SeaBee - Defense for the Defense - eBPF-Based Mandatory Access Control Framework

Explore an innovative eBPF-based mandatory access control framework designed to protect eBPF security tools in this 33-minute conference talk from the Linux Foundation. Learn how security researchers have leveraged eBPF to build cutting-edge security mechanisms with kernel-independent bytecode and runtime safety guarantees, particularly valuable in environments with specialized security requirements where traditional LSMs are unsuitable or kernel modifications are impractical. Discover the unique security challenges posed by eBPF programs, where privileged processes can manipulate all eBPF objects, and understand the limitations of SELinux's coarse-grained access control in protecting individual eBPF tools. Examine a comprehensive solution that addresses these gaps through a configurable policy framework requiring no code changes for tool adoption, including detailed coverage of the design, implementation, and practical policy examples. Gain insights into future development opportunities within eBPF and LSM subsystems for implementing more granular access controls, presented by cybersecurity experts from the National Security Agency who demonstrate how to defend the defenders in the evolving landscape of eBPF security.