In this lesson, you will learn how to bypass traditional user-space log collectors by intercepting stdout and stderr directly from kernel data structures.
The Problem with Userspace Aggregation
In a standard containerized environment, logs are typically captured by a daemon (like fluentd or logstash) running in user-space. This creates a dependency chain: if the collector process hangs, crashes, or is compromised by an attacker attempting to cover their tracks, the log trail disappears. By moving log aggregation to the kernel level, we ensure that logging remains immutable and tamper-evident, functioning independently of the container runtime’s health.
Hooking the Pipe Buffer
Every process in a container communicates via file descriptors, typically mapping stdout and stderr to a pipe or a pseudo-terminal. At the kernel level, these are represented by struct pipe_buffer. Instead of waiting for a user-space daemon to read from the pipe, we can implement a kernel module or an eBPF program that attaches to the pipe_write operations.
When a containerized process calls write() to file descriptor 1 or 2, the kernel copies the data into the pipe buffer. By hooking this path, we can redirect or clone these buffers directly into a reserved kernel ring buffer (similar to printk but isolated for container logs).
// Conceptual hook into the write path
ssize_t my_kernel_logger(struct kiocb *iocb, struct iov_iter *from) {
// 1. Intercept the write buffer
// 2. Extract the process context (Namespaces/Cgroup ID)
// 3. Write to a secure, append-only kernel memory region
return original_pipe_write(iocb, from);
}
By tagging each log entry with the container’s Namespace ID (or Cgroup ID) at the moment of kernel execution, we create a cryptographically verifiable log stream. Because this happens before the data hits user-space, even a root user within the container cannot delete or modify the logs, as the "source of truth" now resides in the protected kernel memory address space, invisible to the container's environment.
Key Takeaway: Kernel-level log aggregation removes the vulnerability of user-space log collectors by capturing process output directly from the kernel's pipe and socket buffers, ensuring logs remain immutable and resistant to container-level tampering.