KRAKENGUARD: Towards Fine-Grained eBPF Isolation
summary
KRAKENGUARD is a privileged user‑space manager that enforces JSON policies at load time by lifting eBPF bytecode to LLVM IR and running exhaustive symbolic execution to check helpers, maps, memory and return values. It blocks offensive helpers, detects verifier‑exploiting CVEs, and performs cross‑program read/write set checks to allow safe co‑location. Real workloads like Katran and Electrode analyze in less than 1 second using ~100 MB of RAM and enable an XDP-as-a-Service use case with host‑level performance.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:21eBPF in shared environments
- 3:05Security risks of broad privileges
- 4:52Limitations of isolation
- 6:38Requirements for fine-grained isolation
- 7:43Constraining eBPF programs
- 8:45KrakenGuard architecture
- 9:46Policy enforcement via symbolic execution
- 11:10Safe co-location of eBPF
- 11:52KrakenGuard’s policy language
- 13:15Evaluation with real-world eBPF
- 14:42Case studies: Electrode and Katran
- 15:24XDP as a service results
- 16:06Conclusion
related talks
36meBPF for Runtime Security
14mWill eBPF Save Us From the Next Global Outage?
32meBPF: The Next Power Tool of SREs
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
42mResolving Performance and Security Issues with eBPF
32meBPF: BPF kernel infrastructure
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
33meBPF: exploring use case of BPF kernel infrastructure