Attack wave on AUR packages!

21 
--- [8] Loaded eBPF programs/links (bpftool) ---
  Loaded eBPF programs: 22
  WARNING: lsm eBPF programs loaded by unknown process (expected systemd / AppArmor / SELinux).
  Unknown loaders: python3(556)




Python3 is used to load my VPN daemon. According to HTOP.
22

Thanks for debugging, really helpful.

The python3(556) warning is almost certainly ProtonVPN — its Linux daemon is Python-based and legitimately loads lsm eBPF hooks for the network killswitch. False positive on archcanary’s end.

Fixed in the latest commit — it now checks if the loader’s binary is a pacman-owned package and downgrades to INFO if so, instead of warning.

  git pull
  ./install.sh --system
1 Like
23

Proton VPN is exactly what it is.

--- [8] Loaded eBPF programs/links (bpftool) ---
  Loaded eBPF programs: 26
  INFO: lsm eBPF programs loaded by non-systemd process (pacman-owned binary).
  Loaders: python3(556) (python)
  Perf attachments (kprobe/tracepoint): none.
  Net attachments (XDP/TC): none.


 Check summary
 ───────────────────────────────────────────────────────
 Package list (2016 pkgs)             ✅  clean
 pacman.log history                   ✅  clean
 Systemd persistence                  ✅  clean
 eBPF rootkit traces                  ✅  clean
 npm cache                            ✅  clean
 bun cache                            ✅  clean
 yarn cache                           ✅  clean
 pnpm cache                           ✅  clean
 PKGBUILD obfuscation scan            ✅  clean
 eBPF programs (bpftool)              ✅  clean
 ld.so.preload injection              ✅  clean
 XDG autostart + shell RCs            ✅  clean
 Kernel modules (DKMS)                ✅  clean
 Lynis hardening                      ✅  clean
 Package integrity                    ✅  clean
 ───────────────────────────────────────────────────────
============================================================
 RESULT: CLEAN - No indicators found.
============================================================
1 Like