Back to Details

kernel-security

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Kernel Security

Linux 内核安全

Purpose

目的

Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities.
指导 Agent 掌握 Linux 内核安全：LSM 框架（SELinux、AppArmor）、使用 libseccomp 实现 seccomp-bpf、KASLR 及其绕过缓解措施、Intel CET（Shadow Stack + IBT）、ARM PAC 与 BTI、内核 sanitizer（KASAN、KMSAN），以及内核漏洞的 CVE 研判。

When to Use

适用场景

  • Writing SELinux or AppArmor policies for confined services
  • Sandboxing processes with seccomp-bpf filters
  • Hardening binaries with CET, PAC, or BTI
  • Enabling KASAN on kernel builds for vulnerability research
  • Triaging kernel CVE impact on your distro/kernel version
  • Designing container or microservice security boundaries
  • 为受限服务编写 SELinux 或 AppArmor 策略
  • 使用 seccomp-bpf 过滤器对进程进行沙箱隔离
  • 使用 CET、PAC 或 BTI 对二进制文件进行加固
  • 在内核构建中启用 KASAN 以开展漏洞研究
  • 研判内核 CVE 对当前发行版或内核版本的影响
  • 设计容器或微服务的安全边界

Workflow

工作流

1. LSM framework overview

1. LSM 框架概览

Application syscall
    → DAC (uid/gid, file mode)
    → LSM hook (SELinux/AppArmor/Yama/...)
    → Capability check
    → seccomp filter
    → Kernel
bash
undefined
Application syscall
    → DAC (uid/gid, file mode)
    → LSM hook (SELinux/AppArmor/Yama/...)
    → Capability check
    → seccomp filter
    → Kernel
bash
undefined

Active LSM

Active LSM

cat /sys/kernel/security/lsm
cat /sys/kernel/security/lsm

common: lockdown,capability,yama,apparmor,safesetid

common: lockdown,capability,yama,apparmor,safesetid

undefined
undefined

2. SELinux policy

2. SELinux 策略

bash
undefined
bash
undefined

Check SELinux status

Check SELinux status

getenforce sestatus
getenforce sestatus

Context of file/process

Context of file/process

ls -Z /usr/sbin/nginx ps -eZ | grep nginx
ls -Z /usr/sbin/nginx ps -eZ | grep nginx

Audit denials

Audit denials

ausearch -m avc -ts recent sealert -a /var/log/audit/audit.log

Policy module example:

```te
ausearch -m avc -ts recent sealert -a /var/log/audit/audit.log

策略模块示例：

```te

myapp.te

myapp.te

policy_module(myapp, 1.0.0)
type myapp_t; type myapp_exec_t; type myapp_log_t;
init_daemon_domain(myapp_t, myapp_exec_t)
allow myapp_t myapp_log_t:file { create write append open }; allow myapp_t self:tcp_socket { create bind listen accept };

```bash
checkmodule -M -m -o myapp.mod myapp.te
semodule_package -o myapp.pp -m myapp.mod
semodule -i myapp.pp
policy_module(myapp, 1.0.0)
type myapp_t; type myapp_exec_t; type myapp_log_t;
init_daemon_domain(myapp_t, myapp_exec_t)
allow myapp_t myapp_log_t:file { create write append open }; allow myapp_t self:tcp_socket { create bind listen accept };

```bash
checkmodule -M -m -o myapp.mod myapp.te
semodule_package -o myapp.pp -m myapp.mod
semodule -i myapp.pp

3. AppArmor profiles

3. AppArmor profiles

bash
undefined
bash
undefined

Generate complain-mode profile

Generate complain-mode profile

aa-genprof /usr/bin/myapp
aa-genprof /usr/bin/myapp

Enforce

Enforce

aa-enforce /etc/apparmor.d/usr.bin.myapp
aa-enforce /etc/apparmor.d/usr.bin.myapp

Check status

Check status

aa-status

```apparmor
aa-status

```apparmor

/etc/apparmor.d/usr.bin.myapp

/etc/apparmor.d/usr.bin.myapp

#include <tunables/global>
/usr/bin/myapp { #include <abstractions/base>
/usr/bin/myapp mr, /var/log/myapp.log w, /etc/myapp/config r, network bind tcp, deny /etc/shadow r, }
undefined
#include <tunables/global>
/usr/bin/myapp { #include <abstractions/base>
/usr/bin/myapp mr, /var/log/myapp.log w, /etc/myapp/config r, network bind tcp, deny /etc/shadow r, }
undefined

4. seccomp-bpf with libseccomp

4. 使用 libseccomp 实现 seccomp-bpf

c
#include <seccomp.h>

int sandbox(void) {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);

    // Allow read/write/exit/mmap
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);

    // Return EPERM instead of kill for open
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(open), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(openat), 0);

    return seccomp_load(ctx);
}
bash
undefined
c
#include <seccomp.h>

int sandbox(void) {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);

    // Allow read/write/exit/mmap
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);

    // Return EPERM instead of kill for open
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(open), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(openat), 0);

    return seccomp_load(ctx);
}
bash
undefined

Export BPF filter for audit

Export BPF filter for audit

scmp_filter_ctx ctx = ...; seccomp_export_bpf(ctx, fd);
scmp_filter_ctx ctx = ...; seccomp_export_bpf(ctx, fd);

strace to find needed syscalls before tightening

strace to find needed syscalls before tightening

strace -c ./myapp
undefined
strace -c ./myapp
undefined

5. KASLR

5. KASLR

bash
undefined
bash
undefined

Check KASLR enabled

Check KASLR enabled

cat /proc/sys/kernel/randomize_va_space # 2 = full dmesg | grep KASLR
cat /proc/sys/kernel/randomize_va_space # 2 = full dmesg | grep KASLR

Kernel cmdline

Kernel cmdline

grep kaslr /proc/cmdline

Mitigations against KASLR leaks:
- No `/proc/<pid>/maps` to untrusted
- Pointer hashing in `%pK` printk
- eBPF restricted on unprivileged
grep kaslr /proc/cmdline

防止 KASLR 信息泄露的缓解措施：
- 不向不受信任方开放 `/proc/<pid>/maps`
- 在 `%pK` printk 中进行指针哈希处理
- 限制非特权用户使用 eBPF

6. Intel CET

6. Intel CET

bash
undefined
bash
undefined

Compile with CET

Compile with CET

gcc -fcf-protection=full -o app app.c
gcc -fcf-protection=full -o app app.c

Verify shadow stack and IBT

Verify shadow stack and IBT

readelf -n app | grep -E 'SHSTK|IBT' readelf --notes app | grep -A2 GNU_PROPERTY

| Feature | Protects against |
|---------|------------------|
| SHSTK (Shadow Stack) | ROP return address overwrites |
| IBT (Indirect Branch Tracking) | CALL/JMP to non-ENDBR targets |

Requires CPU with CET (Intel Tiger Lake+; AMD Zen 3+ on CPUs with shadow-stack support) and kernel CET support.
readelf -n app | grep -E 'SHSTK|IBT' readelf --notes app | grep -A2 GNU_PROPERTY

| 功能 | 防护目标 |
|---------|------------------|
| SHSTK（Shadow Stack） | 防止 ROP 返回地址被覆写 |
| IBT（Indirect Branch Tracking） | 防止 CALL/JMP 跳转到非 ENDBR 目标 |

需要支持 CET 的 CPU（Intel Tiger Lake+；支持 Shadow Stack 的 AMD Zen 3+ CPU）以及内核对 CET 的支持。

7. ARM PAC and BTI

7. ARM PAC 与 BTI

bash
undefined
bash
undefined

GCC/Clang branch protection

GCC/Clang branch protection

gcc -mbranch-protection=standard -o app app.c
gcc -mbranch-protection=standard -o app app.c

PAC (pointer authentication) + BTI (branch target identification)

PAC (pointer authentication) + BTI (branch target identification)

Verify

Verify

readelf -n app | grep -E 'GNU_PROPERTY_AARCH64_FEATURE_1' llvm-objdump -d app | grep bti

PAC signs return addresses and pointers with cryptographic keys (ARMv8.3+).
BTI marks valid branch targets — invalid jumps fault.
readelf -n app | grep -E 'GNU_PROPERTY_AARCH64_FEATURE_1' llvm-objdump -d app | grep bti
PAC 使用加密密钥对返回地址和指针进行签名（ARMv8.3+）。
BTI 标记有效的分支目标——跳转至无效目标时将触发异常。

8. Kernel memory tagging

8. 内核内存标记

bash
undefined
bash
undefined

KASAN kernel build

KASAN kernel build

CONFIG_KASAN=y in kernel .config

CONFIG_KASAN=y in kernel .config

make menuconfig # Kernel hacking → KASAN
make menuconfig # Kernel hacking → KASAN

Boot with KASAN kernel

Boot with KASAN kernel

Reports use-after-free, OOB with stack trace

Reports use-after-free, OOB with stack trace

KMSAN (uninitialized memory)

KMSAN (uninitialized memory)

CONFIG_KMSAN=y — kernel equivalent of MSan

CONFIG_KMSAN=y — kernel equivalent of MSan


```bash

```bash

KASAN report example fields

KASAN report example fields

BUG: KASAN: slab-out-of-bounds in ...

BUG: KASAN: slab-out-of-bounds in ...

Call trace: ...

Call trace: ...

undefined
undefined

9. CVE triage workflow

9. CVE 研判工作流

bash
undefined
bash
undefined

Check kernel version

Check kernel version

uname -r
uname -r

Distro security tracker

Distro security tracker

Ubuntu: ubuntu-security-notices

Ubuntu: ubuntu-security-notices

RHEL: errata

RHEL: errata

NVD lookup

NVD lookup

https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX

https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX

Is patch backported?

Is patch backported?

zgrep -l CVE-2024-XXXX /usr/share/doc/linux-*/changelog.Debian.gz

Triage checklist:
1. Affected subsystem (net, fs, drivers)?
2. Local or remote exploit?
3. Fixed in your kernel version?
4. Mitigation without patch (disable module, sysctl)?
zgrep -l CVE-2024-XXXX /usr/share/doc/linux-*/changelog.Debian.gz

研判清单：
1. 受影响的子系统（net、fs、drivers）？
2. 本地漏洞利用还是远程漏洞利用？
3. 是否已在所使用的内核版本中修复？
4. 是否存在无需补丁的缓解措施（禁用模块、sysctl）？

Common Problems

常见问题

SymptomCauseFix
SELinux denialsMissing allow rule
audit2allow
; refine policy
AppArmor profile breakPath mismatchUpdate profile paths; use globs
seccomp kills appMissing syscall
strace
; add allow rule
CET not activeOld CPU/kernelCheck 
/proc/cpuinfo
flags
KASAN kernel slow2-5x overheadUse only in test VMs
False sense of securityLSM bypass via kernel bugDefense in depth; keep kernel updated
症状原因修复方法
SELinux 拒绝缺少 allow 规则使用 
audit2allow
；完善策略
AppArmor profile 失效路径不匹配更新 profile 路径；使用 glob
seccomp 终止应用缺少 syscall使用 
strace
；添加 allow 规则
CET 未生效CPU 或内核过旧检查 
/proc/cpuinfo
flags
KASAN 内核运行缓慢2–5 倍开销仅在测试 VM 中使用
产生虚假的安全感通过内核 bug 绕过 LSM纵深防御；及时更新内核

Related Skills

相关 Skills

  • skills/virtualization/containers-internals
    — container seccomp and caps
  • skills/runtimes/binary-hardening
    — userspace CET, RELRO, PIE
  • skills/runtimes/sanitizers
    — ASan/HWASan userspace counterparts
  • skills/observability/ebpf
    — LSM BPF programs
  • skills/kernel/kernel-debugging
    — analyze KASAN reports
  • skills/security/reverse-engineering
    — exploit analysis
  • skills/virtualization/containers-internals
    ——容器 seccomp 与 caps
  • skills/runtimes/binary-hardening
    ——用户空间 CET、RELRO、PIE
  • skills/runtimes/sanitizers
    ——对应的用户空间 ASan/HWASan 工具
  • skills/observability/ebpf
    ——LSM BPF 程序
  • skills/kernel/kernel-debugging
    ——分析 KASAN 报告
  • skills/security/reverse-engineering
    ——漏洞利用分析