Networking resource control with per-cgroup LSM
summary
A per-cgroup LSM attaches BPF programs to existing LSM hooks so cgroup-local policies enforce socket creation, bind-port ranges, IPv4 denial and legacy socket priority without the old netclass hacks. The implementation uses BPF LSM helpers to mutate socket state, overrides errno to keep Java behavior working, and mostly covers create/clone hooks in experiments. Remaining problems: parent programs overwrite child state in hierarchies, sendmsg CMSG bypasses, and LSM currently requires non‑sleepable cgroup storage fixes before wide deployment.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 1:03Networking resource control goals
- 4:18Legacy implementation challenges
- 8:30BPF limitations and workarounds
- 10:15Per-cgroup LSM approach
- 12:21Implementation challenges
- 15:15Unexpected user space dependencies
- 16:18Current status and limitations
- 17:43Q&A
related talks
27mBPF LSM - Updates and What next?
27mLSM BPF Change Everything
30mBPF for Security and LSM updates
52mLSM Maintainers Panel
33mKernel Runtime Security Instrumentation
38mSecure the Linux Kernel with eBPF Linux Security Module
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next