$30 off During Our Annual Pro Sale. View Details »

Securing CI/CD Systems Through eBPF (recap)

whywaita
PRO
November 24, 2022

Securing CI/CD Systems Through eBPF (recap)

whywaita
PRO

November 24, 2022
Tweet

More Decks by whywaita

Other Decks in Technology

Transcript

  1. 4FDVSJOH$*$%4ZTUFNT 5ISPVHIF#1' ,VCFSOFUFT.FFUVQ5PLZP ,VCF$PO/"3FDBQ $ZCFS"HFOU *ODத੢ ݐొ XIZXBJUB

  2. த੢ ݐొ XIZXBJUB  $MPVE.BLFSBU$ZCFS"HFOU *OD  ϓϥΠϕʔτΫϥ΢υ *BB4 

    ϚωʔδυαʔϏε։ൃ TFMGIPTUFESVOOFSJO(JU)VC"DUJPOT  XIZXBJUBNZTIPFT044EFWFMPQFS  झຯࣗ୐αʔό ,T!IPNF ϙʔΧʔ  ,VCF$POॳࢀઓ ॳւ֎  ೖࠃΠϯλϏϡʔͰҰഊ 5IBOLZPVBNTZ😭
  3. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

  4. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • CZ"MFY*MHBZFW $ZDPEF ◦ IUUQTDZDPEFDPN • IUUQTTDIFEDP"V[ • IUUQTXXXZPVUVCFDPNXBUDI

    WQD#(3'W4SW : • $*$%ΛηΩϡΞʹߦ͏ͨΊʹF#1'Λར༻͢ΔࢼΈ
  5. • &YUFOEFE#FSLFMFZ1BDLFU'JMUFS • -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ◦ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎

    • /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ◦ ,VCFSOFUFT$/* .POJUPSJOH"HFOU લఏ஌ࣝF#1'
  6. • &YUFOEFE#FSLFMFZ1BDLFU'JMUFS • -JOVY,FSOFMͷ4BOECPYͰίʔυΛ࣮ߦ͢Δ࢓૊ ◦ ϦίϯύΠϧෆཁ Ͱ ҆શ ͔ͭ ߴ଎

    • /FUXPSL 0CTFSWBCJMJUZͷར༻ࣄྫ͕ଟΊ ◦ ,VCFSOFUFT$/*$JMJVN ◦ .POJUPSJOH"HFOUEBUBEPHBHFOU FCQG@FYQPSUFS લఏ஌ࣝF#1'
  7. IUUQTUXJUUFSDPNHSBGBOBTUBUVT લఏ஌ࣝF#1'

  8. IUUQTHSBGBOBDPNCMPHHSBGBOBBOEDJMJVNEFFQFCQGQPXFSFEPCTFSWBCJMJUZGPSLVCFSOFUFTBOEDMPVE OBUJWFJOGSBTUSVDUVSF લఏ஌ࣝF#1'

  9. ຊ୊

  10. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • $*$%ʹ͓͚ΔηΩϡϦςΟࣄҊ ◦ 4PMBS8JOETॺ໊෇͖ϑΝΠϧͷॻ׵ ◦ $PEF$PWCBTIJOTUBMMFSͷॻ׵ ◦ /1. 1Z1*αϓϥΠνΣʔϯΞλοΫ

    • $*$%πʔϧ ͷηΩϡϦςΟରࡦ͸೉͍͠ ◦ ڧݖݶ شൃ͢Δ؀ڥ ௿Մ؍ଌੑ
  11. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • ఏҊ$*$%΁F#1'ϕʔεͳ"HFOUͷಋೖ • XIZF#1' ◦ ؆୯ʹՄ؍ଌੑͱηΩϡϦςΟχʔζΛߴΊΒΕΔ ◦ ࠷৽ΧʔωϧͰಈ࡞͢Δ ◦

    ڧྗͳίϛϡχςΟͱπʔϧ • $JMJVN5FUSBHPOͷ࠾༻
  12. • F#1'CBTFE 4FDVSJUZ0CTFSWBCJMJUZ ηΩϡϦςΟͷՄ؍ଌੑ BOE 3VOUJNF&OGPSDFNFOU ϦΞϧλΠϜ࣮ߦ੍ޚ • ੨ࢁ͞ΜʹΑΔ೔ຊޠهࣄ $JMJVN1SPKFDU͔Βެ։ʂ

    F#1'Λ༻͍ͯηΩϡϦςΟͷՄ؍ଌੑΛ΋ͨΒ͢5FUSBHPOcHJIZPKQ $JMJVN5FUSBHPO IUUQTHJUIVCDPNDJMJVNUFUSBHPO ͔Θ͍͍ˠ
  13. $JMJVN5FUSBHPO

  14. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • $*$%γεςϜʹ$JMJVN5FUSBHPOΛಋೖ ◦ $*$%γεςϜʹ͓͚Δzಈ࡞Λ؍ଌ͢Δ ◦ ϓϩηε ίωΫγϣϯ ϑΝΠϧ *0৘ใ

    • 5FUSBHPO࠾༻ཧ༝ ◦ LQSPCFΛ࢝Ίͱͯ͠ଟ͘ͷσʔλ͕औಘՄೳ ◦ LTҎ֎ͷ؀ڥͰ΋ಈ࡞͢Δ
  15. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

  16. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ • Ϗϧυ؀ڥͷ0CTFSWBMJCJUZ ◦ ϓϩηε ઀ଓઌυϝΠϯ *1 • ιʔείʔυͷ׬શੑ֬อ ◦

    HPϑΝΠϧͷॻ׵Λ؂ࢹ • ௨৴ઌͷ੍ޚ ◦ ڐՄͯ͠ͳ͍*1υϝΠϯ΁ͷ઀ଓՄ൱ • (JU)VC"DUJPOT্Ͱಈ࡞͢ΔΑ͏ߏஙࡁ
  17. 1P$ͷ࣮૷಺༰ʹ͍ͭͯ

  18. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' HJUDMPOF࣌ͷ HJUIVCDPN΁ͷ઀ଓ UDQ@DPOOFDU ΛUSBDJOH͢Δ͜ͱͰ؍ଌ੒ޭ

  19. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' TFUVQHP಺Ͱ࣮ߦ͞Ε͍ͯΔ ϓϩηε৘ใͷ؍ଌ੒ޭ

  20. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • σϞ ◦ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--

    ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
  21. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • σϞ ◦ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--

    ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
  22. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

  23. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' • σϞ ◦ Ϗϧυதͷ HPϑΝΠϧͷॻ׵ 4*(,*-- ◦ ڐՄ͍ͯ͠ͳ͍*1΁ͷ௨৴ 4*(,*--

    ◦ ڐՄ͍ͯ͠ͳ͍ϓϩηεͷੜ੒ 4*(,*--
  24. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1' (JU)VC"DUJPOT্ͷઃఆϑΝΠϧ͔Β $JMJVN5FUSBHPOͷઃఆΛੜ੒

  25. ·ͱΊ • F#1' $JMJVN5FUSBHPO͸ύϫϑϧͳςΫϊϩδʔ • $*$%͸F#1'ʹΑͬͯ͞ΒʹηΩϡΞʹͳΔ • ࠓޙ͸1P$Ͱ࢖ͬͨ"HFOUΛ044Խ༧ఆ ◦ ͞Εͯ·ͨ͠

    IUUQTHJUIVCDPN$ZDPEF-BCTFCQGBHFOUBDUJPO • $POUSJCVUF଴ͬͯΔΑʂ
  26. ײ૝ • 5FUSBHPOͷڧྗ͞Λेೋ෼ʹ׆͔͢ൃද ◦ 0CTFSWBCJMJUZ 3VOUJNF&OGPSDFNFOU ◦ ϕετϑΟοτ • ʮؾΛ͚ͭΔʯҎ্ͷ͜ͱ͕ग़དྷΔΑ͏ʹ

    ◦ $*$%ͷΑ͏ʹʮॏཁ͚ͩͲ޻਺ׂ͕͔Εʹ͍͘ʯ෺͸ ಛʹ͜ͷΑ͏ͳऔΓ૊Έ͕ඞཁʹͳΓͦ͏
  27. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ ϓϥΠϕʔτΫϥ΢υͰͷ(JU)VC"DUJPOTج൫Λ ։ൃɾӡ༻த IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT

  28. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳTFMGIPTUFESVOOFS XIZXBJUBNZTIPFT

  29. 4FDVSJOH$*$%4ZTUFNT5ISPVHIF#1'

  30. αΠόʔΤʔδΣϯτͰͷऔΓ૊Έ IUUQTXXXTMJEFTIBSFOFUXIZXBJUBEFWFMPQNFOUNZTIPFTBOEQSPWJEFDZDMPVEIPTUFESVOOFSHJUIVCBDUJPOT XJUIZPVSTIPFT ಈతͳ TFMGIPTUFESVOOFS XIZXBJUBNZTIPFT .BOBHFE 1P$"HFOU4FSWFS

  31. Q?