Speaker
Description
In the modern era, Linux kernel CVEs might accumulate faster than fleets can reboot into patched kernels. In some cases, this takes not even days. BPF-based mitigations can block vulnerable code paths at runtime, no reboot needed.
However, at the moment, BPF is far from being a golden bullet. Two mechanisms on how BPF can alter an execution path, LSM Hooks and error injection, are naturally limited: by the set of existing LSM hooks and by the [short] whitelist of ALLOW_ERROR_INJECTION functions. Many subsystems, such as different parts of net/, device drivers, etc., have no BPF security coverage.
In the first part of the talk, we investigate how subsystems currently lacking BPF hook coverage can be equipped with it and present tooling and guidelines to support adding that coverage more systematically.
In the second part, we discuss the error injection topic. One recent radical attempt, killswitch, allows any function to be altered. While this ultimately solves the problem, this is not really a solution which can be kept under control. Thus we discuss what might be done to substantially extend the set of functions eligible for error injection, while keeping the mechanism firmly under control.