EBPFGuard: a Rust Library Mitigation of Threats Using LSM Hooks
Linux is so weird with its approach to security. So many prevention tools and LSMs but it is the easiest platform for post exploitation. For one a lot of effort goes into stopping you from getting root but all if it revolves around the sysadmin not making one of many mistakes and even as root, instead of having a sane way of signing kernel modules by a trusted party (distro), they take great pains to make it hard to do bad stuff like preventing hooks and other things being used by LKMs.<p>Linux security is architected by really smart figures that are mentally stuck on ideologies and silver bullets, don&#x27;t get me wrong, if setup right Linux is difficult for attackers but that rarely ever happens. There are too many &quot;well if a threat actor can do that then you have bigger problems&quot; type of oldschool legacy thinking.<p>What I really want in Linux is good defaults that treat users as infants playing with scisssors. Get over the whole &quot;centralized anything is bad&quot; b.s., and for distros to have good monitoring tools. Detection deserves more priority than prevention. Imagine having all the difficult to tune LKM rules,  auditd,etc... play nice with each other and alert visually on the desktop and insist on you giving them your email or whatever so the distro managed  alerting servers can alert you on stuff.<p>On windows even when I disable defender it secretly monitors stuff and re-enables some features when it sees weird things (and MS would even alert your people if you are an enterprise customer and it is a serious threat) and it can be one of the hardesr hurdles to overcome. To fully disable defender or AV, you have to exploit a vulnerable signed driver, on linux just rm -rf stuff and unload it as root because &quot;if they have root, you have bigger problems&quot;<p>Nothing against this tool, at least they seem to have detection (alerting?) in mind as well from what I skimmed.