EBPF program loading method and device, equipment and medium
By deploying a verification loader in kernel mode and using a whitelist for permission verification, the security issues of eBPF program loading are resolved, enabling effective monitoring and restriction of all eBPF programs and preventing malicious exploitation.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING CO WHEELS TECH CO LTD
- Filing Date
- 2024-10-18
- Publication Date
- 2026-04-21
Smart Images
Figure CN121902126A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of interactive technology, and in particular to a method for loading an eBPF program, an apparatus for loading an eBPF program, an electronic device, and a computer-readable storage medium. Background Technology
[0002] eBPF (extended Berkeley Packet Filter) is a kernel technology that allows developers to run specific functions without modifying the kernel code.
[0003] Because eBPF runs sandboxed programs in kernel mode, it boasts low overhead, high efficiency, and security, leading to its widespread adoption in recent years in areas such as network packet processing, performance monitoring and tracing, security, debugging, and analysis. However, while solving many technical challenges, eBPF has also been exploited maliciously by numerous illegal organizations and institutions. The main approaches to preventing the malicious exploitation of eBPF are as follows:
[0004] (1) Run permission control: Accounts with SYS_ADMIN (System Administrator) and CAP_BPF (Capability Berkeley Packet Filter) permissions can run eBPF programs;
[0005] (2) Perform signature verification on the running eBPF program;
[0006] (3) A callback function is attached to sys_enter_bpf (system enter Berkeley Packet Filter) through the eBPF program. The callback function will be called when loading the eBPF program. In the callback function, it is determined whether to intercept based on the characteristics of the program.
[0007] The above solution has the following problems:
[0008] Regarding the first method: Some systems log in with public accounts, which by default have SYS_ADMIN privileges, making it impossible to prevent logged-in users from maliciously loading eBPF programs.
[0009] Regarding the second method: This method ensures that all loaded programs are verified, but if XDP (eXpress Data Path) or TC eBPF (Traffic Control extended Berkeley Packet Filter) programs are loaded via commands such as ip (Internet Protocol) or tc (Traffic Control), verification is not required; therefore, this solution cannot restrict all loaded eBPF programs.
[0010] Regarding the third method: This method is deployed in user space; if the eBPF program of sys_enter_bpf (systementer Berkeley Packet Filter, the entry point of BPF system call) is maliciously uninstalled, then eBPF can still be loaded normally and cannot intercept malicious eBPF programs. Summary of the Invention
[0011] In view of the above problems, a method for loading an eBPF program, an apparatus for loading an eBPF program, an electronic device, and a computer-readable storage medium are proposed to overcome or at least partially solve the above problems, comprising:
[0012] A method for loading an eBPF program, characterized in that the method is applied in kernel mode, wherein a verification loader is deployed in kernel mode, and the method includes:
[0013] When the eBPF program call event is triggered, the verification loader performs permission verification on the target program that calls the eBPF program;
[0014] When the target program's permissions are verified, the eBPF program is loaded in response to the target program.
[0015] Optionally, the kernel mode stores a whitelist, and the verification loader performs permission verification on the target program that calls the eBPF program, including:
[0016] The verification loader verifies the permissions of the target program based on the whitelist.
[0017] Optionally, the verification loader verifies the permissions of the target program based on the whitelist, including:
[0018] The verification loader queries the whitelist based on the program characteristics of the target program, and verifies the permissions of the target program based on the query results.
[0019] Optionally, the method further includes:
[0020] Read the whitelist configuration file in user space;
[0021] The whitelist is created in the kernel state based on the information read from the whitelist configuration file.
[0022] Optionally, the method further includes:
[0023] Read the new whitelist from the user-mode whitelist configuration file and verify the new whitelist;
[0024] When the new whitelist is verified, the whitelist list in the kernel mode is updated according to the new whitelist.
[0025] Optionally, the method further includes:
[0026] When an abnormal event is detected in the whitelist configuration file for the user space, the loading of the eBPF program is paused.
[0027] Optionally, the method further includes:
[0028] When the permission verification of the target program fails, log information indicating that the permission verification of the target program failed is generated;
[0029] The log information is stored in the kernel state.
[0030] This invention also provides an eBPF program loading device, which is applied in kernel mode, wherein a verification loader is deployed in kernel mode, and the device includes:
[0031] The verification module is used to perform permission verification on the target program that calls the eBPF program when the call event of the eBPF program is triggered.
[0032] A loading module is used to load the eBPF program in response to the target program when the target program's permission verification is successful.
[0033] Optionally, the kernel mode stores a whitelist, and the verification module is used by the verification loader to verify the permissions of the target program according to the whitelist.
[0034] Optionally, the verification module is used for the verification loader to query the whitelist based on the program characteristics of the target program, and to verify the permissions of the target program based on the query results.
[0035] Optionally, the device further includes:
[0036] A module is created to read the whitelist configuration file in user space; and to create the whitelist list in kernel space based on the information read from the whitelist configuration file.
[0037] Optionally, the device further includes:
[0038] The update module is used to read a new whitelist from the whitelist configuration file in the user space and verify the new whitelist; when the new whitelist passes the verification, the whitelist list in the kernel space is updated according to the new whitelist.
[0039] Optionally, the device further includes:
[0040] The pause module is used to pause loading the eBPF program when an abnormal event is detected that targets the whitelist configuration file in the user space.
[0041] Optionally, the device further includes:
[0042] The log storage module is used to generate log information indicating that the target program's permission verification has failed when the target program fails to pass the verification; and to store the log information in the kernel mode.
[0043] This invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the above-described eBPF program loading method.
[0044] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described eBPF program loading method.
[0045] The embodiments of the present invention have the following advantages:
[0046] In this embodiment of the invention, when an eBPF program call event is triggered, the verification loader performs permission verification on the target program calling the eBPF program; when the target program's permission verification passes, the target program loads the eBPF program in response. Through this embodiment, a verification loader can be deployed in kernel mode; this verification loader can be set at the entry point for eBPF program loading, and as long as an eBPF program is being loaded, the verification loader can be triggered to verify the program loading the eBPF program. Compared to existing methods for controlling runtime permissions and performing signature verification on running eBPF programs, this embodiment of the invention, by monitoring the entry point, can restrict the loading of all eBPF programs. Attached Figure Description
[0047] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0048] Figure 1 This is a flowchart of the steps of a method for loading an eBPF program according to an embodiment of the present invention;
[0049] Figure 2 This is a flowchart of another method for loading an eBPF program according to an embodiment of the present invention;
[0050] Figure 3 This is a flowchart illustrating the steps of loading an eBPF program according to an embodiment of the present invention;
[0051] Figure 4 This is a structural block diagram of an eBPF program loading device according to an embodiment of the present invention. Detailed Implementation
[0052] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0053] To more effectively prevent eBPF from being maliciously exploited, embodiments of the present invention can deploy a verification loader in kernel mode. This verification loader can be set at the entry point for loading eBPF programs. Whenever an eBPF program is loaded, the verification loader can be triggered to verify the program loading the eBPF program. Compared with the existing methods for controlling running permissions and verifying the signatures of running eBPF programs, embodiments of the present invention can restrict the loading of all eBPF programs by monitoring the entry point.
[0054] Furthermore, by deploying the verification loader in kernel space, compared to the existing method of mounting a callback function through an eBPF program, the verification loader can be prevented from being maliciously unloaded, thus more effectively preventing the malicious exploitation of eBPF. For details, please refer to... Figure 1 , Figure 1 A flowchart illustrating the steps of a method for loading an eBPF program according to an embodiment of the present invention is shown.
[0055] like Figure 1 As shown, the loading method of this eBPF program may include the following steps:
[0056] Step 101: When the eBPF program's call event is triggered, verify the loader's permission to perform permission verification on the target program that calls the eBPF program.
[0057] In practical applications, a verification loader can be pre-deployed at the kernel-mode loading entry point. Specifically, a checkpoint or hook can be set in the kernel mode. When a target program in user mode attempts to load an eBPF program in kernel mode, the verification loader will be triggered. The verification loader can be used to check and verify whether the target program to be loaded has the permission to load the eBPF program.
[0058] In some feasible embodiments, when a target program in user space attempts to load an eBPF program in kernel space, an eBPF program call event can be determined. At this time, a verification loader pre-deployed in kernel space can be invoked to verify the permissions of the target program calling the eBPF program. Specifically, this permission verification can refer to identifying whether the target program has the permission to load the eBPF program.
[0059] Step 102: When the target program's permission verification is successful, the target program loads the eBPF program in response.
[0060] In practical applications, if the verification loader determines that the target program has the permission to load the eBPF program, then the permission verification of the target program can be considered successful.
[0061] When the target program's permissions are verified, the kernel can respond to the target program by loading the eBPF program and executing the corresponding operation.
[0062] In this embodiment of the invention, when an eBPF program call event is triggered, the verification loader performs permission verification on the target program calling the eBPF program; when the target program's permission verification passes, the target program loads the eBPF program in response. Through this embodiment, a verification loader can be deployed in kernel mode; this verification loader can be set at the entry point for eBPF program loading, and as long as an eBPF program is being loaded, the verification loader can be triggered to verify the program loading the eBPF program. Compared to existing methods for controlling runtime permissions and performing signature verification on running eBPF programs, this embodiment of the invention, by monitoring the entry point, can restrict the loading of all eBPF programs.
[0063] Reference Figure 2 The diagram illustrates a flowchart of another method for loading an eBPF program according to an embodiment of the present invention, which may include the following steps:
[0064] Step 201: A whitelist is stored in the kernel mode. When an eBPF program call event is triggered, the verification loader verifies the permissions of the target program according to the whitelist.
[0065] In some feasible embodiments, a whitelist can be pre-stored in kernel mode. This whitelist may contain the identifiers of one or more programs that have the permission to load eBPF programs. Based on this whitelist, the verification loader can verify the permissions of the target program.
[0066] Specifically, when a target program in user space attempts to load an eBPF program in kernel space, an eBPF program call event can be triggered. At this time, a verification loader pre-deployed in kernel space can be invoked to verify the permissions of the target program that calls the eBPF program.
[0067] After the verification loader is triggered, it can determine whether the target program currently loading the eBPF program is in the whitelist by using the identifiers of one or more programs with permissions to load eBPF programs stored in the whitelist.
[0068] If the target program is in the whitelist, the verification loader can determine that the target program has the permission to load eBPF programs; otherwise, if the target program is not in the whitelist, the verification loader can determine that the target program does not have the permission to load eBPF programs.
[0069] For example, the identifiers for each program with permission to load eBPF programs in the whitelist can include the program's name. The verification loader compares the information provided by the target program with the identifiers in the whitelist to determine whether the target program has permission to load eBPF programs.
[0070] As another example, the identifiers for each program with permission to load eBPF programs in the whitelist may include the program's name and an added string. The verification loader compares the information provided by the target program with the identifiers in the whitelist to determine whether the target program has permission to load eBPF programs.
[0071] The added string can be an encrypted string. Specifically, the string can be generated by hash encryption or by other methods, and this embodiment of the invention does not limit this.
[0072] In one embodiment of the present invention, the verification loader queries a whitelist based on the program characteristics of the target program, and verifies the permissions of the target program based on the query results.
[0073] In some feasible embodiments, the verification loader can verify the permissions of the target program based on the program characteristics of the target program loading the eBPF program; specifically, when the target program loads the eBPF program, the verification loader can obtain the program characteristics of the target program loading the eBPF program; wherein, the program characteristics may include the identifier, name, etc. of the target program.
[0074] After obtaining the program characteristics of the target program, the verification loader can query the whitelist based on the program characteristics of the target program, and determine whether the target program has the permission to load eBPF programs based on the query results.
[0075] Specifically, the verification loader can query the whitelist and compare the information stored in the whitelist with the target program's characteristics. If a match is found, the target program can be determined to have the permission to load eBPF programs. If no match is found, the target program can be determined not to have the permission to load eBPF programs.
[0076] Step 202: When the target program's permission verification is successful, the target program loads the eBPF program in response.
[0077] In practical applications, if the verification loader determines that the target program has the permission to load the eBPF program, then the permission verification of the target program can be considered successful.
[0078] When the target program's permissions are verified, the kernel can respond to the target program by loading the eBPF program and executing the corresponding operation.
[0079] In one embodiment of the present invention, the above method may further include the following steps:
[0080] Read the whitelist configuration file in user space; create a whitelist list in kernel space based on the information read from the whitelist configuration file.
[0081] In some feasible embodiments, a whitelist configuration file can be deployed in user space first. The whitelist configuration file can deploy a whitelist of programs with the permission to load eBPF programs. The whitelist can consist of unique identifiers of one or more programs with the permission to load eBPF programs.
[0082] During the initialization of the verification loader, the verification loader can read the whitelist configuration file in user space and create a whitelist list in kernel space based on the information read from the whitelist configuration file. Specifically, the verification loader can read the whitelist from the whitelist configuration file; then, based on the read whitelist, it creates a whitelist list in kernel space.
[0083] Subsequently, the verification loader can use a whitelist to determine whether the target program has the permission to load eBPF programs.
[0084] In one embodiment of the present invention, the above method may further include the following steps:
[0085] The new whitelist is read from the user-space whitelist configuration file and verified. When the new whitelist passes verification, the whitelist in the kernel space is updated accordingly.
[0086] In some feasible embodiments, in order to improve the flexibility of adjusting the permissions of each program to load the eBPF program, the whitelist can be modified; specifically, the whitelist configuration file in user space can be adjusted first to add or remove the identifiers of programs with the permission to load the eBPF program.
[0087] Then, the verification loader can read the new whitelist from the whitelist configuration file in user space and update the whitelist list in kernel space.
[0088] To increase the credibility of the whitelist, a new whitelist can be verified after it is read. Once the verification is successful, the whitelist in the kernel mode can be updated accordingly.
[0089] For example, a preset format requirement can be set; if the new whitelist read from the user-space whitelist configuration file does not meet the preset format requirement, it can be considered that the adjustment of the whitelist configuration file is abnormal; in this case, the whitelist list in the kernel space can be not updated according to the new whitelist.
[0090] Conversely, if the new whitelist read from the user-space whitelist configuration file meets the preset format requirements, the adjustment of the whitelist configuration file can be considered a normal adjustment. In this case, the verification loader can update the whitelist in kernel space based on the new whitelist, so that the subsequent verification loader can perform permission verification according to the updated whitelist.
[0091] Another example is that the information in the whitelist configuration file can be encrypted; after the verification loader reads the information from the whitelist configuration file, it can decrypt the information; if decryption is successful, the whitelist list in the kernel mode can be updated according to the new whitelist obtained from the decryption. Conversely, if decryption fails, it can be determined that the whitelist configuration file is abnormal. In this case, the whitelist list in the kernel mode does not need to be updated according to the new whitelist. This embodiment of the invention does not impose any restrictions on this.
[0092] In some feasible embodiments, the step of reading a new whitelist from the user-space whitelist configuration file can be performed at preset time intervals, or the verification loader can be executed to read a new whitelist from the user-space whitelist configuration file when a preset event is triggered in the user space. This embodiment of the invention does not limit this.
[0093] In one embodiment of the present invention, the above method may further include the following steps:
[0094] When an abnormal event is detected that targets a whitelist configuration file in user space, the loading of the eBPF application is paused.
[0095] In some feasible embodiments, the whitelist configuration file in user space can also be detected. When an abnormal event is detected that targets the whitelist configuration file in user space, it can be determined that the whitelist in the whitelist configuration file is no longer trustworthy. At this time, the verification loader can no longer determine whether the program loading the eBPF program has the corresponding permissions based on the whitelist list, and also suspend loading the eBPF program until the whitelist list in kernel space is reset. This embodiment of the invention does not impose any restrictions on this.
[0096] For example, an abnormal event can refer to an abnormal event related to the whitelist configuration file in user space, such as an intrusion event or a tampering event related to the whitelist configuration file; or it can refer to an abnormal event related to kernel space, such as an intrusion event or a tampering event related to kernel space. This embodiment of the invention does not limit this.
[0097] In one embodiment of the present invention, the above method may further include the following steps:
[0098] When the target program fails the permission verification, a log message indicating that the target program failed the permission verification is generated and stored in kernel space.
[0099] In some feasible embodiments, in order to facilitate the analysis of the reasons for the eBPF program loading failure, log information about the target program's permission failure can be generated when the target program's permission verification fails, and the log information can be stored in kernel space to prevent the log information from being deleted.
[0100] For example, such as Figure 3 As shown, a whitelist configuration file can be deployed in the user-space file system; the verification loader can read the whitelist from the whitelist configuration file in the user-space file system and create a whitelist list in kernel mode.
[0101] When the target program loads the eBPF program, the verification loader will be triggered. The verification loader can call the bpf_prog_load(Berkeley Packet Filter program load, load BPF program) function to load the eBPF program, and verify whether the target program is allowed to load the eBPF program based on the program characteristics of the target program and the whitelist.
[0102] If the verification passes, it indicates that the target program has the permission to load the eBPF program; at this time, the bpf_prog_load function can load the eBPF program in response to the target program's request. Conversely, if the verification fails, bpf_prog_load can record log information and store the log information in memory, and bpf_prog_load can also return a message to the target program indicating that loading the eBPF program failed.
[0103] In this embodiment of the invention, a whitelist is stored in the kernel space. When an eBPF program call event is triggered, the verification loader verifies the permissions of the target program according to the whitelist. When the target program's permission verification passes, the target program loads the eBPF program. This embodiment of the invention allows the deployment of a verification loader and a whitelist in the kernel space. The verification loader can be set at the entry point for eBPF program loading. Whenever an eBPF program is loaded, the verification loader can be triggered to verify the program loading the eBPF program according to the whitelist. Compared to existing methods for controlling runtime permissions and performing signature verification on running eBPF programs, this embodiment of the invention, by monitoring the entry point, can restrict the loading of all eBPF programs.
[0104] Furthermore, the whitelist can be configured according to actual needs, making it more flexible and convenient compared to not rebuilding the kernel. Specifically, the range of programs allowed to load eBPF can be modified by changing the whitelist, without needing to rebuild the kernel, thus improving the practicality of the solution.
[0105] Furthermore, the reasons for eBPF program loading failures can be viewed through the log information in kernel mode.
[0106] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.
[0107] Reference Figure 4 The diagram shows a structural schematic of an eBPF program loading device according to an embodiment of the present invention. The device is applied in kernel mode, in which a verification loader is deployed.
[0108] like Figure 4 As shown, the device may include the following modules:
[0109] The verification module 401 is used to verify the loader's permission to call the target program of the eBPF program when the call event of the eBPF program is triggered.
[0110] Load module 402 is used to load the eBPF program in response to the target program when the target program's permissions are verified.
[0111] In an optional embodiment of the present invention, a whitelist is stored in the kernel mode, and the verification module 401 is used to verify the permissions of the target program by the loader according to the whitelist.
[0112] In an optional embodiment of the present invention, the verification module 401 is used to verify that the loader queries the whitelist list based on the program characteristics of the target program, and verifies the permissions of the target program based on the query results.
[0113] In an optional embodiment of the present invention, the apparatus further includes:
[0114] Create a module to read the whitelist configuration file in user space; based on the information read from the whitelist configuration file, create a whitelist list in kernel space.
[0115] In an optional embodiment of the present invention, the apparatus further includes:
[0116] The update module is used to read a new whitelist from the user-space whitelist configuration file and verify the new whitelist; when the new whitelist passes verification, the whitelist list in the kernel space is updated according to the new whitelist.
[0117] In an optional embodiment of the present invention, the apparatus further includes:
[0118] The pause module is used to pause the loading of eBPF programs when an abnormal event is detected that targets a whitelist configuration file in user space.
[0119] In an optional embodiment of the present invention, the apparatus further includes:
[0120] The log storage module is used to generate log information indicating that the target program's permission verification has failed when the target program fails to pass the verification; the log information is stored in kernel space.
[0121] In this embodiment of the invention, when an eBPF program call event is triggered, the verification loader performs permission verification on the target program calling the eBPF program; when the target program's permission verification passes, the target program loads the eBPF program in response. Through this embodiment, a verification loader can be deployed in kernel mode; this verification loader can be set at the entry point for eBPF program loading, and as long as an eBPF program is being loaded, the verification loader can be triggered to verify the program loading the eBPF program. Compared to existing methods for controlling runtime permissions and performing signature verification on running eBPF programs, this embodiment of the invention, by monitoring the entry point, can restrict the loading of all eBPF programs.
[0122] This invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the above-described eBPF program loading method.
[0123] This invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, it implements the above-described method for loading the eBPF program.
[0124] As the apparatus embodiment is basically similar to the method embodiment, it is described in a relatively simple manner. For relevant details, please refer to the description of the method embodiment.
[0125] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0126] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0127] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0128] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.
[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0130] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.
[0131] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.
[0132] The foregoing has provided a detailed description of an eBPF program loading method, an eBPF program loading device, an electronic device, and a computer-readable storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are merely for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for loading an eBPF program, characterized in that, The method is applied in kernel mode, where a verification loader is deployed. The method includes: When the eBPF program call event is triggered, the verification loader performs permission verification on the target program that calls the eBPF program; When the target program's permissions are verified, the eBPF program is loaded in response to the target program.
2. The method according to claim 1, characterized in that, The kernel mode stores a whitelist, and the verification loader performs permission verification on the target program that calls the eBPF program, including: The verification loader verifies the permissions of the target program based on the whitelist.
3. The method according to claim 2, characterized in that, The verification loader verifies the permissions of the target program based on the whitelist, including: The verification loader queries the whitelist based on the program characteristics of the target program, and verifies the permissions of the target program based on the query results.
4. The method according to claim 2, characterized in that, The method further includes: Read the whitelist configuration file in user space; The whitelist is created in the kernel state based on the information read from the whitelist configuration file.
5. The method according to claim 4, characterized in that, The method further includes: Read the new whitelist from the user-mode whitelist configuration file and verify the new whitelist; When the new whitelist is verified, the whitelist list in the kernel mode is updated according to the new whitelist.
6. The method according to claim 4, characterized in that, The method further includes: When an abnormal event is detected in the whitelist configuration file for the user space, the loading of the eBPF program is paused.
7. The method according to claim 1, characterized in that, The method further includes: When the permission verification of the target program fails, log information indicating that the permission verification of the target program failed is generated; The log information is stored in the kernel state.
8. A loading device for an eBPF program, characterized in that, The device is used in kernel mode, where a verification loader is deployed. The device includes: The verification module is used to perform permission verification on the target program that calls the eBPF program when the call event of the eBPF program is triggered. A loading module is used to load the eBPF program in response to the target program when the target program's permission verification is successful.
9. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the loading method of the eBPF program as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the loading method of the eBPF program as described in any one of claims 1 to 7.