probe.go

//go:build linux

package kfeatures

import (
	"crypto/rand"
	"encoding/hex"
	"errors"
	"fmt"
	"os"
	"os/exec"
	"slices"
	"strconv"
	"strings"
	"sync"

	"github.com/cilium/ebpf"
	"github.com/cilium/ebpf/features"
	"golang.org/x/sys/unix"
)

// Cache for Probe() results. Kernel features don't change at runtime,
// so we cache after the first probe to avoid repeated syscalls.
var (
	cachedFeatures *SystemFeatures
	cacheMu        sync.Mutex
	cacheErr       error
)

// probeConfig holds the configuration for a probe operation.
type probeConfig struct {
	programTypes       []ebpf.ProgramType
	securitySubsystems bool
	kernelConfig       bool
	capabilities       bool
	jit                bool
	filesystems        bool
	syscalls           bool
	mitigations        bool
	namespaces         bool
	lsmPath            string // custom path for LSM file (for testing)
}

// ProbeOption configures what [ProbeWith] collects for diagnostics/reporting.
// Probe options are not readiness requirements and are intentionally separate
// from [Requirement] values consumed by [Check].
type ProbeOption func(*probeConfig)

// WithProgramTypes probes the specified eBPF program types.
func WithProgramTypes(types ...ebpf.ProgramType) ProbeOption {
	return func(c *probeConfig) {
		c.programTypes = append(c.programTypes, types...)
	}
}

// WithSecuritySubsystems probes security subsystem status (LSM list, IMA).
func WithSecuritySubsystems() ProbeOption {
	return func(c *probeConfig) {
		c.securitySubsystems = true
	}
}

// WithKernelConfig parses and includes kernel configuration.
func WithKernelConfig() ProbeOption {
	return func(c *probeConfig) {
		c.kernelConfig = true
	}
}

// WithCapabilities probes process capabilities (CAP_BPF, CAP_SYS_ADMIN, CAP_PERFMON),
// unprivileged BPF access status, and BPF runtime stats status.
func WithCapabilities() ProbeOption {
	return func(c *probeConfig) {
		c.capabilities = true
	}
}

// WithJIT probes BPF JIT compiler status (enabled, hardening, kallsyms, memory limit).
func WithJIT() ProbeOption {
	return func(c *probeConfig) {
		c.jit = true
	}
}

// WithSyscalls probes availability of BPF-relevant syscalls (bpf(), perf_event_open).
func WithSyscalls() ProbeOption {
	return func(c *probeConfig) {
		c.syscalls = true
	}
}

// WithNamespaces probes namespace context (user namespace, PID namespace).
func WithNamespaces() ProbeOption {
	return func(c *probeConfig) {
		c.namespaces = true
	}
}

// WithMitigations probes CPU vulnerability mitigations that affect BPF JIT codegen
// and reads CONFIG_BPF_JIT_ALWAYS_ON from kernel config.
func WithMitigations() ProbeOption {
	return func(c *probeConfig) {
		c.mitigations = true
		c.kernelConfig = true // needed for CONFIG_BPF_JIT_ALWAYS_ON
	}
}

// WithFilesystems probes filesystem mounts relevant to BPF operations
// (tracefs, debugfs, securityfs, bpffs).
func WithFilesystems() ProbeOption {
	return func(c *probeConfig) {
		c.filesystems = true
	}
}

// WithLSMPath sets a custom path for the LSM file.
// This is primarily for testing; production code uses the default /sys/kernel/security/lsm.
func WithLSMPath(path string) ProbeOption {
	return func(c *probeConfig) {
		c.lsmPath = path
	}
}

// WithAll enables probing of all features.
func WithAll() ProbeOption {
	return func(c *probeConfig) {
		c.programTypes = []ebpf.ProgramType{
			ebpf.LSM,
			ebpf.Kprobe,
			ebpf.Tracing, // covers fentry/fexit
			ebpf.TracePoint,
		}
		c.securitySubsystems = true
		c.kernelConfig = true
		c.capabilities = true
		c.jit = true
		c.filesystems = true
		c.syscalls = true
		c.mitigations = true
		c.namespaces = true
	}
}

// ProbeWith probes kernel features based on the provided options.
// BTF and kernel version are always probed regardless of options (both are cheap).
// If no options are provided, only BTF and kernel version are populated.
func ProbeWith(opts ...ProbeOption) (*SystemFeatures, error) {
	cfg := &probeConfig{}
	for _, opt := range opts {
		opt(cfg)
	}

	sf := &SystemFeatures{}

	// Probe kernel config first (needed for kprobe.multi check)
	var kc *KernelConfig
	if cfg.kernelConfig {
		kc, _ = readKernelConfig()
		sf.KernelConfig = kc
		if kc != nil {
			sf.PreemptMode = kc.Preempt
		}
		// Ignore errors: kernel config is optional
	}

	// Probe syscall availability
	if cfg.syscalls {
		sf.BPFSyscall = probeBPFSyscall()
		sf.PerfEventOpen = probePerfEventOpen()
	}

	// Probe program types
	for _, pt := range cfg.programTypes {
		result := probeProgramType(pt)
		switch pt {
		case ebpf.LSM:
			sf.LSMProgramType = result
		case ebpf.Kprobe:
			sf.Kprobe = result
		case ebpf.Tracing:
			sf.Fentry = result
		case ebpf.TracePoint:
			sf.Tracepoint = result
		}
	}

	// Probe kprobe.multi separately (requires kernel config for CONFIG_FPROBE check)
	for _, pt := range cfg.programTypes {
		if pt == ebpf.Kprobe {
			sf.KprobeMulti = probeKprobeMulti(kc)
			break
		}
	}

	// Always probe BTF availability (cheap single stat, useful regardless of options)
	sf.BTF = probeBTF()

	// Always populate kernel version (cheap uname syscall, useful for diagnostics)
	sf.KernelVersion = probeKernelVersion()

	// Probe security subsystems
	if cfg.securitySubsystems {
		lsmPath := cfg.lsmPath
		if lsmPath == "" {
			lsmPath = defaultLSMPath
		}
		lsms, err := readActiveLSMsFrom(lsmPath)
		if err != nil {
			sf.BPFLSMEnabled = ProbeResult{Supported: false, Error: err}
			sf.IMAEnabled = ProbeResult{Supported: false, Error: err}
		} else {
			sf.ActiveLSMs = lsms
			sf.BPFLSMEnabled = ProbeResult{Supported: slices.Contains(lsms, "bpf")}
			// IMAEnabled: strict check, only true if "ima" is in LSM list.
			// This is required for bpf_ima_file_hash to work.
			sf.IMAEnabled = ProbeResult{Supported: slices.Contains(lsms, "ima")}
		}
		// IMADirectory: check if /sys/kernel/security/ima exists.
		// This indicates IMA is compiled in and securityfs is mounted,
		// but does not guarantee IMA is actively measuring files.
		sf.IMADirectory = probeIMADirectory()

		// IMAAnyMeasurementActive: check if any IMA measurement rule has fired.
		// Only probe if IMA is enabled (in LSM list) to avoid unnecessary exec.
		if sf.IMAEnabled.Supported {
			sf.IMAAnyMeasurementActive = probeIMAAnyMeasurementActive()
		}
	}

	// Probe capabilities
	if cfg.capabilities {
		sf.HasCapBPF = probeCapability(capBPF)
		sf.HasCapSysAdmin = probeCapability(capSysAdmin)
		sf.HasCapPerfmon = probeCapability(capPerfmon)
		sf.UnprivilegedBPFDisabled = probeUnprivilegedBPF()
		sf.BPFStatsEnabled = probeBPFStats()
	}

	// Probe JIT compiler status
	if cfg.jit {
		sf.JITEnabled = probeJITEnabled()
		sf.JITHardened = probeJITHardened()
		sf.JITKallsyms = probeJITKallsyms()
		sf.JITLimit = probeJITLimit()
	}

	// Probe filesystem mounts.
	//
	// TraceFS and BPFFS are gated features (FeatureTraceFS, FeatureBPFFS): a
	// caller asking "is bpffs ready?" wants to know whether they can pin maps,
	// not whether some directory exists at /sys/fs/bpf. We therefore verify
	// the filesystem is actually mounted with the expected superblock magic.
	//
	// DebugFS and SecurityFS are diagnostic-only fields (no Feature* gate),
	// so the looser presence-only check is sufficient for them.
	if cfg.filesystems {
		sf.TraceFS = probeFilesystemMountedAny(
			mountCandidate{path: tracefsPath, magic: unix.TRACEFS_MAGIC},
			mountCandidate{path: tracefsFallbackPath, magic: unix.TRACEFS_MAGIC},
		)
		sf.DebugFS = probeFilesystemPresent(debugfsPath)
		sf.SecurityFS = probeFilesystemPresent(securityfsPath)
		sf.BPFFS = probeFilesystemMounted(bpffsPath, unix.BPF_FS_MAGIC)
	}

	// Probe CPU mitigations and JIT-always-on
	if cfg.mitigations {
		sf.SpectreV1 = readVulnerabilityStatus(spectreV1Path)
		sf.SpectreV2 = readVulnerabilityStatus(spectreV2Path)
		if kc != nil {
			sf.JITAlwaysOn = kc.JITAlwaysOn
		}
	}

	// Probe namespace context
	if cfg.namespaces {
		sf.InInitUserNS = probeInitUserNS()
		sf.InInitPIDNS = probeInitPIDNS()
	}

	return sf, nil
}

// Probe probes all kernel features and caches the result.
// Subsequent calls return the cached result without re-probing.
// Use [ProbeNoCache] if you need fresh results.
func Probe() (*SystemFeatures, error) {
	cacheMu.Lock()
	defer cacheMu.Unlock()

	if cachedFeatures != nil || cacheErr != nil {
		return cachedFeatures, cacheErr
	}
	cachedFeatures, cacheErr = ProbeWith(WithAll())
	return cachedFeatures, cacheErr
}

// ProbeNoCache probes all kernel features without using the cache.
// Use this when you need fresh results, e.g., after loading kernel modules.
func ProbeNoCache() (*SystemFeatures, error) {
	return ProbeWith(WithAll())
}

// ResetCache clears cached probe results, forcing the next [Probe] call to re-probe.
// This is primarily useful for testing.
func ResetCache() {
	cacheMu.Lock()
	defer cacheMu.Unlock()
	cachedFeatures = nil
	cacheErr = nil
}

// probeProgramType checks if a BPF program type is supported.
func probeProgramType(pt ebpf.ProgramType) ProbeResult {
	err := features.HaveProgramType(pt)
	if err == nil {
		return ProbeResult{Supported: true}
	}
	if errors.Is(err, ebpf.ErrNotSupported) {
		return ProbeResult{Supported: false}
	}
	return ProbeResult{Supported: false, Error: err}
}

// probeKprobeMulti checks if kprobe.multi (multi-attach kprobes) is supported.
// This requires CONFIG_FPROBE (kernel 5.18+) which is checked via kernel config.
func probeKprobeMulti(kc *KernelConfig) ProbeResult {
	// First check if basic kprobe is supported.
	if err := features.HaveProgramType(ebpf.Kprobe); err != nil {
		if errors.Is(err, ebpf.ErrNotSupported) {
			return ProbeResult{Supported: false}
		}
		return ProbeResult{Supported: false, Error: err}
	}

	// kprobe.multi requires CONFIG_FPROBE.
	if kc == nil {
		// Cannot determine kprobe.multi support without kernel config.
		// This commonly happens in containers where /proc/config.gz and
		// /boot/config-* are not available.
		return ProbeResult{Supported: false, Error: ErrNoKernelConfig}
	}
	if kc.KprobeMulti.IsEnabled() {
		return ProbeResult{Supported: true}
	}

	return ProbeResult{Supported: false}
}

const btfPath = "/sys/kernel/btf/vmlinux"

// probeBTF checks if BTF (BPF Type Format) is available for CO-RE programs.
func probeBTF() ProbeResult {
	_, err := os.Stat(btfPath)
	if err == nil {
		return ProbeResult{Supported: true}
	}
	if os.IsNotExist(err) {
		return ProbeResult{Supported: false}
	}
	return ProbeResult{Supported: false, Error: err}
}

const defaultLSMPath = "/sys/kernel/security/lsm"

// readActiveLSMsFrom reads the list of active LSMs from the specified path.
func readActiveLSMsFrom(path string) ([]string, error) {
	data, err := os.ReadFile(path)
	if err != nil {
		return nil, err
	}
	content := strings.TrimSpace(string(data))
	if content == "" {
		return nil, nil
	}
	return strings.Split(content, ","), nil
}

// probeKernelVersion returns the kernel release string (e.g., "6.1.0-generic").
func probeKernelVersion() string {
	var uname unix.Utsname
	if err := unix.Uname(&uname); err != nil {
		return ""
	}
	return unix.ByteSliceToString(uname.Release[:])
}

const imaDirectoryPath = "/sys/kernel/security/ima"

// probeIMADirectory checks if the IMA securityfs directory exists.
// This indicates IMA is compiled in and securityfs is mounted,
// but does not guarantee IMA is actively measuring files.
func probeIMADirectory() ProbeResult {
	_, err := os.Stat(imaDirectoryPath)
	if err == nil {
		return ProbeResult{Supported: true}
	}
	if os.IsNotExist(err) {
		return ProbeResult{Supported: false}
	}
	return ProbeResult{Supported: false, Error: err}
}

const imaMeasurementCountPath = "/sys/kernel/security/ima/runtime_measurements_count"

// ProbeIMAAnyMeasurementActive checks whether at least one IMA measurement
// rule has fired. It does not identify which func= rule caused the measurement.
// Exported so consumers can call it directly without going through [Check].
func ProbeIMAAnyMeasurementActive() ProbeResult {
	return probeIMAAnyMeasurementActive()
}

// probeIMAAnyMeasurementActive checks whether at least one IMA measurement
// has occurred by reading the runtime measurement count. A count > 1 (beyond
// the boot_aggregate entry) means at least one measurement has fired.
//
// When the count is exactly 1, the probe executes /bin/true and re-reads
// the count. An increase confirms a measurement covering exec occurred,
// but does not distinguish which specific func= rule triggered it.
func probeIMAAnyMeasurementActive() ProbeResult {
	before, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	// If measurements already exist beyond boot_aggregate, some rule is active.
	if before > 1 {
		return ProbeResult{Supported: true}
	}

	// Execute /bin/true to see if a measurement rule triggers on exec.
	// This is a ~2ms side effect with a deterministic, always-present binary.
	_ = (&exec.Cmd{Path: "/bin/true"}).Run()

	after, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	if after > before {
		return ProbeResult{Supported: true}
	}

	return ProbeResult{Supported: false}
}

// ProbeIMAExecMeasurementActive checks whether an IMA measurement rule
// covering exec (e.g., func=BPRM_CHECK) is active by executing a fresh
// temporary binary and checking for a measurement count increase.
//
// Unlike [ProbeIMAAnyMeasurementActive], this probe does not use a count > 1
// shortcut. It returns Supported=true only when the controlled exec stimulus
// increments the IMA measurement count.
func ProbeIMAExecMeasurementActive() ProbeResult {
	return probeIMAExecMeasurementActive()
}

// probeIMAExecMeasurementActive creates a fresh temporary executable (new
// inode), then takes a baseline measurement count, executes the binary, and
// re-reads the count. The measurement window is kept as narrow as possible:
// only the exec and whatever the kernel does for that exec are counted.
// A fresh inode avoids false negatives from IMA's per-inode measurement cache.
func probeIMAExecMeasurementActive() ProbeResult {
	bin, cleanup, err := createFreshTempBinary()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}
	defer cleanup()

	before, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	if err := execTempBinary(bin); err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	after, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	return ProbeResult{Supported: after > before}
}

// createFreshTempBinary copies /bin/true into a new temp directory (fresh
// inode) and returns the path, a cleanup function, and any error. The caller
// must invoke cleanup when done. Materializing the binary before the
// measurement window avoids false positives from FILE_CHECK rules measuring
// the source read or temp-file write.
//
// A unique random trailer is appended to the ELF so that IMA's global
// hash-table deduplication does not suppress the measurement. The trailer
// sits past the ELF's segment table and does not affect execution.
func createFreshTempBinary() (string, func(), error) {
	noop := func() {}

	src, err := os.ReadFile("/bin/true")
	if err != nil {
		return "", noop, err
	}

	// Append random bytes so the digest is unique per invocation.
	trailer, err := uniqueTrailer()
	if err != nil {
		return "", noop, err
	}
	src = append(src, trailer...)

	dir, err := imaProbeTempDir()
	if err != nil {
		return "", noop, err
	}

	bin := dir + "/probe"
	if err := os.WriteFile(bin, src, 0700); err != nil {
		os.RemoveAll(dir)
		return "", noop, err
	}

	return bin, func() { os.RemoveAll(dir) }, nil
}

// execTempBinary executes the binary at the given path and waits for it
// to exit.
func execTempBinary(path string) error {
	return (&exec.Cmd{Path: path}).Run()
}

// ProbeIMAFileCheckMeasurementActive checks whether an IMA measurement rule
// covering file open (e.g., func=FILE_CHECK) is active by opening a fresh
// temporary file and checking for a measurement count increase.
//
// Unlike [ProbeIMAAnyMeasurementActive], this probe does not use a count > 1
// shortcut. It returns Supported=true only when the controlled file-open
// stimulus increments the IMA measurement count.
func ProbeIMAFileCheckMeasurementActive() ProbeResult {
	return probeIMAFileCheckMeasurementActive()
}

// probeIMAFileCheckMeasurementActive creates a fresh temporary file (new
// inode), rewrites it with unique content to invalidate any IMA measurement
// cache and avoid global hash-table deduplication. The baseline count is
// taken after all setup I/O, and the measurement window contains only an
// O_RDONLY open — the canonical FILE_CHECK stimulus.
func probeIMAFileCheckMeasurementActive() ProbeResult {
	path, cleanup, err := createFreshTempFile()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}
	defer cleanup()

	// Rewrite the file with unique content to invalidate any IMA measurement
	// cached from the initial create and ensure the digest has not been seen
	// before in IMA's global hash table.
	trailer, err := uniqueTrailer()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}
	if err := os.WriteFile(path, trailer, 0644); err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	before, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	// Open O_RDONLY — this is the FILE_CHECK stimulus.
	f, err := os.Open(path)
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}
	f.Close()

	after, err := readMeasurementCount()
	if err != nil {
		return ProbeResult{Supported: false, Error: err}
	}

	return ProbeResult{Supported: after > before}
}

// createFreshTempFile creates a regular file with initial content in a new
// temp directory (fresh inode) and returns the path, a cleanup function, and
// any error. The caller must invoke cleanup when done.
func createFreshTempFile() (string, func(), error) {
	noop := func() {}

	dir, err := imaProbeTempDir()
	if err != nil {
		return "", noop, err
	}

	path := dir + "/probe-file"
	if err := os.WriteFile(path, []byte("ima-probe-init\n"), 0644); err != nil {
		os.RemoveAll(dir)
		return "", noop, err
	}

	return path, func() { os.RemoveAll(dir) }, nil
}

// imaProbeTempDir creates a temp directory on a non-tmpfs filesystem.
// Common IMA policies exclude tmpfs before FILE_CHECK/BPRM_CHECK rules,
// which would cause false negatives. Prefers /var/tmp (typically on the
// root filesystem) over the default temp dir. Returns an error if no
// writable non-tmpfs candidate is available rather than silently falling
// back to tmpfs.
func imaProbeTempDir() (string, error) {
	var errs []error
	seen := map[string]bool{}

	for _, base := range []string{"/var/tmp", os.TempDir()} {
		if base == "" || seen[base] {
			continue
		}
		seen[base] = true

		if !isNonTmpfs(base) {
			errs = append(errs, fmt.Errorf("%s is unavailable or tmpfs", base))
			continue
		}

		dir, err := os.MkdirTemp(base, "kfeatures-ima-probe-*")
		if err == nil {
			return dir, nil
		}
		errs = append(errs, fmt.Errorf("create temp dir under %s: %w", base, err))
	}

	return "", fmt.Errorf("no writable non-tmpfs temp directory for IMA probe: %w", errors.Join(errs...))
}

// isNonTmpfs returns true if path exists and is not on a tmpfs filesystem.
func isNonTmpfs(path string) bool {
	var st unix.Statfs_t
	if err := unix.Statfs(path, &st); err != nil {
		return false
	}
	return uint32(st.Type) != unix.TMPFS_MAGIC
}

// uniqueTrailer returns 16 random bytes hex-encoded (32 bytes) to produce
// a unique file digest per invocation. This prevents IMA's global hash-table
// deduplication from suppressing repeated measurements.
func uniqueTrailer() ([]byte, error) {
	var buf [16]byte
	if _, err := rand.Read(buf[:]); err != nil {
		return nil, err
	}
	return []byte(hex.EncodeToString(buf[:]) + "\n"), nil
}

// ReadIMARuntimeMeasurementsCount returns the current IMA runtime measurement
// count from /sys/kernel/security/ima/runtime_measurements_count. No side
// effects. Useful for diagnostics and for callers building before/after probes.
func ReadIMARuntimeMeasurementsCount() (int, error) {
	return readMeasurementCount()
}

// readMeasurementCount reads the IMA runtime measurement count from the
// default path.
func readMeasurementCount() (int, error) {
	return readMeasurementCountFrom(imaMeasurementCountPath)
}

// readMeasurementCountFrom reads an IMA runtime measurement count from the
// given path. Separated from readMeasurementCount for testability.
func readMeasurementCountFrom(path string) (int, error) {
	data, err := os.ReadFile(path)
	if err != nil {
		return 0, err
	}
	return strconv.Atoi(strings.TrimSpace(string(data)))
}