Bridging BPF LSM and the Linux Audit Subsystem
summary
Claim: export audit functionality to BPF via kfuncs so BPF LSMs can emit formal audit records. Implementation: patch series breaks the LSM audit API into discrete exported functions and a BPF-visible log start that records prog ID, pid and comm; prototype works end-to-end. Tools and measurement: ring buffer and printk alternatives, synthetic VM benchmarks and ftrace sampling. Result: audit path produces clear, linkable logs but costs far more than printk (worst cases dominated by SKB allocation and wakeups); more benchmarking and API hardening needed.
AI-written summary · about
chapters (10)
- 0:00BPF LSM and Linux Audit intro
- 3:11BPF LSM in audit logging
- 7:06BPF audit logging limits
- 10:37BPF-to-audit API design
- 13:05Audit log start function
- 15:14Audit impact on BPF performance
- 18:23Audit performance bottlenecks
- 20:29Solutions for performance issues
- 21:32Patch series status
- 22:36Q&A
related talks
27mBPF LSM - Updates and What next?
27mLSM BPF Change Everything
33mKernel Runtime Security Instrumentation
30mBPF for Security and LSM updates
20mExtending Non-Repudiable Logs with eBPF
53mGetting Started with BPF Security Observability
38mSecure the Linux Kernel with eBPF Linux Security Module
26mKernel Runtime Security Instrumentation