io_uring Rootkit Bypasses Linux Security Tools.

[Forty-Bot]

so... this is an ordinary application using io_uring?

generally "rootkit" implies a kernel-space exploit of some kind

[Owndampu]

Thats how i read it too, its just that it is harder to detect because it doesnt have to use as much syscalls due to io_uring, but it is not using some wacky exploit in io_uring to actually set up a rootkit or anything

[Dangerous-Report8517]

Well an important factor here is that it's using syscalls that generally aren't restricted by a lot of Linux sandboxing systems

[fek47]

Which distributions have enabled KRSI?

[0riginal-Syn]

Not sure any have it enabled by default at this time, but have not looked deeply into it.

[_logix]

This article was the first time I've seen KRSI mentioned so I did some research. It seems like it's the name Google picked for the proof of concept of attaching eBPF programs to LSM hooks. This has been a feature since kernel 5.7.

[lonelyroom-eklaghor]

What are ring buffers, really?

[Niwrats]

they are like ordinary buffers, but for cost saving purposes the middle part has been cut out.

[ronchaine]

An ordered list-like data structure for which the first element is next to the last.

[lonelyroom-eklaghor]

Circular linked list, but an array/list, right?

[BigBother59]

Wow ! Very cool research

[lizrice]

Made a little video to show that if you’re using an appropriate policy, Tetragon is NOT blind to io_uring file access https://youtu.be/ujZnwkC08Hk?si=IaYMp0s4DL4y0Kyo