kernel-security
Master Linux kernel security mechanisms including SELinux and AppArmor policy authoring, seccomp-bpf sandboxing, and exploit mitigations like KASLR, Intel CET, and ARM PAC. Learn to triage kernel CVEs, configure memory sanitizers, and design container security boundaries.
Kernel Security guides you through writing SELinux and AppArmor policies, seccomp filters, and kernel hardening techniques.
AI-generated summary based on this skill's SKILL.md
Install
mohitmishra786/low-level-dev-skills/kernel-security · repository language: JavaScript
git clone https://github.com/mohitmishra786/low-level-dev-skills
cp -r low-level-dev-skills/skills/security/kernel-security ~/.claude/skills/kernel-securitynpx skillfed install mohitmishra786/low-level-dev-skills/kernel-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does kernel-security cover for SELinux policy writing?
kernel-security teaches SELinux policy writing for service confinement, including how to author policies that restrict process capabilities and file access. The skill covers practical policy development, audit2allow workflows for analyzing denials, and best practices for confining services within security domains to limit lateral movement and privilege escalation risks.
How do I write seccomp-bpf filters to sandbox process syscalls?
kernel-security provides seccomp-bpf filter configuration guidance, including libseccomp tutorials and practical examples for sandboxing processes. You'll learn to define syscall whitelists, handle architecture differences, and deploy filters in containers and services to restrict the kernel attack surface by blocking unnecessary system calls.
What kernel exploit mitigations does kernel-security teach?
kernel-security covers KASLR, Intel CET (shadow stack and IBT), and ARM PAC/BTI branch protection mechanisms. The skill explains how to enable these mitigations, understand their bypass techniques, and configure them across different architectures to defend against code reuse and control-flow hijacking exploits.
How should I triage kernel CVE impact and apply patches?
kernel-security provides a kernel CVE triage checklist and impact assessment methodology. You'll learn to evaluate CVE severity, determine affected kernel versions and configurations, prioritize patching, and implement workarounds when patches aren't immediately available—essential for maintaining kernel security posture in production environments.
Can kernel-security help with AppArmor profile development?
Yes, kernel-security covers AppArmor profile authoring as an alternative to SELinux for service confinement. The skill teaches how to write AppArmor policies, understand the differences between SELinux and AppArmor approaches, and deploy profiles to sandbox processes and restrict resource access in Linux security frameworks.
Does kernel-security cover memory sanitizers like KASAN?
kernel-security includes KASAN and KMSAN coverage for detecting memory bugs in kernel builds. You'll learn to enable these sanitizers during kernel compilation, interpret detection output for uninitialized memory and use-after-free issues, and integrate them into kernel hardening and exploit mitigation strategies.
SKILL.md
rendered from the published skill — quoted content, verbatim
Kernel Security
Purpose
Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities.
When to Use
- Writing SELinux or AppArmor policies for confined services
- Sandboxing processes with seccomp-bpf filters
- Hardening binaries with CET, PAC, or BTI
- Enabling KASAN on kernel builds for vulnerability research
- Triaging kernel CVE impact on your distro/kernel version
- Designing container or microservice security boundaries
Workflow
1. LSM framework overview
Application syscall
→ DAC (uid/gid, file mode)
→ LSM hook (SELinux/AppArmor/Yama/...)
→ Capability check
→ seccomp filter
→ Kernel
```bash
Active
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/security/kernel-security/SKILL.md