fntlnz

Flux as a Library Example

Flux is a lightweight scripting language for querying databases (like InfluxDB) and working with data. It's part of InfluxDB 1.7 and 2.0, but can be run independently of those.

This gist contains a main.go file that shows how flux can be used as a library in your programs.

Components

The main components you need are:

fntlnz

Seccomp BPF filter example

Use bpf programs as filters for seccomp, the one in the example will block all the write syscalls after it's loaded.

Usage

Compile it with just

gcc main.c

fntlnz

#include <linux/bpf.h>
#include <linux/in.h>
#include <linux/if_ether.h>
#include <linux/ip.h>

#define SEC(NAME) __attribute__((section(NAME), used))

SEC("dropper_main")
int dropper(struct xdp_md *ctx) {
  int ipsize = 0;

fntlnz

[[constraint]]
  name = "k8s.io/api"
  version = "kubernetes-1.11.0"

[[constraint]]
  name = "k8s.io/apimachinery"
  version = "kubernetes-1.11.0"

[[constraint]]
  name = "k8s.io/client-go"

fntlnz

InfluxDB and Chronograf in Kubernetes

1. Create the namespace

kubectl create ns monitoring

2. Deploy influxdb

kubectl apply -f influxdb.yml

fntlnz

1. Calculate the offset

offset(fn) = virtual_address(fn) - virtual_address(.text) + offset(.text)


2. Virtual address: 
readelf -S /home/fntlnz/go/bin/influx | grep -i text
  [ 1] .text             PROGBITS         0000000000401000  00001000

So, virtual address= 0x0000000000401000

fntlnz

docker service create --mode global --mount type=volume,volume-opt=o=addr=10.3.20.25,volume-opt=device=:/share/poc1/pluto,volume-opt=type=nfs,source=pluto,target=/pluto --name nfstest alpine top

fntlnz

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

fntlnz

~ # cat /proc/cpuinfo

system type             : TrendChip TC3162U SOC
processor               : 0
cpu model               : R3000 V0.1
BogoMIPS                : 330.95
wait instruction        : no
microsecond timers      : no
tlb_entries             : 32
extra interrupt vector  : no

fntlnz

To use a yubico U2F token on CentOS/RHEL/Fedora you need to add the specific udev file to your system to recognize them.

Get the udev rules

wget -O /etc/udev/rules.d/70-u2f.rules https://raw.githubusercontent.com/Yubico/libu2f-host/master/70-u2f.rules

Reload device events