When Kernel Programmers Lie to the Verifier: A Tale of Broken Assumptions in eBPF

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

The Failing Guard Imagine you are a system administrator tasked with a simple security policy: block and log any attempt to execute binaries from the /tmp directory. After some research, you settle on the eBPF Linux Security Module (eBPF LSM). It’s the perfect tool for the job—it allows you to hook into the execve path, inspect the filename and arguments, and decide whether to allow the execution.…

Read on blog.igns.top ↗