Choose Your Shield: Evaluating Linux Security Modules for Cloud Na...
summary
Compares SELinux, AppArmor and BPF LSM by measuring runtime overhead, attack mitigation and operational friction and shows KubeArmor as a working enforcement layer with demos: apt executions denied, rich telemetry with PID and host PID, and presets that block fileless exec and /proc snooping. Notes BPF LSM uses inode-based controls to avoid symlink/bind escapes, AppArmor misses some child transitions and privilege-escalation cases, and KubeArmor uses a node-aware operator to generate per-node daemonsets for heterogeneous LSMs. Presets block fileless exec and telemetry differs by LSM.
AI-written summary · about
chapters (17)
- 0:00Runtime security intro
- 1:24Runtime security in cloud native
- 3:07Linux LSM access control
- 6:23LSMs for runtime security
- 7:51SELinux overview
- 9:40SELinux for containers
- 11:50AppArmor path control
- 13:39BPF LSM for runtime
- 15:28CubeArmor runtime security
- 16:33CubeArmor policies
- 18:42Zero trust in CubeArmor
- 20:50CubeArmor presets
- 23:17AppArmor limitations
- 25:52LSM deployment challenges
- 28:42LSM stacking constraints
- 30:31LSM performance overhead
- 31:59Q&A
related talks
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
21mArmoring Cloud Native Workloads With LSM Superpowers
28mKubeArmor: Applying Security Policies with Practical Examples in K8S
28mOverview of the Linux Kernel Security Subsystem
24mRuntime Security: Challenges & Solution Space
30mFinding Imposter Among Us: Container Edition
25mProtecting Modern Workloads with eBPF superpowers
27mBPF LSM - Updates and What next?