nixos/opensnitch: Add support for EPBF process monitor

Co-authored-by: Slime90

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -174,6 +174,8 @@
 
 - `services.fail2ban.jails` can now be configured with attribute sets defining settings and filters instead of lines. The stringed options `daemonConfig` and `extraSettings` have respectively been replaced by `daemonSettings` and `jails.DEFAULT.settings` which use attribute sets.
 
+- The application firewall `opensnitch` now uses the process monitor method eBPF as default as recommended by upstream. The method can be changed with the setting [services.opensnitch.settings.ProcMonitorMethod](#opt-services.opensnitch.settings.ProcMonitorMethod).
+
 - The module [services.ankisyncd](#opt-services.ankisyncd.package) has been switched to [anki-sync-server-rs](https://github.com/ankicommunity/anki-sync-server-rs) from the old python version, which was difficult to update, had not been updated in a while, and did not support recent versions of anki.
 Unfortunately all servers supporting new clients (newer version of anki-sync-server, anki's built in sync server and this new rust package) do not support the older sync protocol that was used in the old server, so such old clients will also need updating and in particular the anki package in nixpkgs is also being updated in this release.
 The module update takes care of the new config syntax and the data itself (user login and cards) are compatible, so users of the module will be able to just log in again after updating both client and server without any extra action.

nixos/modules/services/security/opensnitch.nix

@@ -147,7 +147,7 @@ in {
   config = mkIf cfg.enable {
 
     # pkg.opensnitch is referred to elsewhere in the module so we don't need to worry about it being garbage collected
-    services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/default-config.json")));
+    services.opensnitch.settings = mapAttrs (_: v: mkDefault v) (builtins.fromJSON (builtins.unsafeDiscardStringContext (builtins.readFile "${pkgs.opensnitch}/etc/opensnitchd/default-config.json")));
 
     systemd = {
       packages = [ pkgs.opensnitch ];
@@ -171,9 +171,19 @@ in {
       ${concatMapStrings ({ file, local }: ''
         ln -sf '${file}' "${local}"
       '') rules}
+
+      if [ ! -f /etc/opensnitch-system-fw.json ]; then
+        cp "${pkgs.opensnitch}/etc/opensnitchd/system-fw.json" "/etc/opensnitchd/system-fw.json"
+      fi
     '');
 
-    environment.etc."opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
+    environment.etc = mkMerge [ ({
+      "opensnitchd/default-config.json".source = format.generate "default-config.json" cfg.settings;
+    }) (mkIf (cfg.settings.ProcMonitorMethod == "ebpf") {
+      "opensnitchd/opensnitch.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch.o";
+      "opensnitchd/opensnitch-dns.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch-dns.o";
+      "opensnitchd/opensnitch-procs.o".source = "${config.boot.kernelPackages.opensnitch-ebpf}/etc/opensnitchd/opensnitch-procs.o";
+    })];
 
   };
 }

pkgs/os-specific/linux/opensnitch-ebpf/default.nix

@@ -0,0 +1,58 @@
+{ lib
+, kernel
+, stdenv
+, clang-tools
+, llvmPackages
+, elfutils
+, flex
+, bison
+, bc
+, opensnitch
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opensnitch_ebpf";
+  version = "${opensnitch.version}-${kernel.version}";
+
+  inherit (opensnitch) src;
+
+  sourceRoot = "source/ebpf_prog";
+
+  nativeBuildInputs = with llvmPackages; [
+    bc
+    bison
+    clang
+    clang-tools
+    elfutils
+    flex
+    libllvm
+  ];
+
+  # We set -fno-stack-protector here to work around a clang regression.
+  # This is fine - bpf programs do not use stack protectors
+  # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+
+  env.KERNEL_DIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/source";
+  env.KERNEL_HEADERS="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  extraConfig =''
+    CONFIG_UPROBE_EVENTS=y
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    for file in opensnitch*.o; do
+      install -Dm644 "$file" "$out/etc/opensnitchd/$file"
+    done
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "eBPF process monitor module for OpenSnitch";
+    homepage = "https://github.com/evilsocket/opensnitch";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ onny ];
+    platforms = platforms.linux;
+  };
+}

pkgs/tools/networking/opensnitch/daemon.nix

@@ -56,10 +56,8 @@ buildGoModule rec {
     mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
     mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
     cp system-fw.json $out/etc/opensnitchd/
-    substitute default-config.json $out/etc/default-config.json \
+    substitute default-config.json $out/etc/opensnitchd/default-config.json \
-      --replace "/var/log/opensnitchd.log" "/dev/stdout" \
+      --replace "/var/log/opensnitchd.log" "/dev/stdout"
-      --replace "iptables" "nftables" \
-      --replace "ebpf" "proc"
     substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
       --replace "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd" \
       --replace "/etc/opensnitchd/rules" "/var/lib/opensnitch/rules" \

pkgs/top-level/linux-kernels.nix

@@ -450,6 +450,8 @@ in {
     # Current stable release; don't backport release updates!
     openafs = openafs_1_8;
 
+    opensnitch-ebpf = if lib.versionAtLeast kernel.version "5.10" then callPackage ../os-specific/linux/opensnitch-ebpf { } else null;
+
     facetimehd = callPackage ../os-specific/linux/facetimehd { };
 
     tuxedo-keyboard = if lib.versionAtLeast kernel.version "4.14" then callPackage ../os-specific/linux/tuxedo-keyboard { } else null;