LID / Linux Is Dying
Posted by secsecseec@reddit | linuxadmin | View on Reddit | 2 comments
Hello again, I’m azqzazq1, a cybersecurity researcher.
My previous research, SunnyDayBPF, was recently featured by Ollie Whitehouse, CTO at the UK NCSC, in the Cyber Defence Analysis weekly summary.
Now I’m working on a new low-level Linux security research idea and I’d really like to hear opinions from people interested in eBPF, LSMs, AppArmor, and Linux hardening.
While spending more time with BPF internals, I noticed an interesting trust-boundary problem.
At a high level, the LSM framework prevents one LSM from simply overriding another LSM’s deny decision. However, eBPF tracing mechanisms can operate outside that LSM decision flow. This creates an interesting gap when combined with pathname-based MAC enforcement.
The research explores whether pre-LSM pathname manipulation through eBPF can cause AppArmor to evaluate a different path than the one originally requested by the user process.
In other words:
Can the security decision remain technically “valid” while the observed enforcement target is shifted before the LSM check?
I’m currently calling this research:
LID — Linux Integrity Drift
The focus is not “turning off AppArmor”, but understanding how kernel tracing, pathname-based access control, and security enforcement assumptions can drift from each other under specific conditions.
I’d love to hear thoughts from people working on Linux security, eBPF, AppArmor, LSM internals, or runtime detection.
Security assumptions killing all the ecosystem.
qxvkler@reddit
This is a really cool angle, honestly. Everyone’s been hyped about what eBPF can observe and enforce, but not as many people are talking about what it can subtly desync.
That pre‑LSM pathname manipulation idea sounds like the sort of thing that would be brushed off as “theoretically interesting” right up until someone chains it in a real exploit. Curious if you’ve hit any hard blockers already, like verifier constraints or ordering guarantees that kill some of the more evil variants.
If you end up publishing a writeup or PoC, please link it here. This feels like the kind of thing that could end up in threat models for “LSM + eBPF-heavy” distros pretty fast.
secsecseec@reddit (OP)
Hello. thank you so much. https://github.com/azqzazq1/LID you can see details, PoC and other things.