Kernel Runtime Security Instrumentation
summary
Kernel Runtime Security Instrumentation lets userspace attach eBPF to LSM hooks so policies can both detect and block actions without rebuilding the kernel, using helpers and perf event output for ordered audit logs. Design exposes about 198 hooks to load bytecode, supports reading kernel structs via BTF for stable offsets, implements detections like denying a process that unlinks its own executable or blocking execution when LD_PRELOAD appears twice, and demos show it runs live with lower tail latency than audit.
AI-written summary · about
chapters (6)
related talks
33mKernel Runtime Security Instrumentation
36meBPF for Runtime Security
38mSecure the Linux Kernel with eBPF Linux Security Module
40mExploring Runtime Security and Forensic using eBPF
33meBPF for Security
42mResolving Performance and Security Issues with eBPF
32mReal Time Security - eBPF for Preventing attacks
42mKernel Analysis Using eBPF