Revisiting eBPF Seccomp Filters
summary
Argues that replacing classic BPF with eBPF for seccomp makes filters stateful filters using ebpf maps and helpers, enabling concrete features: syscall-account limiting (allow calls only during container setup), multi-phase process specialization, and syscall-flow integrity (SFIP) via map-backed state machines. Provides a kernel patch adding a seccomp-specific eBPF program type, verifier hooks, helper whitelist, and runtime integration (C1/runC annotations), enforces privileges like CAP_SYS_ADMIN or no_new_privs, can disable unprivileged usage, and suggests IMA signatures for trusted filters; prototype code is on GitHub.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:42Limitation of CBPF
- 4:47Advances of eBPF
- 5:31Implications on Seccomp
- 7:09Some common opinions
- 12:43Temporal syscall specialization [1]
- 15:07Syscall-flow-integrity protection [1]
- 17:43Security model of Seccomp-eBPF
- 18:44Reduce to eBPF security
- 20:41Harden Seccomp-eBPF filters
- 21:21Potential security support from IMA
- 23:01Container runtime integration
- 23:38Conclusion
related talks
26mReinventing Seccomp for Fun and Profiles
28mUnderstanding programmable system call security with Secomp-eBPF in Linux.
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
01h 21mTutorial: The Why and How of libseccomp
01h 03mUsing seccomp to limit the Linux kernel attack service
52mUsing Seccomp to Limit the Kernel Attack Surface
42mResolving Performance and Security Issues with eBPF
32meBPF: The Next Power Tool of SREs