A Practical Approach to Control Unauthorized Execution of Interpreters
summary
Kernel module called "interpreter lab" enforces execution rules by hooking execve/execveat/bprm_change_interp via ftrace and resolving real paths and env vectors to decide if an interpreter runs. It specifically blocks python and perl for euid >=1000 when the script or interpreter lives on writable paths, allows root, and handles argv/ENV/shebang variants. Implementation is tested on Debian/Ubuntu, notes bypasses (copied binaries, memfd, hard links) and recommends noexec or IMA/EVM and kernel ≥5.2 to cover gaps.
AI-written summary · about
chapters (5)
related talks
23mScript Integrity
46mControlling Script Execution
47mApplication Whitelisting
42mResolving Performance and Security Issues with eBPF
26mKernel Runtime Security Instrumentation
33mKernel Runtime Security Instrumentation
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces