Ananicy-cpp flagged by archcanary-latest

General system Applications
1

Continuing the discussion from Archcanary — a layered security scanner for Arch-based Linux (beta, looking for testers):

[quote=“made-lief, post:241, topic:80837”]
ananicy-cpp flagged by archcanary (latest AUR version)

Hi here, actually I am using cachy for now.

Problem here:
— [8] Loaded eBPF programs/links (bpftool) —
Loaded eBPF programs: 51
WARNING: stealth-associated program types present: tracepoint,tracing
These hook types are used by eBPF rootkits to hide PIDs/files/processes.
Review: sudo bpftool prog show ; sudo bpftool link show
(Legitimate if you run bpftrace/bcc/sysprof/Falco — confirm the source.)
Perf attachments (kprobe/tracepoint/uprobe): 2
No hooks on rootkit-associated functions.
pid 1332 fd 12: prog_id 63 tracepoint sched_process_exec
pid 1332 fd 14: prog_id 65 tracepoint sched_process_fork
Net attachments (XDP/TC): none.

I am unable to silence the warnings and the failed archcanary-service by adding ananicy-cpp or one of the tracepoint entries to the allowlist.

How to proceed?
Thanks!

2

Update: release v0.1.32-1

Hi @woodpecker,

Thanks for using the tool and showing the false possive.

Quick rundown of what you hit:

Check [8] noticed something had loaded eBPF tracepoint programs and flagged it, because hiding processes via tracepoints is a rootkit move.

The “something” was just ananicy-cpp — it hooks sched_process_exec/fork to spot new processes and renice them. Totally normal, and the check even confirmed the scary part was clean (“No hooks on rootkit-associated functions”).

On v0.1.32 (just released) there’s nothing to do — the check now trusts any eBPF loader that’s an installed package, and ananicy-cpp qualifies, so it quietly drops to INFO and the service stops failing.

yay -Syu archcanary
3

Thanks, great, just got the update and it’s all fine :slight_smile:
Hope you can keep tracking arch package/AUR security issues as vigilantly!