LSM BPF Change Everything
summary
Shows that attaching BPF to LSM hooks fixes raceable tracepoint blind spots: tracepoint-based Falco probes are reliably bypassed by argument-swapping while LSM hooks run after args move into the kernel. Demonstrates a blocking program restrict_connect that denies connections to 1.1.1.1 and an audit_connect variant that always returns 0 and records the true destination even under attack. Notes ~200 LSM hooks, per-object security blobs, BPF helpers for IMA hashes, and requires kernel >5.7 with CONFIG_BPF_LSM and BTF enabled.
AI-written summary · about
chapters (4)
related talks
27mBPF LSM - Updates and What next?
38mSecure the Linux Kernel with eBPF Linux Security Module
30mBPF for Security and LSM updates
33mKernel Runtime Security Instrumentation
24mBridging BPF LSM and the Linux Audit Subsystem
20mNetworking resource control with per-cgroup LSM
53mGetting Started with BPF Security Observability
57mBPF and Security. Friends and Foes