Continuing the discussion from Archcanary — a layered security scanner for Arch-based Linux (beta, looking for testers):
[quote=“made-lief, post:241, topic:80837”]
ananicy-cpp flagged by archcanary (latest AUR version)
Hi here, actually I am using cachy for now.
Problem here:
— [8] Loaded eBPF programs/links (bpftool) —
Loaded eBPF programs: 51
WARNING: stealth-associated program types present: tracepoint,tracing
These hook types are used by eBPF rootkits to hide PIDs/files/processes.
Review: sudo bpftool prog show ; sudo bpftool link show
(Legitimate if you run bpftrace/bcc/sysprof/Falco — confirm the source.)
Perf attachments (kprobe/tracepoint/uprobe): 2
No hooks on rootkit-associated functions.
pid 1332 fd 12: prog_id 63 tracepoint sched_process_exec
pid 1332 fd 14: prog_id 65 tracepoint sched_process_fork
Net attachments (XDP/TC): none.
I am unable to silence the warnings and the failed archcanary-service by adding ananicy-cpp or one of the tracepoint entries to the allowlist.
How to proceed?
Thanks!