Lightning Talk: Armoring Cloud Native Workloads with BPF LSM
Lightningat Cloud Native eBPF Day Europe 2022 · on Monday, 2022-05-16· at 15:45· Pavilion 4 | Room A | Level 2 | Central Forum·
summary
BPF LSM provides inline kernel hooks for runtime enforcement and is already used to virtual patch real CVEs such as PwnKit by attaching a small BPF program to bprm_check_security that blocks execs with dangerous flags while excluding trusted containers. Projects reimplementing lockdown like lockdown LSM use BPF LSM to preserve features while restricting kernel access. KubeArmor currently translates declarative policies to AppArmor and SELinux and is integrating BPF LSM to gain finer control and better observability across cloud native workloads.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:12Need for runtime security
- 0:32Security Primitives
- 2:13PodSecurity Context
- 3:02Enter BPF LSM
- 3:25BPF LSM - Flexible
- 4:15BPF LSM - Stackable
- 4:49Monitoring/Observability
- 5:24Summary
- 6:25KubeArmor
related talks
21mArmoring Cloud Native Workloads With LSM Superpowers
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
27mBPF LSM - Updates and What next?
07mLightning Talk: Enhancing Runtime Protection Leveraging Compliance Frameworks
25mProtecting Modern Workloads with eBPF superpowers
30mSandboxing Agentic AI With LSM-BPF
09mLightning Talk: Securing K8s Pods from Within: A Runtime Approach
38mSecure the Linux Kernel with eBPF Linux Security Module