Reinventing Seccomp for Fun and Profiles
Talkat Cilium + eBPF Day North America 2024 · on Tuesday, 2024-11-12· at 11:15· Salt Palace | Level 1 | Grand Ballroom B·
summary
A proof-of-concept reimplements seccomp features using eBPF, KRSI/LSM hooks and tracepoints to provide eBPF + KRSI based syscall filtering, argument-level checks and process-kill actions. The demo generates container-aware eBPF collections via Inspector Gadget, dynamically blocks openat when flags aren’t read-only, and shows profiles can be toggled live. Key limits: missing tracepoints and 30% of syscalls lack LSM hooks on x86_64, so not all syscalls are preventable, and performance and cross-kernel compatibility remain unmeasured. tracepoint-based filtering is central to the approach.
AI-written summary · about
chapters (19)
- 0:00Seccomp and eBPF overview
- 1:06Seccomp usability challenges
- 2:31What Seccomp is
- 3:57Seccomp problems in modern
- 5:06Goal: Seccomp in cloud-native
- 7:11Replace Seccomp with eBPF?
- 8:38KRSI and LSM hooks for filtering
- 10:03eBPF profiles as modular gadgets
- 11:48Live demo: eBPF blocking
- 15:20LSM hook limitations
- 16:23Behavior-based restrictions
- 17:26Missing trace points
- 18:08Trace points vs Kprobes
- 19:12Kernel config and LSM hooks
- 20:12Performance considerations
- 20:35eBPF Seccomp summary
- 21:17Seccomp struggles in containers
- 22:42Q&A: Replace Seccomp?
- 23:12Q&A: eBPF performance
related talks
35mRevisiting eBPF Seccomp Filters
01h 03mUsing seccomp to limit the Linux kernel attack service
39mCustom seccomp Profiles with Inspektor Gadget
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.
52mUsing Seccomp to Limit the Kernel Attack Surface
01h 21mTutorial: The Why and How of libseccomp
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp