BPF for Security and LSM updates
summary
Implemented a BPF-based safe_setid LSM that successfully blocks an unauthorized UID transition in a live VM, using libbpf bootstrap and clang 18, but hit verifier and map quirks: inner-array maps required avoiding zero entries and failed with EINVAL until switched to explicit inner-map handling, iteration uses bpf_map_for_each_elem and a max-unroll workaround for BPF-loop verifier variable-offset issues, and kernel changes needed for acquire/release K funcs and trusted-arg annotations. Patches for LSM static calls show roughly a 10% throughput improvement on pipe tests when LSMs are enabled. Extended-attribute helpers (bpf_get_xattr and bpf_set_xattr) are progressing with re-entrancy and POSIX-ACL concerns.
AI-written summary · about
chapters (12)
- 0:00Introduction and goals
- 1:23What is safe set ID LSM
- 3:10BPF map challenges and fixes
- 6:00LSM hook implementation struggles
- 8:31BPF toolchain and verifier issues
- 11:26LSM code and demo setup
- 13:58Live demo and policy enforcement
- 17:36Gaps in BPF LSM development
- 18:19Use cases for BPF LSMs
- 21:11BPF LSM adoption barriers
- 21:52Performance overhead and mitigations
- 26:10Q&A on toolchain and patches
related talks
27mBPF LSM - Updates and What next?
27mLSM BPF Change Everything
33mKernel Runtime Security Instrumentation
36mThe journey of BPF from restricted C language towards extended and safe C.
24mBridging BPF LSM and the Linux Audit Subsystem
57mBPF and Security. Friends and Foes
38mSecure the Linux Kernel with eBPF Linux Security Module
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...