gVisor: Modern Linux Sandboxing Technology - Hack In The Box 2023
Explore gVisor-based Linux sandboxing: advantages, implementation, and applications in security. Learn about existing solutions, primitives, and how to build a process-level sandbox for enhanced observability and protection.
How to Protect Your Privacy Using X.Org Security Module on the Desktop
Learn to enhance desktop privacy using X.Org Security Module. Explore implementation, evaluation, and practical insights for safeguarding personal information on Linux systems.
Making Unprivileged Containers More Usable
Explore unprivileged containers, their limitations, and solutions for enhanced usability. Learn about syscalls, seccomp, kernel policies, and security considerations in container management.
CRIU and SELinux: Implementing Container Live Migration with Checkpoint/Restore - Forum 1
Explore container live migration with CRIU, focusing on SELinux labeling challenges and solutions for preserving security context during process and container migration.
Popping the Penguin - An Introduction to the Principles of Linux Persistence
Explore Linux persistence techniques and principles for maintaining unauthorized access, covering key methods and strategies used by attackers to remain undetected on compromised systems.
Intro to Linux System Hardening
Learn essential Linux system hardening techniques, from securing ports and services to configuring SSH and implementing firewalls, in this comprehensive introduction to enhancing your system's security.
Kubernetes Node Firewalling from the Inside Out
Explore advanced host network firewalling in Kubernetes using declarative resources. Learn about contemporary implementations in Talos and Cilium for enhanced cluster security.
Drawing Lines in the Sand - Running Unprivileged eBPF in Kubernetes
Explore eBPF capabilities in Kubernetes, focusing on security permissions, Linux capabilities, and avoiding 'privileged:true'. Learn about fine-grained control and necessary privileges for different eBPF features.
The Evolution of Exploiting Memory Vulnerabilities in Linux
Explore the evolution of memory vulnerability exploitation in Linux, covering outdated techniques, binary hardening, and cutting-edge bypass methods, with real-world examples and statistical insights.
Linux Namespaces for Fun and Isolation - NDC Security 2024
Explore Linux namespaces for containerization and sandboxing. Learn their purposes and practical applications in software development for enhanced security and isolation.
The Digest_cache LSM - Enhancing File Access Security and Performance
Explore the digest_cache LSM, a standalone component providing reference digest values for file integrity verification, improving system security and performance in Linux environments.
Unprivileged Access Control in AppArmor
Explore AppArmor's extension for unprivileged access control, including challenges, changes, and API development for enhanced application security and sandboxing capabilities.
KubeArmor: Cloud-Native Runtime Security Enforcement
Explore KubeArmor: a runtime security system for cloud-native environments. Learn how it restricts pod, container, and node behavior using Linux security modules and generates rich alerts with eBPF.
Minijail: Running Untrusted Programs Safely
Explore Minijail, a powerful sandboxing tool for secure execution of untrusted code. Learn its applications in Chrome OS, Android, and server environments, including containerized Android on Chrome OS.
On the Way to Safe Containers - Security and Resource Management in LXC and LXD
Explore container security with LXC and LXD, focusing on user namespaces, AppArmor, seccomp, and resource limitations. Learn about safe system containers and potential vulnerabilities in VM-like environments.
Towards Measured Boot Out of the Box
Explore measured boot technology, its importance for system security, and innovative approaches to implement it effectively in Linux distributions, overcoming adoption challenges.
Seecomp: Understanding Linux Kernel Security Features
Explore Seecomp, a tool for enhancing Linux kernel security through system call filtering. Learn about its architecture, testing, and key features for improved security and logging.
SELinux in the Containerized World - Kubernetes Security and Challenges
Explore SELinux's role in container and Kubernetes security, covering challenges, volume relabeling, and future integration prospects.
Rootful Networking with Rootless Podman Containers
Explore rootful networking with rootless Podman containers, uncovering network namespace intricacies and enhancing container security without sacrificing functionality.
Restricting Unprivileged User Namespaces in Ubuntu
Explore Ubuntu 24.04's approach to restricting unprivileged user namespaces, including challenges, solutions, and ongoing efforts to address remaining issues.
Update on Landlock: IOCTL Support
Explore Landlock security module's features, recent developments, and new IOCTL restriction support for enhanced Linux process sandboxing and security policies.