SeaBee: Defense for the Defense
Talkat Linux Security Summit North America 2025 · on Thursday, 2025-06-26· at 11:05· Bluebird Ballroom (BBB) 3GH·
summary
An eBPF-based mandatory access control framework named SeaBee isolates privileged eBPF tools by labeling loader processes and their children, enforcing label checks in BPF LSM programs and storing metadata in maps and BPF local storage. User-space daemon is written in Rust using libbpf-rs and a CLI cbccontrol accepts policies signed with OpenSSL signatures to bind keys to policies. Prototype enforces map/program access and logging but cannot defend against kernel compromise, early-boot tampering, or some verifier/helper limitations.
AI-written summary · about
chapters (11)
- 0:00Introduction and outline
- 0:44Background on eBPF LSM
- 3:18The problem and goals
- 7:32Threat model and design
- 12:18Implementation overview
- 14:47Policy scope and structure
- 17:02Labeling and enforcement
- 19:46LSM hook utilization
- 21:56Authentication and keys
- 26:38SeaBee command line tool
- 27:28Conclusions and outlook
related talks
32mBpfJailer: eBPF based Mandatory Access Control
36meBPF for Runtime Security
25mProtecting Modern Workloads with eBPF superpowers
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
35mRevisiting eBPF Seccomp Filters
36mSecuring the Superpowers: Who Loaded That EBPF Program?
32meBPF: The Next Power Tool of SREs
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools