kernel-security
Master Linux kernel security mechanisms including SELinux and AppArmor policy authoring, seccomp-bpf sandboxing, and exploit mitigations like KASLR, Intel CET, and ARM PAC. Learn to triage kernel CVEs, configure memory sanitizers, and design container security boundaries.
Kernel Security guides you through writing SELinux and AppArmor policies, seccomp filters, and kernel hardening techniques.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-27
Kernel Security guides you through writing SELinux and AppArmor policies, seccomp filters, and kernel hardening techniques. Master Linux kernel security mechanisms including SELinux and AppArmor policy authoring, seccomp-bpf sandboxing, and exploit mitigations like KASLR, Intel CET, and ARM PAC. Learn to triage kernel CVEs, configure memory sanitizers, and design container security boundaries.
Use it when
- kernel-security provides seccomp-bpf filter configuration guidance.
- kernel-security covers KASLR, Intel CET (shadow stack and IBT), and ARM PAC/BTI branch protection mechanisms.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
mohitmishra786/low-level-dev-skills/kernel-security · repository language: JavaScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does kernel-security cover for SELinux policy writing?
kernel-security teaches SELinux policy writing for service confinement, including how to author policies that restrict process capabilities and file access. The skill covers practical policy development, audit2allow workflows for analyzing denials, and best practices for confining services within security domains to limit lateral movement and privilege escalation risks.
How do I write seccomp-bpf filters to sandbox process syscalls?
kernel-security provides seccomp-bpf filter configuration guidance, including libseccomp tutorials and practical examples for sandboxing processes. You'll learn to define syscall whitelists, handle architecture differences, and deploy filters in containers and services to restrict the kernel attack surface by blocking unnecessary system calls.
What kernel exploit mitigations does kernel-security teach?
kernel-security covers KASLR, Intel CET (shadow stack and IBT), and ARM PAC/BTI branch protection mechanisms. The skill explains how to enable these mitigations, understand their bypass techniques, and configure them across different architectures to defend against code reuse and control-flow hijacking exploits.
How should I triage kernel CVE impact and apply patches?
kernel-security provides a kernel CVE triage checklist and impact assessment methodology. You'll learn to evaluate CVE severity, determine affected kernel versions and configurations, prioritize patching, and implement workarounds when patches aren't immediately available—essential for maintaining kernel security posture in production environments.
Can kernel-security help with AppArmor profile development?
Yes, kernel-security covers AppArmor profile authoring as an alternative to SELinux for service confinement. The skill teaches how to write AppArmor policies, understand the differences between SELinux and AppArmor approaches, and deploy profiles to sandbox processes and restrict resource access in Linux security frameworks.
Does kernel-security cover memory sanitizers like KASAN?
kernel-security includes KASAN and KMSAN coverage for detecting memory bugs in kernel builds. You'll learn to enable these sanitizers during kernel compilation, interpret detection output for uninitialized memory and use-after-free issues, and integrate them into kernel hardening and exploit mitigation strategies.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Kernel Security
Purpose
Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities.
When to Use
- Writing SELinux or AppArmor policies for confined services
- Sandboxing processes with seccomp-bpf filters
- Hardening binaries with CET, PAC, or BTI
- Enabling KASAN on kernel builds for vulnerability research
- Triaging kernel CVE impact on your distro/kernel version
- Designing container or microservice security boundaries
Workflow
1. LSM framework overview
Application syscall
→ DAC (uid/gid, file mode)
→ LSM hook (SELinux/AppArmor/Yama/...)
→ Capability check
→ seccomp filter
→ Kernel
```bash
Active
(truncated - see the full file via the links below)
File tree — 1 file
skills/security/kernel-security/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Write and deploy SELinux or AppArmor policies for service confinement”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Binary Hardening guides you through applying and validating security protections for C/C++ executables. Learn compiler and linker flags for RELRO, PIE, stack canaries, FORTIFY_SOURCE, and CFI, plus seccomp-bpf syscall filtering and hardware defenses like Intel CET and ARM BTI. Use checksec to audit existing binaries and confirm mitigations are in place.
Containers Internals covers the low-level mechanisms that power Docker and Podman: process namespaces for isolation, cgroups v2 for resource limits, overlayfs for layered storage, and seccomp-bpf for syscall filtering. Explore runc, the OCI spec, Linux capabilities, rootless user namespaces, and practical escape mitigations.
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Appsec Expert provides specialized guidance for securing applications throughout the development lifecycle. It covers threat modeling with STRIDE, vulnerability testing via SAST/DAST/SCA tools, secure coding patterns, and DevSecOps automation. Use it to identify vulnerabilities, design defense-in-depth controls, and remediate security issues with verified, production-ready approaches.
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
This skill maps techniques for defeating Windows exploit mitigations—memory protections like ASLR, DEP, CFG, and CET—alongside platform security controls including WDAC, ASR, AMSI, ETW, and PPL. It pairs each bypass method with detection signatures and operational security notes to support both offensive testing and defensive hardening. Includes reconnaissance scripts, gadget finders, and a quick-start workflow for fingerprinting a target's mitigation landscape before weaponizing an exploit.
More skills Windows Kernel Exploits (GPL-3.0)