid)
7    .load(&process_monitor_bytes)?;
8
9let monitor: &mut KProbe = bpf.program_mut("on_execve")
10    .unwrap()
11    .try_into()?;
12
13monitor.load()?;
14monitor.attach()?;
15
16// При каждом execve: логируем PID, command, parent

1// FlowLink eBPF: Syscall Filter — dangerous syscall blocking
2#[kprobe]
3pub fn on_openat(ctx: KProbeContext, fd: i32, pathname: *const c_char) -> u32 {
4    let pid = bpf_get_current_pid_tgid() >> 32;
5    
6    // Check if process is under FlowLink agent cgroup
7    if !is_agent_cgroup(pid) { return 0; }
8    
9    // Read the path being opened
10    let path = read_path(pathname);
11    
12    // Check against deny list from FlowLink policy store
13    if is_denied_path(&path) {
14        log_event(pid, "DENY", &path);
15        return -EPERM as u32; // Block the syscall
16    }
17    
18    0 // Allow
19}

1// FlowLink eBPF: Network Bastion — outbound connection control
2#[cgroup_sock_ops]
3pub fn on_connect(ctx: SockOpsContext) -> i32 {
4    let pid = bpf_get_current_pid_tgid() >> 32;
5    
6    // Only enforce for agent processes
7    if !is_agent_cgroup(pid) { return 0; }
8    
9    // Extract destination address and port
10    let (family, daddr, dport) = get_socket_params(ctx);
11    
12    // Check against network policy (loaded from FlowLink gateway)
13    if !is_allowed_connection(family, &daddr, dport) {
14        log_network_event(pid, "BLOCK", &daddr, dport);
15        return -EACCES as i32; // Block connection
16    }
17    
18    0 // Allow
19}