Viewing profile — leodido

Didn't leave it out. It was grouped with AppArmor in the table, which was imprecise. I'm splitting the row. SELinux labels are on the inode, so renames preserve the context. Copy r…

Ah, and thank you for pointing to `fapolicyd`! It's the closest prior art to what we're doing at the exec layer, and its `ld.so` bypass prevention via policy rules addresses the ex…

Fair point on SELinux: grouping it with AppArmor was imprecise. Thank you for spotting it. As you mentioned, SELinux labels are on the inode, so a rename does preserve the security…

User `walterbell` is right. Padding changes the hash, so the modified binary wouldn't match the denylist. It also wouldn't match anything the system has seen before since it's now …

Author here. I helped creating Falco (CNCF runtime security) and built this (Veto) to fix the path-based identity problem we all shipped a decade ago. The dynamic linker bypass in …

Hello, glad your test run went well! Would you mind telling us more at support@listen.dev regarding the pinning? Not sure I got what you mean, just want to be sure. Feel free to se…

AFAIK not.

Written with Ragel targeting Golang. Provides partial parsing, too. 2μs to parse an average syslog line. Feedbacks always welcome.