leodido

6 ms·

1.
by leodido 7mo ago
Didn't leave it out. It was grouped with AppArmor in the table, which was imprecise. I'm splitting the row. SELinux labels are on the inode, so renames preserve the context. Copy resistance is policy-dependent (works for `sandbox_
2.
by leodido 7mo ago
Ah, and thank you for pointing to `fapolicyd`! It's the closest prior art to what we're doing at the exec layer, and its `ld.so` bypass prevention via policy rules addresses the exact dynamic linker evasion I wrote about. Two arch
3.
by leodido 7mo ago
Fair point on SELinux: grouping it with AppArmor was imprecise. Thank you for spotting it. As you mentioned, SELinux labels are on the inode, so a rename does preserve the security context. I'll split the row in the table. On the copy
4.
by leodido 7mo ago
User `walterbell` is right. Padding changes the hash, so the modified binary wouldn't match the denylist. It also wouldn't match anything the system has seen before since it's now an unknown binary... The veto denylist approa
5.
by leodido 7mo ago
Author here. I helped creating Falco (CNCF runtime security) and built this (Veto) to fix the path-based identity problem we all shipped a decade ago. The dynamic linker bypass in the "where it breaks" section is the part I'm
6.
by leodido 2y ago
Hello, glad your test run went well! Would you mind telling us more at support@listen.dev regarding the pinning? Not sure I got what you mean, just want to be sure. Feel free to send us the details at that email. Thank you, ~leo
7.
Show HN: Bpfcov – source-based code coverage for eBPF programs(github.com)
2 points by leodido 5y ago|0 comments
8.
by leodido 7y ago
AFAIK not.
9.
Show HN: Kubectl-dig – Deep kubernetes visibility from the kubectl(github.com)
7 points by leodido 7y ago|0 comments
10.
by leodido 8y ago
Written with Ragel targeting Golang. Provides partial parsing, too. 2μs to parse an average syslog line. Feedbacks always welcome.
11.
Blazing fast RFC5424-compliant syslog parser(github.com)
2 points by leodido 8y ago|1 comments