Skip to content

Commit 3e7db0b

Browse files
mmat11mmat11
committed
fim: implement ebpf backend
1 parent 9db2cd1 commit 3e7db0b

32 files changed

Lines changed: 861 additions & 141 deletions

.github/workflows/check-audtibeat.yml renamed to .github/workflows/check-auditbeat.yml

File renamed without changes.

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
130130
*Auditbeat*
131131

132132
- Add linux capabilities to processes in the system/process. {pull}37453[37453]
133+
- Add opt-in eBPF backend for file_integrity module. {pull}37223[37223]
133134

134135
*Filebeat*
135136

‎NOTICE.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12257,11 +12257,11 @@ SOFTWARE.
1225712257

1225812258
--------------------------------------------------------------------------------
1225912259
Dependency : github.com/elastic/ebpfevents
12260-
Version: v0.3.2
12260+
Version: v0.4.0
1226112261
Licence type (autodetected): Apache-2.0
1226212262
--------------------------------------------------------------------------------
1226312263

12264-
Contents of probable licence file $GOMODCACHE/github.com/elastic/ebpfevents@v0.3.2/LICENSE.txt:
12264+
Contents of probable licence file $GOMODCACHE/github.com/elastic/ebpfevents@v0.4.0/LICENSE.txt:
1226512265

1226612266
The https://github.com/elastic/ebpfevents repository contains source code under
1226712267
various licenses:

‎auditbeat/.gitignore‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,3 @@ module/*/_meta/config.yml
66
/auditbeat
77
/auditbeat.test
88
/docs/html_docs
9-

‎auditbeat/auditbeat.reference.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ auditbeat.modules:
9292
# Auditbeat will ignore files unless they match a pattern.
9393
#include_files:
9494
#- '/\.ssh($|/)'
95+
# Select the backend which will be used to source events.
96+
# "fsnotify" doesn't have the ability to associate user data to file events.
97+
# Valid values: auto, fsnotify, kprobes, ebpf.
98+
# Default: fsnotify.
99+
backend: fsnotify
95100

96101
# Scan over the configured file paths at startup and send events for new or
97102
# modified files since the last time Auditbeat was running.

‎auditbeat/docker-compose.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,15 @@ services:
1414
- KIBANA_PORT=5601
1515
volumes:
1616
- ${PWD}/..:/go/src/github.com/elastic/beats/
17+
- /sys:/sys
1718
command: make
1819
privileged: true
1920
pid: host
2021
cap_add:
2122
- AUDIT_CONTROL
23+
- BPF
24+
- PERFMON
25+
- SYS_RESOURCE
2226

2327
# This is a proxy used to block beats until all services are healthy.
2428
# See: https://github.com/docker/compose/issues/4369

‎auditbeat/docs/modules/file_integrity.asciidoc‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,13 @@ to only send events for new or modified files.
2828

2929
The operating system features that power this feature are as follows.
3030

31-
* Linux - `inotify` is used, and therefore the kernel must have inotify support.
31+
* Linux - Multiple backends are supported: `auto`, `fsnotify`, `kprobes`, `ebpf`.
32+
By default, `fsnotify` is used, and therefore the kernel must have inotify support.
3233
Inotify was initially merged into the 2.6.13 Linux kernel.
34+
The eBPF backend uses modern eBPF features and supports 5.10.16+ kernels.
35+
FSNotify doesn't have the ability to associate user data to file events.
36+
The preferred backend can be selected by specifying the `backend` config option.
37+
Since eBPF and Kprobes are in technical preview, `auto` will default to `fsnotify`.
3338
* macOS (Darwin) - Uses the `FSEvents` API, present since macOS 10.5. This API
3439
coalesces multiple changes to a file into a single event. {beatname_uc} translates
3540
this coalesced changes into a meaningful sequence of actions. However,
@@ -144,6 +149,9 @@ of this directories are watched. If `recursive` is set to `true`, the
144149
`file_integrity` module will watch for changes on this directories and all
145150
their subdirectories.
146151

152+
*`backend`*:: (*Linux only*) Select the backend which will be used to
153+
source events. Valid values: `auto`, `fsnotify`, `kprobes`, `ebpf`. Default: `fsnotify`.
154+
147155
include::{docdir}/auditbeat-options.asciidoc[]
148156

149157

‎auditbeat/module/file_integrity/_meta/config.yml.tmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,14 @@
5555
#- '/\.ssh($|/)'
5656
{{- end }}
5757

58+
{{- if eq .GOOS "linux" }}
59+
# Select the backend which will be used to source events.
60+
# "fsnotify" doesn't have the ability to associate user data to file events.
61+
# Valid values: auto, fsnotify, kprobes, ebpf.
62+
# Default: fsnotify.
63+
backend: fsnotify
64+
{{- end }}
65+
5866
# Scan over the configured file paths at startup and send events for new or
5967
# modified files since the last time Auditbeat was running.
6068
scan_at_start: true

‎auditbeat/module/file_integrity/_meta/docs.asciidoc‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,13 @@ to only send events for new or modified files.
2121

2222
The operating system features that power this feature are as follows.
2323

24-
* Linux - `inotify` is used, and therefore the kernel must have inotify support.
24+
* Linux - Multiple backends are supported: `auto`, `fsnotify`, `kprobes`, `ebpf`.
25+
By default, `fsnotify` is used, and therefore the kernel must have inotify support.
2526
Inotify was initially merged into the 2.6.13 Linux kernel.
27+
The eBPF backend uses modern eBPF features and supports 5.10.16+ kernels.
28+
FSNotify doesn't have the ability to associate user data to file events.
29+
The preferred backend can be selected by specifying the `backend` config option.
30+
Since eBPF and Kprobes are in technical preview, `auto` will default to `fsnotify`.
2631
* macOS (Darwin) - Uses the `FSEvents` API, present since macOS 10.5. This API
2732
coalesces multiple changes to a file into a single event. {beatname_uc} translates
2833
this coalesced changes into a meaningful sequence of actions. However,
@@ -137,4 +142,7 @@ of this directories are watched. If `recursive` is set to `true`, the
137142
`file_integrity` module will watch for changes on this directories and all
138143
their subdirectories.
139144

145+
*`backend`*:: (*Linux only*) Select the backend which will be used to
146+
source events. Valid values: `auto`, `fsnotify`, `kprobes`, `ebpf`. Default: `fsnotify`.
147+
140148
include::{docdir}/auditbeat-options.asciidoc[]

‎auditbeat/module/file_integrity/config.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@
1818
package file_integrity
1919

2020
import (
21+
"errors"
2122
"fmt"
2223
"math"
2324
"path/filepath"
2425
"regexp"
26+
"runtime"
2527
"sort"
2628
"strings"
2729

@@ -72,6 +74,25 @@ const (
7274
XXH64 HashType = "xxh64"
7375
)
7476

77+
type Backend string
78+
79+
const (
80+
BackendFSNotify Backend = "fsnotify"
81+
BackendKprobes Backend = "kprobes"
82+
BackendEBPF Backend = "ebpf"
83+
BackendAuto Backend = "auto"
84+
)
85+
86+
func (b *Backend) Unpack(v string) error {
87+
*b = Backend(v)
88+
switch *b {
89+
case BackendFSNotify, BackendKprobes, BackendEBPF, BackendAuto:
90+
return nil
91+
default:
92+
return fmt.Errorf("invalid backend: %q", v)
93+
}
94+
}
95+
7596
// Config contains the configuration parameters for the file integrity
7697
// metricset.
7798
type Config struct {
@@ -86,6 +107,7 @@ type Config struct {
86107
Recursive bool `config:"recursive"` // Recursive enables recursive monitoring of directories.
87108
ExcludeFiles []match.Matcher `config:"exclude_files"`
88109
IncludeFiles []match.Matcher `config:"include_files"`
110+
Backend Backend `config:"backend"`
89111
}
90112

91113
// Validate validates the config data and return an error explaining all the
@@ -160,6 +182,11 @@ nextHash:
160182
if err != nil {
161183
errs = append(errs, fmt.Errorf("invalid scan_rate_per_sec value: %w", err))
162184
}
185+
186+
if c.Backend != "" && c.Backend != BackendAuto && runtime.GOOS != "linux" {
187+
errs = append(errs, errors.New("backend can only be specified on linux"))
188+
}
189+
163190
return errs.Err()
164191
}
165192

0 commit comments

Comments
 (0)