v1.0.0

What's Changed

• Initial commit. Monitor to get raw events from ring buffer. by @anfedotoff in #1
• YAML configs for Loader and Agent by @anfedotoff in #2
• Registry for loaded detectors by @anfedotoff in #3
• Transmuter: convert raw kernel events to serializable data by @anfedotoff in #4
• Added minimal documentation by @anfedotoff in #5
• Added Transmiitter by @anfedotoff in #6
• Add new detector ProcMon. New logic for GTFOBins detector by @anfedotoff in #8
• Add CI build and linting by @anfedotoff in #9
• Procmon tracks forks by @anfedotoff in #10
• Use currnet process info in GTFOBins detector by @anfedotoff in #11
• HistFile detector to check if user stops writing bash history by @anfedotoff in #12
• Refactor ProcMon by @anfedotoff in #13
• Add ProcessExec and ProcessExit events by @anfedotoff in #14
• Refactor proc_creds by @anfedotoff in #15
• Add process information to histfile detector by @anfedotoff in #16
• Fix gtfobins by @anfedotoff in #17
• Implement Transmute trait by @anfedotoff in #18
• Tests by @anfedotoff in #19
• release: systemd service instalation by @anfedotoff in #21
• refactor(gtfobins): Simplify gtfobins config by @anfedotoff in #22
• Io uring by @anfedotoff in #23
• refactor: use bpf_get_current_task_btf helper by @anfedotoff in #24
• feat: Filemon detector. File Access Monitoring Detector Using LSM Hooks by @anfedotoff in #25
• docs: split design and detectors documentation by @anfedotoff in #26
• Enforce gtfobins by @anfedotoff in #27
• Fix procmon ppid by @anfedotoff in #28
• Pathunlink test by @anfedotoff in #29
• refactor: rename all bpf maps by @anfedotoff in #30
• feat: put PROCMON_PROC_MAP size in global config by @anfedotoff in #31
• Netmon by @anfedotoff in #32
• feat: use timestamp in all events by @anfedotoff in #33
• refactor: use yaml string as Detector::new parameter by @anfedotoff in #34
• refactor: replace lazy_static with LazyLock by @anfedotoff in #35
• refactor: use bpf_probe_read_kernel instead bpf_probe_read by @anfedotoff in #36
• Filtering process events by @anfedotoff in #37
• refactor(ebpf): use HashMap instead LpmTrie in gtfobins by @anfedotoff in #38
• refactor: rename IOUring to IOUringMon by @anfedotoff in #39
• IOUringMon process filter by @anfedotoff in #40
• Filemon process filter by @anfedotoff in #41
• Netmon process filter by @anfedotoff in #42
• Remove expose events by @anfedotoff in #43
• Lima tests by @anfedotoff in #44
• refactor: add proto definitions for detector configs by @anfedotoff in #45
• feat(procmon): add cgroup_id and cgroup_name to process event by @anfedotoff in #46
• build: Update and fix dependencies by @anfedotoff in #47
• Update Dependabot by @anfedotoff in #48
• fix(procmon): remove unnecessary logging by @anfedotoff in #49
• Bombini container by @anfedotoff in #50
• docs: Update histfile docs by @anfedotoff in #51
• ci: fix dependabot by @anfedotoff in #52
• fix: Arm64 build support by @Avgor46 in #54
• feat: add path_chmod hook to FileMon by @anfedotoff in #55
• Filemon chown by @anfedotoff in #56
• Filemon mount by @anfedotoff in #57
• feat(trasmitter): use stdout except log stderr to transmit events by @anfedotoff in #59
• feat(filemon): add security_mmap_file hook by @anfedotoff in #58
• Filemon ioctl by @anfedotoff in #60
• feat(procmon) add security_task_fix_setuid hook by @anfedotoff in #62
• tests: make test_filemon_open_mmap_allow_list_file more stable by @anfedotoff in #63
• Procmon capset by @anfedotoff in #64
• refactor(filemon): use filter_by_process function to avoid copy paste by @anfedotoff in #65
• feat(procmon): add security_task_prctl hook by @anfedotoff in #66
• Iouing data by @anfedotoff in #67
• feat(procmon): add security_create_user_ns hook by @anfedotoff in #68
• feat(procmon): add security_ptrace_access_check hook by @anfedotoff in #69
• refactor: use enabled vs disable for ProcMon and FileMon hooks by @anfedotoff in #70
• Fileless exec by @anfedotoff in #84
• fix(trasmuter): find zero byte in str_from_bytes first by @anfedotoff in #96
• feat(procmon): collect hashes of executed binaries by @anfedotoff in #92
• feat(procmon): extract container id from cgroup name by @anfedotoff in #97
• refactor(procmon): use tracepoints to catch fork and exit by @anfedotoff in #101
• fix(bombini): Add SIGTERM handler by @anfedotoff in #102
• Init procmap by @anfedotoff in #106
• fix(procmon): Track only thread leaders while exit by @anfedotoff in #107
• Revert "fix(procmon): Track only thread leaders while exit" by @anfedotoff in #108
• fix(procmon): use lru_hash for PROCMON_PROC_MAP by @anfedotoff in #110
• Path filtering for FileMon by @anfedotoff in #111
• feat(filemon): Add path filtering for mmap hook by @anfedotoff in #112
• feat(filemon): add path filtering for path_truncate hook by @anfedotoff in #113
• fix tests by @anfedotoff in #114
• Chown filter by @anfedotoff in #115
• Chmod filter by @anfedotoff in #116
• Ioctl filter by @anfedotoff in #117
• Unlink filter by @anfedotoff in #118
• Enrich netmon events by FQDN by @anfedotoff in #120
• Revert getnameinfo resolve by @anfedotoff in #121
• refactor(procmon): skip serialization for empty container_id (host) by @anfedotoff in #122
• refactor: serialize event to Vec not to String by @anfedotoff in #123
• Netmon filtering by @anfedotoff in #124
• feat(procmon): add Cred filter for procmon hooks by @anfedotoff in #129
• fix(gtfobins): do not treat gtfobins if gtfobins parent has pid 1 by @anfedotoff in #130
• refactor: use cargo xtask to generate vmlinux.rs by @anfedotoff in #131
• feat: add start_time to Process info by @anfedotoff in #134
• refactor: unite process priv escalation events by ProcessEvent by @anfedotoff in #136
• refactor: allow Transmuters to be stateful by @anfedotoff in #135
• refactor: Major config refactoring by @anfedotoff in #138
• update Dockerfile by @anfedotoff in #139
• remove histfile detector by @anfedotoff in #140
• refactor: remove unnecessary copying by @anfedotoff in #141
• Support Bombini for 6.2 6.8 and 6.14 Linux kernels by @anfedotoff in #143
• ci: split lint and test. Build and tests in VM by @anfedotoff in #144
• ci: cache sensitive to ci file changes by @anfedotoff in #145
• tests: add feature to dump events json to stdout after all tests by @anfedotoff in #146
• add missed tests by @anfedotoff in #147
• feat: add gid/egid to Process info by @anfedotoff in #148
• docs: update design concepts by @anfedotoff in #151
• Mdbook by @anfedotoff in #152
• docs: add badges to README by @anfedotoff in #153
• Proto docs by @anfedotoff in #154
• tests: split open and mmap into separate tests by @anfedotoff in #155
• update license file by @anfedotoff in #156
• docs: add JSON schema for all Bombini events by @anfedotoff in #157
• feat: add garbage collection for PROCMON_PROC_MAP by @anfedotoff in #158
• fix: ProcMon fixes by @anfedotoff in #159
• Process cache by @anfedotoff in #160
• feat: add parent Process information in events by @anfedotoff in #163
• docs: add bombini logo by @anfedotoff in #164
• docs: fix logo paths by @anfedotoff in #165
• Contribution guide by @anfedotoff in #166
• k8s: add k8s setup and update docs by @anfedotoff in #167
• feat(procmon): add security_fix_setgid hook by @anfedotoff in #176
• refactor remove mod.rs from module path by @anfedotoff in #177
• refactor(filemon): Use enum in FileMsg by @anfedotoff in #181
• Add security_path_symlink hook by @Avgor46 in #191
• refactor: Remove async from Transmuter by @Avgor46 in #193
• Bombini Rule Engine by @anfedotoff in #217
• Some missed fixes by @anfedotoff in #218
• feat: NetMon event port filtering by @anfedotoff in #219
• feat(filemon): add UID and GID filtering attributes for chow hook by @anfedotoff in #220
• FileIoctl event filtering by cmd by @anfedotoff in #221
• Add PathChmod mode filtering by @Avgor46 in #227
• Add File open filtering by flags by @Avgor46 in #228
• feat: Add rule name to events by @Avgor46 in #229
• Add Mmap prot mode and flags filtering by @Avgor46 in #230
• fix: Fixes to mmap hook by @Avgor46 in #235
• fix: fix netmon ipv6 test by @anfedotoff in #236
• feat: add bprm_check hook for exec control by @anfedotoff in #237
• docs: Change BprmCheck header from H2 to H3 by @anfedotoff in #242
• Log rotation by @Avgor46 in #244
• feat(ebpf): implement sandbox mode for FileMon and ProcMon by @anfedotoff in #243
• Optimize NOT expressions by @Avgor46 in #249
• test: Wait for events in tests by @Avgor46 in #250
• feat: Added Attribute trait by @Avgor46 in #252
• add libbpf-dev to ci by @Kivooeo in #256
• feat: Added KernelMon detector by @Avgor46 in #254
• docs: Fix docs for KernelMon by @Avgor46 in #260
• feat: Added metric server by @Avgor46 in #261
• Allow list fix by @Avgor46 in #272
• fix(test): Do not clean up tmp directory if Bombini failed to start by @Avgor46 in #273
• feat: Added exec_id and parent_exec_id to process by @Avgor46 in #264
• Add verifier issue mark to tricky bpf code by @Avgor46 in #274
• fix: Update kernelmon test timeout by @Avgor46 in #275
• fix: Clippy warning by @Avgor46 in #276
• add co-re support by @Kivooeo in #277
• fix: Return -1 on error in ebpf detectors by @Avgor46 in #278
• Update release builds by @anfedotoff in #279
• fix: Check for tgid in process exit by @Avgor46 in #286
• fix: support tarball with musl and fix aarch musl builds by @anfedotoff in #285
• Nightly downgrade by @Avgor46 in #287
• Fix kernel by @Avgor46 in #289
• add co-re usage documentation for contributors by @Kivooeo in #288
• fix: Fix netmon detector by @Avgor46 in #290
• feat: connect to unix socket with retry by @anfedotoff in #293
• ci: Rework Bombini CI by @Avgor46 in #291
• ci: Remove dependabot from release notes by @Avgor46 in #295
• ci: Release pipeline by @Avgor46 in #294
• refactor: Use Aya RingBuf instead of DynRingBuf by @Avgor46 in #296
• feat: Implement bprm_check privilege filter by @Avgor46 in #297
• Remove GTFOBins detector by @Avgor46 in #298
• docs: Prepare docs for release by @Avgor46 in #299

New Contributors

• @dependabot[bot] made their first contribution in #53
• @Kivooeo made their first contribution in #256

Full Changelog: https://github.com/bombinisecurity/bombini/commits/$VERSION