Secimport: Tailor-Made eBPF Sandbox for Python Applications
summary
A Python proof of concept uses eBPF to monitor syscalls, build a per-module syscall allowlist, and enforce it with near-zero overhead; it profiles a run to record which modules open files, bind sockets, fork/exec or deserialize pickles and then applies that profile to sandbox later executions. Violations trigger configurable actions including stop the process on first violation or kill and log. The tool inspects running processes, catches pickle→spawn chains, and blocks unexpected syscall paths.
AI-written summary · about
chapters (6)
- 0:00Introduction and background
- 3:38Understanding eBPF technology
- 9:42eBPF use cases in security
- 12:14Secimport sandbox concept
- 17:42Personal story and future
- 19:30Q&A
related talks
32meBPF: The Next Power Tool of SREs
26mReinventing Seccomp for Fun and Profiles
10mGenerating seccomp policies with eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
36meBPF for Runtime Security
42mResolving Performance and Security Issues with eBPF
33mPython-BPF: Writing eBPF programs in pure Python
16mWhy Everyone Should Care About eBPF