Advancing Kernel Control Flow Integrity with eBPF

Dive into a 32-minute conference talk from the Linux Plumbers Conference that explores the innovative use of eBPF for enhancing kernel security, with a focus on kernel control flow integrity (kCFI). Discover how eBPF's unique strengths in safety, runtime state access, and dynamicity can address the imprecision and deployment challenges of current kCFI implementations. Examine the intricacies of using eBPF to enforce fine-grained and precise kCFI, including techniques to reduce eBPF invocation costs while maintaining flexibility. Gain insights into the detailed workings of an eBPF-based kCFI implementation and its performance overhead evaluation. Understand the current limitations of kernel CFI, explore opportunities and challenges of using eBPF for kCFI, and learn approaches to overcome these obstacles. Use this discussion as a springboard to consider broader applications of eBPF in kernel security and engage in further dialogue about the feasibility of such approaches.