Extending Non-Repudiable Logs with eBPF

Explore how eBPF can enhance non-repudiable logging in the Linux kernel to improve system integrity attestation. Learn about an extensible interface that allows user-defined programs to leverage TPM-based non-repudiable logging for any kernel data accessible to eBPF programs. Discover how this approach enables more granular system integrity verification through the wide variety of eBPF hook locations. Examine a practical application of this technique in measuring and storing container image digests to verify and attest container integrity. Gain insights into the exciting future of eBPF in security and trust, and its potential for various use cases.

Extending Non-Repudiable Logs with eBPF - Avery Blanchard, George Almasi