Open Source Summit Europe 2022

In a container environment based on a shared kernel, privilege escalation due to vulnerabilities and misconfigurations is one of the most critical security issues. Many existing studies detect and defend against privilege escalation by observing sensitive kernel data. However, these methods are difficult to apply to the operating cloud environment because most require modifying the kernel code or inserting a kernel module. In this talk, Inhyeok Jang and Sungjin Kim address how to utilize eBPF, a built-in kernel superpower, to respond to privilege escalation. In particular, they show the implementation results in various forms such as off-the-shelf open-source eBPF based tools, bpftrace, BCC, and BPF-CORE. In addition, they explore a practical way to use it in a cloud native environment by adding privilege escalation detection capability to an open-source Kubernetes monitoring tool. Hopefully, this talk will allow listeners to learn how to use eBPF for container security in a real-world setting and will be helpful to developers and administrators interested in extending security visibility into Linux systems in operation and defending containers.