Loading…
This event has ended. View the official site or create your own event → Check it out
This event has ended. Create your own
October 4-6 in Berlin, Germany
Register Now for LinuxCon+ContainerCon Europe
View analytic
Wednesday, October 5 • 16:40 - 17:30
Using Seccomp to Limit the Kernel Attack Surface - Michael Kerrisk, man7.org

Sign up or log in to save this to your schedule and see who's attending!

Seccomp (secure computing) is a means to limit the system calls a program may make: it can be used to select exactly which system calls are permitted (or denied) and to restrict the arguments that may be passed to those system calls. System call filtering is achieved by writing BPF programs--programs written for a small in-kernel virtual machine that is able to examine system call numbers and arguments. Among other uses, seccomp is by now a key component of various container systems such as Docker and LXC. In this session, I'll provide a bottom-up view of seccomp before going on to examine the BPF virtual machine and some practical examples of filtering programs that restrict the set of permitted system calls. The goal is to give developers and administrators using container frameworks a solid understanding of a tool that has become a fundamental component of container frameworks.

Speakers
avatar for Michael Kerrisk

Michael Kerrisk

Author/Engineer, man7.org
Michael Kerrisk is the author of the highly praised book, ""The Linux Programming Interface"" (http://man7.org/tlpi/), a guide and reference for system programming on Linux and UNIX. Since 2004, he is the maintainer of the Linux man-pages project (http://www.kernel.org/doc/man-pages/).


Wednesday October 5, 2016 16:40 - 17:30
Köpenick