BPF LSM - Updates and What next?
summary
BPF LSM is shipping in mainline and is already deployed for telemetry and enforcement at Google, using BPF atomics to count events and bpf local storage blobs to tag tasks with security domains; a static-call patchset turns indirect LSM hooks into direct calls and shows ~3% faster Redis-style benchmarks with SELinux enabled. Built features include trampoline/JIT LSM hooks and a loader-based program signatures approach (PKCS7) to verify compiled BPF; remaining problems are default-callback side effects (inode setxattr/capability corner cases) and unsigned runtime-generated programs.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:14How Do You Write a Bp of Lsm Program
- 7:26Atomics to Bpf
- 8:05Indirect Calls
- 10:17Empty Callbacks
- 19:24Loader Program
- 22:01Bpf Get Exciter Helper
- 25:48Do Mandatory Access Control and Ls and Auditing Need To Go Together
related talks
30mBPF for Security and LSM updates
27mLSM BPF Change Everything
33mKernel Runtime Security Instrumentation
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
38mSecure the Linux Kernel with eBPF Linux Security Module
25mDiscussion: What's next for BPF Signing
36meBPF for Runtime Security
32meBPF: The Next Power Tool of SREs