feat(ebpf): implement sandbox mode for FileMon and ProcMon

bombini-common/src/config.rs

@@ -1,4 +1,5 @@
 //! Config module represents data structures to initialize detectors maps.
 
+pub mod filemon;
 pub mod procmon;
 pub mod rule;

bombini-common/src/config/filemon.rs

@@ -0,0 +1,15 @@
+use crate::event::file::FileEventNumber;
+
+#[derive(Debug, Copy, Clone)]
+#[repr(C)]
+pub struct FileMonKernelConfig {
+    /// Option -> sandbox enabled, bool value deny_list
+    pub sandbox_mode: [Option<bool>; FileEventNumber::TotalFileEvents as usize],
+}
+
+#[cfg(feature = "user")]
+pub mod user {
+    use super::*;
+
+    unsafe impl aya::Pod for FileMonKernelConfig {}
+}

bombini-common/src/config/procmon.rs

@@ -1,7 +1,11 @@
+use crate::event::process::ProcessEventNumber;
+
 #[derive(Debug, Copy, Clone)]
 #[repr(C)]
 pub struct ProcMonKernelConfig {
     pub ima_hash: bool,
+    /// Option -> sandbox enabled, bool value deny_list
+    pub sandbox_mode: [Option<bool>; ProcessEventNumber::TotalProcessEvents as usize],
 }
 
 #[cfg(feature = "user")]

bombini-common/src/event.rs

@@ -7,6 +7,7 @@ pub mod network;
 pub mod process;
 
 /// Generic event for ring buffer
+#[repr(C)]
 pub struct GenericEvent {
     pub ktime: u64,
     /// event enum discriminant for fast access

bombini-common/src/event/file.rs

@@ -13,6 +13,8 @@ pub struct FileMsg {
     pub process: ProcessKey,
     pub parent: ProcessKey,
     pub event: FileEventVariant,
+    /// true if event is blocked by corresponding LSM hook
+    pub blocked: bool,
     pub rule_idx: Option<u8>,
 }
 

bombini-common/src/event/process.rs

@@ -412,6 +412,8 @@ pub struct ProcessMsg {
     pub process: ProcessKey,
     pub parent: ProcessKey,
     pub event: ProcessEventVariant,
+    /// true if event is blocked by corresponding LSM hook
+    pub blocked: bool,
     pub rule_idx: Option<u8>,
 }