Linux Code Review Hub
Oct 24, 2024 · Information Security
Practical eBPF Security: Auditing and Intercepting Privilege‑Escalation Operations
The article explains how attackers exploit SUID binaries for privilege escalation and demonstrates how to use eBPF LSM hooks (file_open, bprm_check_security) and Kprobe tracing to audit such operations, then shows how to block them by returning error codes while exempting root users.
AuditingInterceptionKprobe
0 likes · 9 min read
