$30 off During Our Annual Pro Sale. View Details »

Securing CI/CD Systems Through eBPF (recap)

whywaita
PRO
November 24, 2022

Securing CI/CD Systems Through eBPF (recap)

whywaita
PRO

November 24, 2022
Tweet

More Decks by whywaita

Other Decks in Technology

Transcript

  1. 4FDVSJOH$*$%4ZTUFNT
    5ISPVHIF#1'
    ,VCFSOFUFT.FFUVQ5PLZP ,VCF$PO/"3FDBQ
    $ZCFS"HFOU *ODத੢ ݐొ XIZXBJUB

    View Slide

  2. த੢ ݐొ XIZXBJUB
    $MPVE.BLFSBU$ZCFS"HFOU *OD
    ϓϥΠϕʔτΫϥ΢υ *BB4

    ϚωʔδυαʔϏε։ൃ
    TFMGIPTUFESVOOFSJO(JU)VC"DUJPOT

    XIZXBJUBNZTIPFT044EFWFMPQFS
    झຯࣗ୐αʔό ,T!IPNF
    ϙʔΧʔ
    ,VCF$POॳࢀઓ ॳւ֎
    ೖࠃΠϯλϏϡʔͰҰഊ 5IBOLZPVBNTZ😭

    View Slide

  3. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

    View Slide

  4. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● CZ"MFY*MHBZFW $ZDPEF
    ○ IUUQTDZDPEFDPN
    ● IUUQTTDIFEDP"V[
    ● IUUQTXXXZPVUVCFDPNXBUDI WQD#(3'W4SW
    :
    ● $*$%ΛηΩϡΞʹߦ͏ͨΊʹF#1'Λར༻͢ΔࢼΈ

    View Slide

  5. ● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS
    ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊
    ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎
    ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ
    ○ ,VCFSOFUFT$/* .POJUPSJOH"HFOU
    લఏ஌ࣝF#1'

    View Slide

  6. ● &YUFOEFE#FSLFMFZ1BDLFU'JMUFS
    ● -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊
    ○ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎
    ● /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ
    ○ ,VCFSOFUFT$/*$JMJVN
    ○ .POJUPSJOH"HFOUEBUBEPHBHFOU FCQG@FYQPSUFS
    લఏ஌ࣝF#1'

    View Slide

  7. IUUQTUXJUUFSDPNHSBGBOBTUBUVT
    લఏ஌ࣝF#1'

    View Slide

  8. IUUQTHSBGBOBDPNCMPHHSBGBOBBOEDJMJVNEFFQFCQGQPXFSFEPCTFSWBCJMJUZGPSLVCFSOFUFTBOEDMPVE
    OBUJWFJOGSBTUSVDUVSF
    લఏ஌ࣝF#1'

    View Slide

  9. ຊ୊

    View Slide

  10. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● $*$%ʹ͓͚ΔηΩϡϦςΟࣄҊ
    ○ 4PMBS8JOETॺ໊෇͖ϑΝΠϧͷॻ׵
    ○ $PEF$PWCBTIJOTUBMMFSͷॻ׵
    ○ /1. 1Z1*αϓϥΠνΣʔϯΞλοΫ
    ● $*$%πʔϧ ͷηΩϡϦςΟରࡦ͸೉͍͠
    ○ ڧݖݶ شൃ͢Δ؀ڥ ௿Մ؍ଌੑ

    View Slide

  11. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● ఏҊ$*$%΁F#1'ϕʔεͳ"HFOUͷಋೖ
    ● XIZF#1'
    ○ ؆୯ʹՄ؍ଌੑͱηΩϡϦςΟχʔζΛߴΊΒΕΔ
    ○ ࠷৽ΧʔωϧͰಈ࡞͢Δ
    ○ ڧྗͳίϛϡχςΟͱπʔϧ
    ● $JMJVN5FUSBHPOͷ࠾༻

    View Slide

  12. ● F#1'CBTFE
    4FDVSJUZ0CTFSWBCJMJUZ ηΩϡϦςΟͷՄ؍ଌੑ

    BOE
    3VOUJNF&OGPSDFNFOU ϦΞϧλΠϜ࣮ߦ੍ޚ

    ● ੨ࢁ͞ΜʹΑΔ೔ຊޠهࣄ
    $JMJVN1SPKFDU͔Βެ։ʂ
    F#1'Λ༻͍ͯηΩϡϦςΟͷՄ؍ଌੑΛ΋ͨΒ͢5FUSBHPOcHJIZPKQ
    $JMJVN5FUSBHPO
    IUUQTHJUIVCDPNDJMJVNUFUSBHPO ͔Θ͍͍ˠ

    View Slide

  13. $JMJVN5FUSBHPO

    View Slide

  14. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● $*$%γεςϜʹ$JMJVN5FUSBHPOΛಋೖ
    ○ $*$%γεςϜʹ͓͚Δzಈ࡞Λ؍ଌ͢Δ
    ○ ϓϩηε ίωΫγϣϯ ϑΝΠϧ *0৘ใ
    ● 5FUSBHPO࠾༻ཧ༝
    ○ LQSPCFΛ࢝Ίͱͯ͠ଟ͘ͷσʔλ͕औಘՄೳ
    ○ LTҎ֎ͷ؀ڥͰ΋ಈ࡞͢Δ

    View Slide

  15. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

    View Slide

  16. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ
    ● Ϗϧυ؀ڥͷ0CTFSWBMJCJUZ
    ○ ϓϩηε ઀ଓઌυϝΠϯ *1
    ● ιʔείʔυͷ׬શੑ֬อ
    ○ HPϑΝΠϧͷॻ׵Λ؂ࢹ
    ● ௨৴ઌͷ੍ޚ
    ○ ڐՄͯ͠ͳ͍*1υϝΠϯ΁ͷ઀ଓՄ൱
    ● (JU)VC"DUJPOT্Ͱಈ࡞͢ΔΑ͏ߏஙࡁ

    View Slide

  17. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ

    View Slide

  18. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    HJUDMPOF࣌ͷ HJUIVCDPN΁ͷ઀ଓ
    UDQ@DPOOFDU
    ΛUSBDJOH͢Δ͜ͱͰ؍ଌ੒ޭ

    View Slide

  19. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    TFUVQHP಺Ͱ࣮ߦ͞Ε͍ͯΔ
    ϓϩηε৘ใͷ؍ଌ੒ޭ

    View Slide

  20. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

    View Slide

  21. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

    View Slide

  22. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

    View Slide

  23. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    ● σϞ
    ○ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--
    ○ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--

    View Slide

  24. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'
    (JU)VC"DUJPOT্ͷઃఆϑΝΠϧ͔Β
    $JMJVN5FUSBHPOͷઃఆΛੜ੒

    View Slide

  25. ·ͱΊ
    ● F#1' $JMJVN5FUSBHPO͸ύϫϑϧͳςΫϊϩδʔ
    ● $*$%͸F#1'ʹΑͬͯ͞ΒʹηΩϡΞʹͳΔ
    ● ࠓޙ͸1P$Ͱ࢖ͬͨ"HFOUΛ044Խ༧ఆ
    ○ ͞Εͯ·ͨ͠
    IUUQTHJUIVCDPN$ZDPEF-BCTFCQGBHFOUBDUJPO
    ● $POUSJCVUF଴ͬͯΔΑʂ

    View Slide

  26. ײ૝
    ● 5FUSBHPOͷڧྗ͞Λेೋ෼ʹ׆͔͢ൃද
    ○ 0CTFSWBCJMJUZ 3VOUJNF&OGPSDFNFOU
    ○ ϕετϑΟοτ
    ● ʮؾΛ͚ͭΔʯҎ্ͷ͜ͱ͕ग़དྷΔΑ͏ʹ
    ○ $*$%ͷΑ͏ʹʮॏཁ͚ͩͲ޻਺ׂ͕͔Εʹ͍͘ʯ෺͸
    ಛʹ͜ͷΑ͏ͳऔΓ૊Έ͕ඞཁʹͳΓͦ͏

    View Slide

  27. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    ϓϥΠϕʔτΫϥ΢υͰͷ(JU)VC"DUJPOTج൫Λ
    ։ൃɾӡ༻த
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT

    View Slide

  28. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT
    ಈతͳTFMGIPTUFESVOOFS XIZXBJUBNZTIPFT

    View Slide

  29. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

    View Slide

  30. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ
    IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT
    XJUIZPVSTIPFT
    ಈతͳ TFMGIPTUFESVOOFS XIZXBJUBNZTIPFT

    .BOBHFE
    1P$"HFOU4FSWFS

    View Slide

  31. Q?

    View Slide