You and Your Security Profiles; Generating Security Policies with the Help of eBPF
summary
Demo shows Tetragon plus eBPF collecting SHA256 digest identity for binaries, capturing sockets/files/capabilities, and shipping events via a gRPC collector to generate policies. CRDs hook kernel functions like TCP connect hook and BPF verifier events, then push policies that enforce rules in-kernel: denied execs are in-kernel synchronous kill immediately. The workflow builds allowlists from observed activity, applies them cluster-wide without pod restarts, and the live demo successfully blocks unauthorized BPF loads and unexpected network connects.
AI-written summary · about
chapters (10)
- 0:00Security profiles with eBPF
- 1:14Least privilege challenges
- 4:51BPF for security
- 7:17Tetragon system data
- 10:27Tetragon kernel tracing
- 16:21Building least privilege policies
- 17:06Policy enforcement demo
- 25:27Results and benefits
- 26:32Contributing to Tetragon
- 28:42Q&A on BPF hooks
related talks
40mUsing the EBPF Superpowers To Generate Kubernetes Security Policies
32mReal Time Security - eBPF for Preventing attacks
36meBPF for Runtime Security
31meBPF-Driven Security for Kubernetes: The Tetragon Story
16meBPF for Creating Least Privileged Policies; What Do I Need to Know to Prepare for the Next CVEs?
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
33meBPF for Security
36mSecuring the Superpowers: Who Loaded That EBPF Program?