# KRIe | Linux Kernel Runtime Integrity With eBPF **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, hacking, freebies\ **Created:** [January 13, 2023, 7:52am UTC](https://onehack.st/t/krie-linux-kernel-runtime-integrity-with-ebpf/231252 "2023-01-13T07:52:44Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\ **Post date:** [January 13, 2023, 7:52am UTC](https://onehack.st/t/krie-linux-kernel-runtime-integrity-with-ebpf/231252/1 "2023-01-13T07:52:44Z")
![image](https://onehack.st/uploads/default/original/3X/e/9/e9290475c78f5c6ad4bb86516ab3dd9e781e9c11.png) [![License: GPL v2](https://camo.githubusercontent.com/48c61f406a408b3cc124389b6fed7001c3ecdb337b94df076b60efeadc443b7f/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d47504c25323076322d626c75652e737667)](https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html) [![License](https://camo.githubusercontent.com/2a2157c971b7ae1deb8eb095799440551c33dcf61ea3d965d86b496a5a65df55/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d417061636865253230322e302d626c75652e737667)](https://opensource.org/licenses/Apache-2.0) KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker will eventually be able to bypass it. That being said, the goal of the project is to make attackers’ lives harder and ultimately prevent out-of-the-box exploits from working on a vulnerable kernel. KRIe has been developed using [CO-RE (Compile Once - Run Everywhere)](https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html) so that it is compatible with a large range of kernel versions. If your kernel doesn’t export its BTF debug information, KRIe will try to download it automatically from [BTFHub](https://github.com/aquasecurity/btfhub). If your kernel isn’t available on BTFHub, but you have been able to manually generate your kernel’s BTF data, you can provide it in the configuration file (see below). ### System requirements This project was developed on Ubuntu Focal 20.04 (Linux Kernel 5.15) and has been tested on older releases down to Ubuntu Bionic 18.04 (Linux Kernel 4.15). - golang 1.18+ - (optional) Kernel headers are expected to be installed in `lib/modules/$(uname -r)`, update the `Makefile` with their location otherwise. - (optional) clang & llvm 14.0.6+ Optional fields are required to recompile the eBPF programs. ### Build 1. Since KRIe was built using CORE, you shouldn’t need to rebuild the eBPF programs. That said, if you want still want to rebuild the eBPF programs, you can use the following command: # ~ make build-ebpf 1. To build KRIE, run: # ~ make build 1. To install KRIE (copy to /usr/bin/krie) run: # ~ make install ### Getting started KRIe needs to run as root. Run `sudo krie -h` to get help. # ~ krie -h Usage: krie [flags] Flags: --config string KRIe config file (default “./cmd/krie/run/config/default\_config.yaml”) -h, --help help for krie ### Configuration ## Log level, options are: panic, fatal, error, warn, info, debug or trace log\_level: debug ## JSON output file, leave empty to disable JSON output. output: “/tmp/krie.json” ## BTF information for the current kernel in .tar.xz format (required only if KRIE isn’t able to locate it by itself) vmlinux: “” ## events configuration events: ## action taken when an init\_module event is detected init\_module: log ## action taken when an delete\_module event is detected delete\_module: log ## action taken when a bpf event is detected bpf: log ## action taken when a bpf\_filter event is detected bpf\_filter: log ## action taken when a ptrace event is detected ptrace: log ## action taken when a kprobe event is detected kprobe: log ## action taken when a sysctl event is detected sysctl: action: log ## Default settings for sysctl programs (kernel 5.2+ only) sysctl\_default: block\_read\_access: false block\_write\_access: false ## Custom settings for sysctl programs (kernel 5.2+ only) sysctl\_parameters: kernel/yama/ptrace\_scope: block\_write\_access: true kernel/ftrace\_enabled: override\_input\_value\_with: “1\n” ## action taken when a hooked\_syscall\_table event is detected hooked\_syscall\_table: log ## action taken when a hooked\_syscall event is detected hooked\_syscall: log ## kernel\_parameter event configuration kernel\_parameter: action: log periodic\_action: log ticker: 1 # sends at most one event every [ticker] second(s) list: - symbol: system/kprobes\_all\_disarmed expected\_value: 0 size: 4 # - symbol: system/selinux\_state # expected\_value: 256 # size: 2 # sysctl - symbol: system/ftrace\_dump\_on\_oops expected\_value: 0 size: 4 - symbol: system/kptr\_restrict expected\_value: 0 size: 4 - symbol: system/randomize\_va\_space expected\_value: 2 size: 4 - symbol: system/stack\_tracer\_enabled expected\_value: 0 size: 4 - symbol: system/unprivileged\_userns\_clone expected\_value: 0 size: 4 - symbol: system/unprivileged\_userns\_apparmor\_policy expected\_value: 1 size: 4 - symbol: system/sysctl\_unprivileged\_bpf\_disabled expected\_value: 1 size: 4 - symbol: system/ptrace\_scope expected\_value: 2 size: 4 - symbol: system/sysctl\_perf\_event\_paranoid expected\_value: 2 size: 4 - symbol: system/kexec\_load\_disabled expected\_value: 1 size: 4 - symbol: system/dmesg\_restrict expected\_value: 1 size: 4 - symbol: system/modules\_disabled expected\_value: 0 size: 4 - symbol: system/ftrace\_enabled expected\_value: 1 size: 4 - symbol: system/ftrace\_disabled expected\_value: 0 size: 4 - symbol: system/sysctl\_protected\_fifos expected\_value: 1 size: 4 - symbol: system/sysctl\_protected\_hardlinks expected\_value: 1 size: 4 - symbol: system/sysctl\_protected\_regular expected\_value: 2 size: 4 - symbol: system/sysctl\_protected\_symlinks expected\_value: 1 size: 4 - symbol: system/sysctl\_unprivileged\_userfaultfd expected\_value: 0 size: 4 ## action to check when a register\_check fails on a sensitive kernel space hook point register\_check: log ## Documentation - The first version of KRIe was announced at BlackHat 2022, during the briefing: [Return to Sender - Detecting Kernel Exploits with eBPF](https://www.blackhat.com/us-22/briefings/schedule/index.html#return-to-sender---detecting-kernel-exploits-with-ebpf-27127) ## License - The golang code is under Apache 2.0 License. - The eBPF programs are under the GPL v2 License. ## GitHub: > **[GitHub - Gui774ume/krie: Linux Kernel Runtime Integrity with eBPF](https://github.com/Gui774ume/krie)** > > Linux Kernel Runtime Integrity with eBPF