Loading…
October 31 - November 1 | Lyon, France
View More Details  & Register Here
Back To Schedule
Thursday, October 31 • 13:50 - 14:35
Kernel Runtime Security Instrumentation - KP Singh, Google

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
Existing Linux Security Modules can only be extended by modifying and rebuilding the kernel, making it difficult to react to new threats. Kernel Runtime Security Instrumentation (KRSI) [1] aims to provide an extensible Linux Security Module (LSM) by allowing userspace programs and system owners to attach eBPF (extended Berkeley Packet Filter) programs to security hooks. This makes the LSM framework extensible without needing to rebuild/re-write and enables a new class of security and auditing software.

The talk discusses the need for such an LSM (with representative use cases) and compares it to some existing alternatives, such as Landlock, a separate custom LSM, kprobes+eBPF etc. The second half of the talk outlines the proposed design and interfaces, and includes a live demo
Speakers
avatar for KP Singh

KP Singh

Staff Software Engineer, Google
KP Singh is the author and maintainer of the mainline eBPF LSM (a.k.a KRSI) for flexible security audit and policy enforcement on Linux. At Google, he leads the effort to build telemetry and detection software deployed on Google's corp, prod and cloud endpoints spanning different... Read More →

Kernel Runtime Security Instrumentation pdf
Thursday October 31, 2019 13:50 - 14:35 CET
Forum 1
  Refereed Presentations
  • Experience Level Advanced
  • Session Slides Included Yes