Search results

* [https://docs.kernel.org/userspace-api/seccomp_filter.html Seccomp BPF (SECure COMPuting with filters)]

* [https://docs.kernel.org/userspace-api/seccomp_filter.html Seccomp BPF (SECure COMPuting with filters)]

CONFIG_LSM="landlock,lockdown,yama,integrity,tomoyo,bpf" ...s 5.1 and above, append {{ic|1=lsm=landlock,lockdown,yama,integrity,tomoyo,bpf}}.

* [https://docs.kernel.org/userspace-api/seccomp_filter.html Seccomp BPF (SECure COMPuting with filters)]

lsm=landlock,lockdown,yama,integrity,apparmor,bpf CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor,bpf"

* [https://docs.kernel.org/userspace-api/seccomp_filter.html Seccomp BPF (SECure COMPuting with filters)]

-A exclude,always -F msgtype=BPF

seccomp: bpf-argument-filtering kernel:allow kernel:errno kernel:kill_process kernel:kil

lsm=landlock,lockdown,yama,integrity,selinux,bpf CONFIG_LSM="landlock,lockdown,yama,integrity,selinux,bpf"

seccomp: bpf-argument-filtering kernel:allow kernel:errno kernel:kill_process kernel:kil

seccomp: bpf-argument-filtering kernel:allow kernel:errno kernel:kill_process kernel:kil

=== BPF hardening === BPF is a system used to load and execute bytecode within the kernel dynamically

=== Deixando o BPF mais seguro === BPF é um sistema usado para carregar e executar bytecode dentro do kernel dina

install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids

=== Mejoras en la seguridad de BPF === BPF es un sistema que carga y ejecuta bytecode en el kernel de forma dinámica

...ce 4.18 the kernel can decode the signals of some IR remote controls using BPF, making LIRC sometimes redundant.[https://lwn.net/Articles/759188/]}}

install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids

=== Защита BPF === BPF — система динамической загрузки байткод

install -Dt "$builddir/tools/bpf/resolve_btfids" tools/bpf/resolve_btfids/resolve_btfids

SystemCallFilter=add_key keyctl bpf ...configuration above exposes the system calls ''add_key'', ''keyctl'' and ''bpf'' to the container, which are not namespaced. This could still be a securit