kernel-security

Kernel Security

Purpose

Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities.

When to Use

Writing SELinux or AppArmor policies for confined services
Sandboxing processes with seccomp-bpf filters
Hardening binaries with CET, PAC, or BTI
Enabling KASAN on kernel builds for vulnerability research
Triaging kernel CVE impact on your distro/kernel version
Designing container or microservice security boundaries

Workflow

1. LSM framework overview

Application syscall
    → DAC (uid/gid, file mode)
    → LSM hook (SELinux/AppArmor/Yama/...)
    → Capability check
    → seccomp filter
    → Kernel

# Active LSM
cat /sys/kernel/security/lsm
# common: lockdown,capability,yama,apparmor,safesetid

2. SELinux policy

# Check SELinux status
getenforce
sestatus

# Context of file/process
ls -Z /usr/sbin/nginx
ps -eZ | grep nginx

# Audit denials
ausearch -m avc -ts recent
sealert -a /var/log/audit/audit.log

Policy module example:

# myapp.te
policy_module(myapp, 1.0.0)

type myapp_t;
type myapp_exec_t;
type myapp_log_t;

init_daemon_domain(myapp_t, myapp_exec_t)

allow myapp_t myapp_log_t:file { create write append open };
allow myapp_t self:tcp_socket { create bind listen accept };

checkmodule -M -m -o myapp.mod myapp.te
semodule_package -o myapp.pp -m myapp.mod
semodule -i myapp.pp

3. AppArmor profiles

# Generate complain-mode profile
aa-genprof /usr/bin/myapp

# Enforce
aa-enforce /etc/apparmor.d/usr.bin.myapp

# Check status
aa-status

# /etc/apparmor.d/usr.bin.myapp
#include <tunables/global>

/usr/bin/myapp {
  #include <abstractions/base>

  /usr/bin/myapp mr,
  /var/log/myapp.log w,
  /etc/myapp/config r,
  network bind tcp,
  deny /etc/shadow r,
}

4. seccomp-bpf with libseccomp

#include <seccomp.h>

int sandbox(void) {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);

    // Allow read/write/exit/mmap
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);

    // Return EPERM instead of kill for open
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(open), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(openat), 0);

    return seccomp_load(ctx);
}

# Export BPF filter for audit
scmp_filter_ctx ctx = ...;
seccomp_export_bpf(ctx, fd);

# strace to find needed syscalls before tightening
strace -c ./myapp

5. KASLR

# Check KASLR enabled
cat /proc/sys/kernel/randomize_va_space   # 2 = full
dmesg | grep KASLR

# Kernel cmdline
grep kaslr /proc/cmdline

Mitigations against KASLR leaks:

No /proc/<pid>/maps to untrusted
Pointer hashing in %pK printk
eBPF restricted on unprivileged

6. Intel CET

# Compile with CET
gcc -fcf-protection=full -o app app.c

# Verify shadow stack and IBT
readelf -n app | grep -E 'SHSTK|IBT'
readelf --notes app | grep -A2 GNU_PROPERTY

Feature	Protects against
SHSTK (Shadow Stack)	ROP return address overwrites
IBT (Indirect Branch Tracking)	CALL/JMP to non-ENDBR targets

Requires CPU with CET (Intel Tiger Lake+; AMD Zen 3+ on CPUs with shadow-stack support) and kernel CET support.

7. ARM PAC and BTI

# GCC/Clang branch protection
gcc -mbranch-protection=standard -o app app.c
# PAC (pointer authentication) + BTI (branch target identification)

# Verify
readelf -n app | grep -E 'GNU_PROPERTY_AARCH64_FEATURE_1'
llvm-objdump -d app | grep bti

PAC signs return addresses and pointers with cryptographic keys (ARMv8.3+). BTI marks valid branch targets — invalid jumps fault.

8. Kernel memory tagging

# KASAN kernel build
# CONFIG_KASAN=y in kernel .config
make menuconfig  # Kernel hacking → KASAN

# Boot with KASAN kernel
# Reports use-after-free, OOB with stack trace

# KMSAN (uninitialized memory)
# CONFIG_KMSAN=y — kernel equivalent of MSan

# KASAN report example fields
# BUG: KASAN: slab-out-of-bounds in ...
# Call trace: ...

9. CVE triage workflow

# Check kernel version
uname -r

# Distro security tracker
# Ubuntu: ubuntu-security-notices
# RHEL: errata

# NVD lookup
# https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX

# Is patch backported?
zgrep -l CVE-2024-XXXX /usr/share/doc/linux-*/changelog.Debian.gz

Triage checklist:

Affected subsystem (net, fs, drivers)?
Local or remote exploit?
Fixed in your kernel version?
Mitigation without patch (disable module, sysctl)?

Common Problems

Symptom	Cause	Fix
SELinux denials	Missing allow rule	`audit2allow`; refine policy
AppArmor profile break	Path mismatch	Update profile paths; use globs
seccomp kills app	Missing syscall	`strace`; add allow rule
CET not active	Old CPU/kernel	Check `/proc/cpuinfo` flags
KASAN kernel slow	2-5x overhead	Use only in test VMs
False sense of security	LSM bypass via kernel bug	Defense in depth; keep kernel updated

Related Skills

skills/virtualization/containers-internals — container seccomp and caps
skills/runtimes/binary-hardening — userspace CET, RELRO, PIE
skills/runtimes/sanitizers — ASan/HWASan userspace counterparts
skills/observability/ebpf — LSM BPF programs
skills/kernel/kernel-debugging — analyze KASAN reports
skills/security/reverse-engineering — exploit analysis