Kernel Runtime Security Instrumentation
Talkat Linux Security Summit North America 2019 · on Monday, 2019-08-19· at 11:35· Sapphire D, Hilton San Diego Bayfront·
summary
Proposes an extensible LSM that attaches eBPF programs to LSM hooks so userspace agents can both signal and mitigate without rebuilding the kernel; prototype demo loads BPF, uses a perf ring buffer to export events, and enforces policy changes at runtime. Finds an unexpected 32-page env limit when copying environment data and measures exec latency around ~517 → 533 microseconds with added auditing. Requires privileged loading (requires CAP_SYS_ADMIN), sleepable eBPF and perf buffer sizing remain open design issues.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:58Signaling and Mitigation
- 3:09Other Signals
- 4:08Medications
- 6:09How does it work
- 7:20VNeck
- 9:17LSM
- 11:42Structure
- 12:58Alternatives
- 16:44Case Study
- 23:32Discussion
related talks
26mKernel Runtime Security Instrumentation
36meBPF for Runtime Security
38mSecure the Linux Kernel with eBPF Linux Security Module
40mExploring Runtime Security and Forensic using eBPF
42mResolving Performance and Security Issues with eBPF
27mBPF LSM - Updates and What next?
32meBPF: The Next Power Tool of SREs
32mReal Time Security - eBPF for Preventing attacks