GoLeash

Runtime enforcement of software supply chain capabilities in Go

Runnable example

Run a Go program invoking some denied capability, with goleash runtime enforcement attached.

cd examples/example_unrestrict

First, generate the hashes for allowed invocations of capabilities, for the trusted initial version of the program.

make all-hash

Execute the trusted version of the program.

make all

Then, add a new denied capability invocation to the program.

sed -i '27,31s/^[[:space:]]*\/\/[[:space:]]*TestReadFile()/TestReadFile()/' dependencyC/dep.go

Execute the compromised version of the program, with the same previously generated hashes.

make all

Syscall tracing

This tool allows you to track syscalls for a specified binary using eBPF.

Prerequisites

Building the Tracer

1. Navigate to the track_syscalls folder and build the tracer

cd track_syscalls
make

Testing with CoreDNS

To demonstrate the syscall tracking capabilities, we'll use CoreDNS as an example.

Compiling and Running CoreDNS

1. Navigate to the CoreDNS folder. Compile and run CoreDNS using the provided script:

./build_and_run.sh

This script will build CoreDNS and start it with a default configuration.

Tracking CoreDNS Syscalls

1. In a new terminal window, navigate back to the track_syscalls folder.
2. Run the syscall tracker (with root privileges), pointing it to the CoreDNS binary:

sudo ./bpf_loader -binary /binary_path -allowlist /allowlist_path

Replace /binary_path with the actual path to the binary you want to monitor. Replace /allowlist_path with the actual path to the allowlist.

3. The program will start tracking syscalls for the specified binary. You'll see output in the termi>

4. To stop the tracking, press Ctrl+C.

Sending a Test Request to CoreDNS

To generate some DNS activity and observe the syscalls:

1. Open another terminal window.

2. Execute the test request script:

./make_request.sh

This script will send a DNS query to the running CoreDNS instance.

3. Observe the syscall tracking output in the terminal where you ran bpf_loader.

You should now see the syscalls triggered by CoreDNS in response to the DNS query, allowing you to analyze its behavior at the system call level.