TechPrufer
Sign inGet started

Blogs›Cloudflare›Linux Kernel Security Modules with eBPF

Linux Kernel Security Modules with eBPF

Linux Kernel Security Modules with eBPF

1
posts
2022

Cloudflare is leveraging eBPF within Linux Security Modules (LSM) to implement granular security policies without requiring kernel module modifications or extensive configuration. This approach is being used to address specific security risks, such as preventing unprivileged users from escalating privileges via USER namespaces using the `unshare` syscall. The LSM BPF framework allows for dynamic policy enforcement at specific kernel hook points, offering a flexible and robust security mechanism.

2022

Live-patching security vulnerabilities inside the Linux kernel with eBPF Linux Security Module

6/29/2022

This post introduces the use of eBPF within Linux Security Modules (LSM) as a novel approach to implementing security policies. It details the process of identifying the relevant kernel hooks (`cred_prepare` for the `unshare` syscall) and demonstrates how to write an eBPF program to intercept and deny `CLONE_NEWUSER` operations for unprivileged users. The post also covers the necessary kernel configuration options and provides example C code for the eBPF program and a libbpf loader, along with a Makefile for compilation. It highlights the benefits of LSM BPF for live-patching security vulnerabilities and enforcing granular access controls without modifying the kernel directly.