Extending Non-Repudiable Logs with eBPF
summary
Adds a kernel module API that lets eBPF programs call bpf_process_measurement to push formatted measurements into the IMA log and extend them into a TPM register (demonstrated to PCR1), so eBPF-visible kernel data becomes TPM-backed, non-repudiable evidence. Implementation namespaces measurements so container image digests are recorded per container instance, runs on stock Fedora kernels without kernel patches, and works end-to-end; virtual TPM shows much higher throughput than a real hardware TPM.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 2:46Chain of trust and TPM basics
- 5:58Non-repudiable logging with eBPF
- 8:03Namespace measurements for containers
- 10:33Evaluation and performance
- 12:45Q&A on logging throughput
- 14:29Alternative logging approaches
- 17:23Hierarchical logging discussion
related talks
33mKernel Runtime Security Instrumentation
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
16mWhy Everyone Should Care About eBPF
33meBPF: exploring use case of BPF kernel infrastructure
36meBPF for Runtime Security
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee