Securing CI/CD Systems Through eBPF (recap)

by whywaita

Slide 1

Slide 1 text

4FDVSJOH$*$%4ZTUFNT 5ISPVHIF#1' ,VCFSOFUFT.FFUVQ5PLZP ,VCF$PO/"3FDBQ $ZCFS"HFOU *ODத੢ ݐొ XIZXBJUB

Slide 2

Slide 2 text

த੢ ݐొ XIZXBJUB $MPVE.BLFSBU$ZCFS"HFOU *OD ϓϥΠϕʔτΫϥ΢υ *BB4 ϚωʔδυαʔϏε։ൃ TFMGIPTUFESVOOFSJO(JU)VC"DUJPOT XIZXBJUBNZTIPFT044EFWFMPQFS झຯࣗ୐αʔό ,T!IPNF ϙʔΧʔ ,VCF$POॳࢀઓ ॳւ֎ ೖࠃΠϯλϏϡʔͰҰഊ 5IBOLZPVBNTZ😭

Slide 3

Slide 3 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

Slide 4

Slide 4 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● CZ"MFY*MHBZFW $ZDPEF ○ IUUQTDZDPEFDPN ● IUUQTTDIFEDP"V[ ● IUUQTXXXZPVUVCFDPNXBUDI WQD#(3'W4SW : ● $*$%ΛηΩϡΞʹߦ͏ͨΊʹF#1'Λར༻͢ΔࢼΈ

Slide 5

Slide 5 text

● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎ ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ○ ,VCFSOFUFT$/* .POJUPSJOH"HFOU લఏ஌ࣝF#1'

Slide 6

Slide 6 text

● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎ ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ○ ,VCFSOFUFT$/*$JMJVN ○ .POJUPSJOH"HFOUEBUBEPHBHFOU FCQG@FYQPSUFS લఏ஌ࣝF#1'

Slide 7

Slide 7 text

IUUQTUXJUUFSDPNHSBGBOBTUBUVT લఏ஌ࣝF#1'

Slide 8

Slide 8 text

IUUQTHSBGBOBDPNCMPHHSBGBOBBOEDJMJVNEFFQFCQGQPXFSFEPCTFSWBCJMJUZGPSLVCFSOFUFTBOEDMPVE OBUJWFJOGSBTUSVDUVSF લఏ஌ࣝF#1'

Slide 9

Slide 9 text

ຊ୊

Slide 10

Slide 10 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● $*$%ʹ͓͚ΔηΩϡϦςΟࣄҊ ○ 4PMBS8JOETॺ໊෇͖ϑΝΠϧͷॻ׵ ○ $PEF$PWCBTIJOTUBMMFSͷॻ׵ ○ /1. 1Z1*αϓϥΠνΣʔϯΞλοΫ ● $*$%πʔϧ ͷηΩϡϦςΟରࡦ͸೉͍͠ ○ ڧݖݶ شൃ͢Δ؀ڥ ௿Մ؍ଌੑ

Slide 11

Slide 11 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● ఏҊ$*$%΁F#1'ϕʔεͳ"HFOUͷಋೖ ● XIZF#1' ○ ؆୯ʹՄ؍ଌੑͱηΩϡϦςΟχʔζΛߴΊΒΕΔ ○ ࠷৽ΧʔωϧͰಈ࡞͢Δ ○ ڧྗͳίϛϡχςΟͱπʔϧ ● $JMJVN5FUSBHPOͷ࠾༻

Slide 12

Slide 12 text

● F#1'CBTFE 4FDVSJUZ0CTFSWBCJMJUZ ηΩϡϦςΟͷՄ؍ଌੑ BOE 3VOUJNF&OGPSDFNFOU ϦΞϧλΠϜ࣮ߦ੍ޚ ● ੨ࢁ͞ΜʹΑΔ೔ຊޠهࣄ $JMJVN1SPKFDU͔Βެ։ʂ F#1'Λ༻͍ͯηΩϡϦςΟͷՄ؍ଌੑΛ΋ͨΒ͢5FUSBHPOcHJIZPKQ $JMJVN5FUSBHPO IUUQTHJUIVCDPNDJMJVNUFUSBHPO ͔Θ͍͍ˠ

Slide 13

Slide 13 text

$JMJVN5FUSBHPO

Slide 14

Slide 14 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● $*$%γεςϜʹ$JMJVN5FUSBHPOΛಋೖ ○ $*$%γεςϜʹ͓͚Δzಈ࡞Λ؍ଌ͢Δ ○ ϓϩηε ίωΫγϣϯ ϑΝΠϧ *0৘ใ ● 5FUSBHPO࠾༻ཧ༝ ○ LQSPCFΛ࢝Ίͱͯ͠ଟ͘ͷσʔλ͕औಘՄೳ ○ LTҎ֎ͷ؀ڥͰ΋ಈ࡞͢Δ

Slide 15

Slide 15 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

Slide 16

Slide 16 text

1P$ͷ࣮૷಺༰ʹ͍ͭͯ ● Ϗϧυ؀ڥͷ0CTFSWBMJCJUZ ○ ϓϩηε ઀ଓઌυϝΠϯ *1 ● ιʔείʔυͷ׬શੑ֬อ ○ HPϑΝΠϧͷॻ׵Λ؂ࢹ ● ௨৴ઌͷ੍ޚ ○ ڐՄͯ͠ͳ͍*1υϝΠϯ΁ͷ઀ଓՄ൱ ● (JU)VC"DUJPOT্Ͱಈ࡞͢ΔΑ͏ߏஙࡁ

Slide 17

Slide 17 text

1P$ͷ࣮૷಺༰ʹ͍ͭͯ

Slide 18

Slide 18 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' HJUDMPOF࣌ͷ HJUIVCDPN΁ͷ઀ଓ UDQ@DPOOFDU ΛUSBDJOH͢Δ͜ͱͰ؍ଌ੒ޭ

Slide 19

Slide 19 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' TFUVQHP಺Ͱ࣮ߦ͞Ε͍ͯΔ ϓϩηε৘ใͷ؍ଌ੒ޭ

Slide 20

Slide 20 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● σϞ ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

Slide 21

Slide 21 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● σϞ ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

Slide 22

Slide 22 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

Slide 23

Slide 23 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' ● σϞ ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*-- ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

Slide 24

Slide 24 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' (JU)VC"DUJPOT্ͷઃఆϑΝΠϧ͔Β $JMJVN5FUSBHPOͷઃఆΛੜ੒

Slide 25

Slide 25 text

·ͱΊ ● F#1' $JMJVN5FUSBHPO͸ύϫϑϧͳςΫϊϩδʔ ● $*$%͸F#1'ʹΑͬͯ͞ΒʹηΩϡΞʹͳΔ ● ࠓޙ͸1P$Ͱ࢖ͬͨ"HFOUΛ044Խ༧ఆ ○ ͞Εͯ·ͨ͠ IUUQTHJUIVCDPN$ZDPEF-BCTFCQGBHFOUBDUJPO ● $POUSJCVUF଴ͬͯΔΑʂ

Slide 26

Slide 26 text

ײ૝ ● 5FUSBHPOͷڧྗ͞Λेೋ෼ʹ׆͔͢ൃද ○ 0CTFSWBCJMJUZ 3VOUJNF&OGPSDFNFOU ○ ϕετϑΟοτ ● ʮؾΛ͚ͭΔʯҎ্ͷ͜ͱ͕ग़དྷΔΑ͏ʹ ○ $*$%ͷΑ͏ʹʮॏཁ͚ͩͲ޻਺ׂ͕͔Εʹ͍͘ʯ෺͸ ಛʹ͜ͷΑ͏ͳऔΓ૊Έ͕ඞཁʹͳΓͦ͏

Slide 27

Slide 27 text

αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ ϓϥΠϕʔτΫϥ΢υͰͷ(JU)VC"DUJPOTج൫Λ ։ൃɾӡ༻த IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT

Slide 28

Slide 28 text

αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳTFMGIPTUFESVOOFS XIZXBJUBNZTIPFT

Slide 29

Slide 29 text

4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

Slide 30

Slide 30 text

αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳ TFMGIPTUFESVOOFS XIZXBJUBNZTIPFT .BOBHFE 1P$"HFOU4FSWFS

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text