/kernel-security

name: kernel-security
description: Linux kernel security skill for LSM, hardening, and exploit mitigations. Use when writing SELinux/AppArmor policies, seccomp-bpf filters, configuring KASLR/CET/PAC, or triaging kernel CVEs. Activates on queries about SELinux, AppArmor, seccomp, KASLR, CET, PAC, BTI, KASAN, or kernel CVE.

Kernel Security

Purpose

Guide agents through Linux kernel security: LSM frameworks (SELinux, AppArmor), seccomp-bpf with libseccomp, KASLR and bypass mitigations, Intel CET (Shadow Stack + IBT), ARM PAC and BTI, kernel sanitizers (KASAN, KMSAN), and CVE triage for kernel vulnerabilities.

When to Use

• Writing SELinux or AppArmor policies for confined services
• Sandboxing processes with seccomp-bpf filters
• Hardening binaries with CET, PAC, or BTI
• Enabling KASAN on kernel builds for vulnerability research
• Triaging kernel CVE impact on your distro/kernel version
• Designing container or microservice security boundaries

Workflow

1. LSM framework overview

Application syscall
    → DAC (uid/gid, file mode)
    → LSM hook (SELinux/AppArmor/Yama/...)
    → Capability check
    → seccomp filter
    → Kernel

# Active LSM
cat /sys/kernel/security/lsm
# common: lockdown,capability,yama,apparmor,safesetid

2. SELinux policy

# Check SELinux status
getenforce
sestatus

# Context of file/process
ls -Z /usr/sbin/nginx
ps -eZ | grep nginx

# Audit denials
ausearch -m avc -ts recent
sealert -a /var/log/audit/audit.log

Policy module example:

# myapp.te
policy_module(myapp, 1.0.0)

type myapp_t;
type myapp_exec_t;
type myapp_log_t;

init_daemon_domain(myapp_t, myapp_exec_t)

allow myapp_t myapp_log_t:file { create write append open };
allow myapp_t self:tcp_socket { create bind listen accept };

checkmodule -M -m -o myapp.mod myapp.te
semodule_package -o myapp.pp -m myapp.mod
semodule -i myapp.pp

3. AppArmor profiles

# Generate complain-mode profile
aa-genprof /usr/bin/myapp

# Enforce
aa-enforce /etc/apparmor.d/usr.bin.myapp

# Check status
aa-status

# /etc/apparmor.d/usr.bin.myapp
#include <tunables/global>

/usr/bin/myapp {
  #include <abstractions/base>

  /usr/bin/myapp mr,
  /var/log/myapp.log w,
  /etc/myapp/config r,
  network bind tcp,
  deny /etc/shadow r,
}

4. seccomp-bpf with libseccomp

#include <seccomp.h>

int sandbox(void) {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);

    // Allow read/write/exit/mmap
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(brk), 0);

    // Return EPERM instead of kill for open
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(open), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(openat), 0);

    return seccomp_load(ctx);
}

# Export BPF filter for audit
scmp_filter_ctx ctx = ...;
seccomp_export_bpf(ctx, fd);

# strace to find needed syscalls before tightening
strace -c ./myapp

5. KASLR

# Check KASLR enabled
cat /proc/sys/kernel/randomize_va_space   # 2 = full
dmesg | grep KASLR

# Kernel cmdline
grep kaslr /proc/cmdline

Mitigations against KASLR leaks:

• No `/proc/<pid>/maps` to untrusted
• Pointer hashing in `%pK` printk
• eBPF restricted on unprivileged

6. Intel CET

# Compile with CET
gcc -fcf-protection=full -o app app.c

# Verify shadow stack and IBT
readelf -n app | grep -E 'SHSTK|IBT'
readelf --notes app | grep -A2 GNU_PROPERTY

| Feature | Protects against | |---------|------------------| | SHSTK (Shadow Stack) | ROP return address overwrites | | IBT (Indirect Branch Tracking) | CALL/JMP to non-ENDBR targets |

Requires CPU with CET (Intel Tiger Lake+; AMD Zen 3+ on CPUs with shadow-stack support) and kernel CET support.

7. ARM PAC and BTI

# GCC/Clang branch protection
gcc -mbranch-protection=standard -o app app.c
# PAC (pointer authentication) + BTI (branch target identification)

# Verify
readelf -n app | grep -E 'GNU_PROPERTY_AARCH64_FEATURE_1'
llvm-objdump -d app | grep bti

PAC signs return addresses and pointers with cryptographic keys (ARMv8.3+). BTI marks valid branch targets — invalid jumps fault.

8. Kernel memory tagging

# KASAN kernel build
# CONFIG_KASAN=y in kernel .config
make menuconfig  # Kernel hacking → KASAN

# Boot with KASAN kernel
# Reports use-after-free, OOB with stack trace

# KMSAN (uninitialized memory)
# CONFIG_KMSAN=y — kernel equivalent of MSan

# KASAN report example fields
# BUG: KASAN: slab-out-of-bounds in ...
# Call trace: ...

9. CVE triage workflow

# Check kernel version
uname -r

# Distro security tracker
# Ubuntu: ubuntu-security-notices
# RHEL: errata

# NVD lookup
# https://nvd.nist.gov/vuln/detail/CVE-XXXX-XXXXX

# Is patch backported?
zgrep -l CVE-2024-XXXX /usr/share/doc/linux-*/changelog.Debian.gz

Triage checklist: 1. Affected subsystem (net, fs, drivers)? 2. Local or remote exploit? 3. Fixed in your kernel version? 4. Mitigation without patch (disable module, sysctl)?

Common Problems

| Symptom | Cause | Fix | |---------|-------|-----| | SELinux denials | Missing allow rule | `audit2allow`; refine policy | | AppArmor profile break | Path mismatch | Update profile paths; use globs | | seccomp kills app | Missing syscall | `strace`; add allow rule | | CET not active | Old CPU/kernel | Check `/proc/cpuinfo` flags | | KASAN kernel slow | 2-5x overhead | Use only in test VMs | | False sense of security | LSM bypass via kernel bug | Defense in depth; keep kernel updated |

Related Skills

• `skills/virtualization/containers-internals` — container seccomp and caps
• `skills/runtimes/binary-hardening` — userspace CET, RELRO, PIE
• `skills/run