Скачать или смотреть bpfbox: Simple Precise Process Confinement with KRSI and eBPF - William Findlay, Carleton University

eBPF is transitioning from an in-kernel monitoring engine to a powerful platform for the development of complex services. In the security space, the Linux 5.8 addition of the KRSI framework is a prime example of this paradigm shift, enabling users to write and enforce dynamic security policy using BPF LSM programs. We are interested in exploring how eBPF and KRSI can be used to reshape the way security decisions are made in Linux, taking advantage of eBPF's flexibility, safety, and cross-layer observability. In this talk, we present bpfbox, a novel process confinement mechanism using an in-kernel enforcement engine written in eBPF. bpfbox translates a simple policy language into predicates that can be enforced using KRSI's LSM programs. We take advantage of several BPF program types to integrate both userspace and kernelspace system behaviour into the policy language.