Secure the Linux Kernel with eBPF Linux Security Module
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 12:20· Room 0B (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Shows how LSM hooks become runtime BPF programs so policies can be injected without a kernel module, using libbpf and the bpf(2) syscall, relying on BTF metadata and the verifier to avoid crashes. Requires kernel 5.7+ and CONFIG options. Demonstrates attaching to the set_task/set_nice LSM hook and blocks priority increases via set_nice hook by returning an error, with programs loaded, verified and observed via bpf_trace_pipe. Also emphasizes no kernel module needed.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:25Agenda and fundamentals
- 8:57Audit framework limits
- 18:35Linux Security Modules and their constraints
- 21:04BPF for kernel security
- 23:09LSM hooks with BPF
- 31:02Live demo: BPF LSM enforcement
- 37:58Q&A
related talks
33mKernel Runtime Security Instrumentation
36meBPF for Runtime Security
26mKernel Runtime Security Instrumentation
40mExploring Runtime Security and Forensic using eBPF
27mBPF LSM - Updates and What next?
27mLSM BPF Change Everything
42mResolving Performance and Security Issues with eBPF
33meBPF for Security