Extending systemd Security Features with eBPF
summary
systemd gains libbpf integration and ships two new eBPF-based controls: RestrictNetworkInterfaces and RestrictFileSystems. Each network rule installs tiny C eBPF programs (~50 lines) attached to cgroup ingress/egress with maps of interface indices and uses BPF links so daemon reloads don’t drop hooks; kernel ≥5.7 required. Filesystem checks use an LSM hook with a global bpf map of per-cgroup inner maps, the eBPF file-open program is ~66 lines and requires BPF LSM enabled. Demos show ping and file-access policies working; code is queued for systemd v250.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:12eBPF support in system (before libbpf)
- 1:48libbpf support in systemd
- 7:40RestrictNetworkinterfaces= Implementation
- 13:55RestrictFileSystems= Implementation
- 20:03More details
related talks
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
36meBPF for Runtime Security
32mReal Time Security - eBPF for Preventing attacks
38mSecure the Linux Kernel with eBPF Linux Security Module
34mUsing systemd features to secure services
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel