Linux Kernel Security Modules with eBPF

1 post · Sep 2014 – Apr 2026

What this trail covers

Cloudflare is leveraging eBPF within Linux Security Modules (LSM) to implement granular security policies without requiring kernel module modifications or extensive configuration. This approach is being used to address specific security risks, such as preventing unprivileged users from escalating privileges via USER namespaces using the `unshare` syscall. The LSM BPF framework allows for dynamic policy enforcement at specific kernel hook points, offering a flexible and robust security mechanism. This post details the patching of a critical bash vulnerability (CVE-2014-6271 and CVE-2014-7169) across Cloudflare's infrastructure and the provision of WAF rules for customers.

All Cloudflare trails

Apr 2026From bytecode to bytes- automated magic packet generationThis post introduces a novel approach to reverse-engineering classic BPF malware by employing symbolic execution with the Z3 theorem prover and the scapy library. It details the process of analyzing BPF instructions, identifying successful execution paths, and automatically generating the specific network packets required to trigger malicious BPF filters. The implementation includes a `BPFPacketCrafter` class for symbolic execution and demonstrates the generation of constraints for packet bytes.
May 2025Vulnerability transparency: strengthening security through responsible disclosureThis post details Cloudflare's commitment to vulnerability transparency and responsible disclosure, aligning with CISA's 'Secure by Design' pledge. It explains the role of CVEs and Cloudflare's process as a CVE Numbering Authority (CNA). The post highlights specific CVEs issued by Cloudflare, including memory exhaustion in quiche, information disclosure in the WordPress plugin, and issues in the WARP client. It also discusses instances where Cloudflare disclosed vulnerabilities via blog posts due to the root cause being outside their direct scope, such as a mutual TLS vulnerability originating from BoringSSL/NGINX. The post emphasizes the importance of balancing theoretical vulnerabilities with real-world risk and encourages other organizations to adopt 'Secure by Design' principles.
Oct 2022Assembly within! BPF tail calls on x86 and ARMThis post details the implementation and implications of BPF tail calls on x86 and ARM architectures, contrasting them with traditional function call optimizations. It explains how BPF tail calls, exposed via the `bpf_tail_call` helper, enable program chaining and reuse stack frames, similar to tail call elimination in compilers. The post highlights the evolution of BPF tail calls, particularly their interaction with BPF-to-BPF function calls on arm64, and discusses the use of BPF tail calls in Cloudflare's XDP-based DDoS mitigation pipeline.
Jun 2022Live-patching security vulnerabilities inside the Linux kernel with eBPF Linux Security ModuleThis post details the implementation of a live-patching solution for security vulnerabilities within the Linux kernel using eBPF Linux Security Modules (LSM BPF). It specifically addresses the risk of privilege escalation through the `unshare` syscall with the `CLONE_NEWUSER` flag. The solution involves writing an eBPF program that hooks into the `cred_prepare` LSM hook to deny the `unshare` syscall for unprivileged users. The post provides the C code for the eBPF program and a C loader using libbpf, along with a Makefile for compilation. It also discusses the challenges of upstreaming such restrictions and the benefits of using eBPF for dynamic policy enforcement.
Feb 2022Production ready eBPF, or how we fixed the BSD socket APIThis post introduces 'tubular', an open-sourced eBPF control plane for the Linux `sk_lookup` hook. It addresses limitations of the BSD sockets API by enabling advanced socket management and routing rules. Key contributions include: an eBPF program for `sk_lookup` hook, a user-space Go component for managing the eBPF program, `tubectl` CLI for user interaction, a system for handling overlapping bindings with precedence rules, methods for acquiring socket file descriptors (SCM_RIGHTS, systemd socket activation, `pidfd_getfd`), state persistence using eBPF maps (destinations, bindings, sockets), and the use of a specialized BPF longest prefix match (LPM) map for efficient binding lookup and precedence encoding.
Advertisement
May 2019Cloudflare architecture and how BPF eats the worldThis post details Cloudflare's extensive use of eBPF for various network functions, including volumetric DoS mitigations in XDP, layer 4 load balancing in XDP, and rate limiting on UDP sockets using `SO_ATTACH_BPF`. It also discusses challenges encountered with eBPF/XDP limitations like the lack of concurrency primitives (now addressed by `bpf_spin_lock`), bugs in the eBPF verifier, and the use of `bpf_sk_lookup` for socket lookups in XDP. The post highlights the evolution from classic BPF and iptables to eBPF for enhanced performance and flexibility in network security and traffic management.
Sep 2014Bash vulnerability CVE-2014-6271 patchedThis post details the immediate response to the critical bash vulnerability (CVE-2014-6271 and later CVE-2014-7169), including internal patching of Cloudflare's Linux servers and the deployment of a default WAF rule for Pro, Business, and Enterprise customers. It highlights the severity of the vulnerability and the importance of timely patching.