--- id: mohitmishra786/low-level-dev-skills/kernel-security version: "c480df37" license: MIT install: manual updated: 2026-06-27 --- # kernel-security — Master Linux kernel security mechanisms including SELinux and AppArmor policy authoring, seccomp-bpf sandboxing, and exploit mitigations like KASLR, Intel CET, and ARM PAC. Learn to triage kernel CVEs, configure memory sanitizers, and design container security boundaries. Publisher: mohitmishra786 · Stars: 148 · Updated: 2026-06-27 Install (manual): `git clone https://github.com/mohitmishra786/low-level-dev-skills` ## SKILL.md # Kernel Security ## Purpose Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities. ## When to Use - Writing SELinux or AppArmor policies for confined services - Sandboxing processes with seccomp-bpf filters - Hardening binaries with CET, PAC, or BTI - Enabling KASAN on kernel builds for vulnerability research - Triaging kernel CVE impact on your distro/kernel version - Designing container or microservice security boundaries ## Workflow ### 1. LSM framework overview ``` Application syscall → DAC (uid/gid, file mode) → LSM hook (SELinux/AppArmor/Yama/...) → Capability check → seccomp filter → Kernel ``` ```bash # Active LSM cat /sys/kernel/security/lsm # common: lockdown,capability,yama,apparmor,safesetid ``` ### 2. SELinux policy ```bash # Check SELinux status getenforce sestatus # Context of file/process ls -Z /usr/sbin/nginx ps -eZ | grep nginx # Audit denials ausearch -m avc -ts recent sealert -a /var/log/audit/audit.log ``` Policy module example: ```te # myapp.te policy_module(myapp, 1.0.0) type myapp_t; type myapp_exec_t; type myapp_log_t; init_daemon_domain(myapp_t, myapp_exec_t) allow myapp_t myapp_log_t:file { create write append open }; allow myapp_t self:tcp_socket { create bind listen accept }; ``` ```bash checkmodule -M -m -o myapp.mod myapp.te semodule_package -o myapp.pp -m myapp.mod semodule -i myapp.pp ``` ### 3. AppArmor profiles ```bash # Generate complain-mode profile aa-genprof /usr/bin/myapp # Enforce aa-enforce /etc/apparmor.d/usr.bin.myapp # Check status aa-status ``` ```apparmor # /etc/apparmor.d/usr.bin.myapp #include /usr/bin/myapp { #include /usr/bin/myapp mr, /var/log/myapp.log w, /etc/myapp/config r, network bind tcp, deny /etc/shadow r, } ``` ### 4. seccomp-bpf with libseccomp ```c #include int sandbox(void) { scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL_PROCESS); // Allow read/write/exit/mmap seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0); seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0); seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0); seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0); seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0); // Return EPERM instead of kill for open seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(open), 0); seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(openat), 0); return seccomp_load(ctx); } ``` ```bash # Export BPF filter for audit scmp_filter_ctx ctx = ...; seccomp_export_bpf(ctx, fd); # strace to find needed syscalls before tightening strace -c ./myapp ``` ### 5. KASLR ```bash # Check KASLR enabled cat /proc/sys/kernel/randomize_va_space # 2 = full dmesg | grep KASLR # Kernel cmdline grep kaslr /proc/cmdline ``` Mitigations against KASLR leaks: - No `/proc//maps` to untrusted - Pointer hashing in `%pK` printk - eBPF restricted on unprivileged ### 6. Intel CET ```bash # Compile with CET gcc -fcf-protection=full -o app app.c # Verify shadow stack and IBT readelf -n app | grep -E 'SHSTK|IBT' readelf --notes app | grep -A2 GNU_PROPERTY ``` | Feature | Protects against | |---------|------------------| | SHSTK (Shadow Stack) | ROP return address overwrites | | IBT (Indirect Branch Tracking) | CALL/JMP to non-ENDBR targets | Requires CPU with CET (Intel Tiger Lake+; AMD Zen 3+ on CPUs with shadow-stack support) and kernel CET support. ### 7. ARM PAC and BTI ```bash # GCC/Clang branch protection gcc -mbranch-protection=standard -o app app.c # PAC (pointer authentication) + BTI (branch target identification) # Verify readelf -n app | grep -E 'GNU_PROPERTY_AARCH64_FEATURE_1' llvm-objdump -d app | grep bti ``` PAC signs return addresses and pointers with cryptographic keys (ARMv8.3+). BTI marks valid branch targets — invalid jumps fault. ### 8. Kernel memory tagging ```bash # KASAN kernel build # CONFIG_KASAN=y in kernel .config make menuconfig # Kernel hacking → KASAN # Boot with KASAN kernel # Reports use-after-free, OOB with stack trace # KMSAN (uninitialized memory) # CONFIG_KMSAN=y — kernel equivalent of MSan ``` ```bash # KASAN report example fields # BUG: KASAN: slab-out-of-bounds in ... # Call trace: ... ``` ### 9. CVE triage workflow ```bash # Check kernel version uname -r # Distro security tracker # Ubuntu: ubuntu-security-notices # RHEL: errata # NVD lookup # https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX # Is patch backported? zgrep -l CVE-2024-XXXX /usr/share/doc/linux-*/changelog.Debian.gz ``` Triage checklist: 1. Affected subsystem (net, fs, drivers)? 2. Local or remote exploit? 3. Fixed in your kernel version? 4. Mitigation without patch (disable module, sysctl)? ## Common Problems | Symptom | Cause | Fix | |---------|-------|-----| | SELinux denials | Missing allow rule | `audit2allow`; refine policy | | AppArmor profile break | Path mismatch | Update profile paths; use globs | | seccomp kills app | Missing syscall | `strace`; add allow rule | | CET not active | Old CPU/kernel | Check `/proc/cpuinfo` flags | | KASAN kernel slow | 2-5x overhead | Use only in test VMs | | False sense of security | LSM bypass via kernel bug | Defense in depth; keep kernel updated | ## Related Skills - `skills/virtualization/containers-internals` — container seccomp and caps - `skills/runtimes/binary-hardening` — userspace CET, RELRO, PIE - `skills/runtimes/sanitizers` — ASan/HWASan userspace counterparts - `skills/observability/ebpf` — LSM BPF programs - `skills/kernel/kernel-debugging` — analyze KASAN reports - `skills/security/reverse-engineering` — exploit analysis [View on SkillFed](https://skillfed.io/mohitmishra786/low-level-dev-skills/kernel-security) · [View on GitHub](https://github.com/mohitmishra786/low-level-dev-skills)