My name is Chine Dimobi and I'll be presenting my thesis, Preventing Unintended Data Access.
Using information flow control in eBPF. So to start, the operating system kernel is the core component of every computer system that manages all of its critical resources. So we're talking about memory, processes.
And typically everything that a computer system requires to function properly.
So system operators would often need to monitor this kennel to be able to understand its system behavior as well as performance. And this is where eBPF comes in.
Ebpf allows small programs to be run inside the kernel to monitor events or extract data.
So these programs typically go through a verification process to ensure that the program is safe.
And will not crash the system. It is then attached to the kernel And while this program is running, it can get data from kernel data structures or interact with the kernel using some helper function as well as store some data into eBPF maps
Which is also accessible to other eBPF programs or programs that are outside of the kernel.
So the problem here is that The verification process does not prevent eBPF programs from accessing unauthorized kernel data.
So some system administrators can be tricked into running malicious eBPF programs that leak sensitive information from the kernel and then can pass this data to EBPF maps, which will be accessible by the malicious programs outside of the kernel.
Or even other malicious programs that might be within the kernel.
And then this is where my research comes in. To add an additional layer of security and control.
So we're able to track all data that an eBPF program accesses.
And then say whether it's allowed or not based on where they go.
So what happens is that the system administrator can define policies that state what helper functions are allowed.
The data access policies, whether it's allowed, should be denied or the data is sensitive.
And then in this case, my system converts this EBPF program into a control flow graph.
And a control flow graph is typically how data flows from the top of the program down to the bottom of the program.
And at every point, my system checks what data the eBPF program is accessing.
So if it's accessing data that is not allowed, it will return a deny which is typically a program violation.
And if it's accessing something that's allowed to all this is good In the case that is accessing some sensitive data.
Which is and in this case sensitive data is data that is allowed to access and process, but it should never leave the program.
So what we do here is return a label taint And then we propagate this label throughout the program And if at any point we see that it tries to write this data outside of the program.
It returns a deny, which is a program violation. And based on the output of this program violation.
It either continues in the pipeline process. Or it stops and rejects the program.
A cool thing here is that all of this happens before the program is attached.
So it does not affect the performance of when the program is running.
So for the result, we see here we see here a sample of a real life monitoring eBPF program.
Here on the left hand side is the safe program that just accesses an ID of a process.
We see that I passes the verifier and the information flow control check.
But on the right-hand side, we see a malicious program that isn't just accessing the ID, but accessing authentication keys Which are like passwords. Even though it passes a verifier check, it fails the information flow control check.
Because it's doing something that is outside of its intended scope.
So for the conclusion, what we've been able to do here is embed a fine-grained access control into the eBPF pipeline So that we can properly distinguish between safe programs and malicious programs that might be accessing sensitive data.
Then by this, we are improving security without affecting the functionality of EBPF programs.
And in the future, we aim to augment our framework to use declassifiers or masks So we can store sensitivity data in maps and still process them over a long time.
One of the limitations you can see here is that we just focus on the information flow control access.
But there's some other ways that eBPF can be used maliciously.
Thank you.