Kernel Runtime Security Instrumentation - KP Singh, Google
Channel: The Linux Foundation
Date: 2019-11-13

Kernel Runtime Security Instrumentation - KP Singh, Google
Forum 1

Speakers: KP Singh
Existing Linux Security Modules can only be extended by modifying and rebuilding the kernel, making it difficult to react to new threats. Kernel Runtime Security Instrumentation (KRSI) [1] aims to provide an extensible Linux Security Module (LSM) by allowing userspace programs and system owners to attach eBPF (extended Berkeley Packet Filter) programs to security hooks. This makes the LSM framework extensible without needing to rebuild/re-write and enables a new class of security and auditing software.

The talk discusses the need for such an LSM (with representative use cases) and compares it to some existing alternatives, such as Landlock, a separate custom LSM, kprobes+eBPF etc. The second half of the talk outlines the proposed design and interfaces, and includes a live demo