RESEARCH ARCHIVE / SUNNYMAPBPF
SunnyMapBPF
Abstract
Falco, Tracee, and Tetragon have become the dominant instrumentation framework for cloud-native runtime security, deployed across millions of production nodes to detect container escapes, malicious process execution, and policy violations. All three tools attach BPF programs to kernel tracepoints, kprobes, and LSM hooks, using BPF maps as the primary mechanism for configuration, state management, and inter-program communication.
SunnyMapBPF identifies a telemetry trust boundary weakness: BPF maps lack per-map access control beyond the initial CAP_BPF capability check. Any process with CAP_BPF can read, modify, or delete map entries belonging to any other BPF program on the same host, including security monitors. The research demonstrates that modifying the runtime BPF map state of these tools achieves complete, silent, and immediate telemetry suppression.
Attack Model
BPF Map State Poisoning is a class of same-privilege tampering in which a process modifies the runtime BPF map state of a security tool to suppress event generation at the kernel level. The attack operates below the user space agent, at the BPF program layer, where configuration and filtering decisions are made before any event reaches the user space pipeline.
Per-Tool Analysis
Tracee v0.24.1
Tracee uses a config_map (BPF_MAP_TYPE_HASH) to store per-policy configuration. The field enabled_policies gates all event filtering through match_scope_filters(). The function computes res & policies_cfg->enabled_policies to determine which policies apply to a given event. Setting enabled_policies = 0 causes this expression to evaluate to zero for every event.
A companion field policies_version is cached per-CPU. The BPF program only re-reads config when it observes a version change. To ensure immediate propagation, the attack atomically bumps policies_version alongside the enabled_policies write. Total modification: approximately 10 bytes.
| Metric | Baseline | Post Poison | Post Restore |
|---|---|---|---|
| sched_process_exec events (5s) | 16 | 0 | 7 |
| Detection rate | 100% | 0% | ~44% |
| Tool process status | Running | Running (no crash) | Running |
| Log anomalies | None | None | None |
Tetragon v1.4.0
Tetragon uses a two-stage attack surface. First, execve_calls is a BPF_MAP_TYPE_PROG_ARRAY used for tail calls in the process execution monitoring pipeline. Deleting entries from this prog_array breaks the tail-call chain, preventing execution of downstream BPF programs that generate process_exec events. Second, execve_map is a hash map storing active process tracking state; clearing it erases all process context.
All Tetragon maps are pinned under /sys/fs/bpf/tetragon/ with well-known paths, making target identification trivial. This enables a graduated attack: breaking only execve_calls suppresses execution events while leaving exit events intact, allowing the attacker to choose between partial and total blindness.
| Metric | Baseline | prog_array only | Full attack | Restored |
|---|---|---|---|---|
| process_exec events | 14 | 0 | 0 | 11 |
| process_exit events | 13+ | 13 | 0 | Normal |
| Total events | 27+ | 13 | 0 | Normal |
| Detection rate | 100% | ~48% | 0% | ~79% |
Falco (latest stable)
Falco's BPF probe uses an interesting_syscalls array map indexed by syscall number. At each syscall entry tracepoint, the BPF program checks interesting_syscalls[__NR_syscall]; a value of 0 causes the probe to return immediately without generating any event. Zeroing all 512 entries disables event generation for every system call, operating at the dispatch layer before any rule evaluation occurs.
The attack is comprehensive because it targets the earliest filter in the BPF pipeline. No matter how many Falco rules are configured, none of them execute if the syscall filter discards the event before it reaches the rule engine.
| Metric | Baseline | Post Poison | Restored |
|---|---|---|---|
| "Sensitive file opened" alerts | 1+ per read | 0 | 1+ per read |
| Total alerts across all rules | Normal | 0 | Normal |
| Detection rate | 100% | 0% | 100% |
| Tool process status | Running | Running | Running |
Cross-Tool Comparison
Map Security Posture
| Property | Tracee v0.24.1 | Tetragon v1.4.0 | Falco (latest) |
|---|---|---|---|
| Total BPF maps | 72+ | 40+ | ~10 |
| Maps pinned to filesystem | 0 | 40+ (all) | 0 |
| Maps frozen (bpf_map_freeze) | 0 | 0 | 0 |
| Maps with BPF_F_RDONLY_PROG | 0 | 0 | 0 |
| Runtime integrity checks | None | None | None |
| Tamper detection | None | None | None |
| Critical maps (attack surface) | 3+ | 5+ | 1 |
| Time to total blindness | 1 BPF invocation | 1 BPF invocation | 1 BPF invocation |
Key Observations
Architectural uniformity. Despite significant differences in tool design (Tracee's policy-driven filtering, Tetragon's tail-call pipeline, Falco's syscall dispatch table), all three tools share the same fundamental weakness: unprotected BPF maps that control event generation logic.
No defense in depth. None of the tested tools implement any secondary verification mechanism. No user space heartbeat, map checksums, canary values, or event rate anomaly detection that could detect or recover from map tampering.
Pinning is a double-edged sword. Tetragon's decision to pin all maps to /sys/fs/bpf/ provides operational visibility but also provides a stable, well-known filesystem path for attackers, eliminating the need for map ID enumeration.
Graduated attack capability. The Tetragon result demonstrates that attackers can achieve fine-grained control over which event categories are suppressed, enabling targeted evasion strategies that minimize forensic artifacts.
Zero forensic artifacts. No tool produced any log entry, metric anomaly, or alert indicating that its BPF maps had been modified. The attack is silent from the perspective of every monitoring layer tested.
Binary transition. Each attack produced a clean transition from full visibility to total blindness, not a gradual degradation. This distinguishes BPF Map Poisoning from noise-based evasion techniques that merely reduce detection probability.