Hardening the Host Kernel against Userspace

Apply policies that minimize the attack surface exposed by the kernel to user processes.

In this lesson, you will learn how to restrict the interface between userspace applications and the kernel to minimize your system's attack surface.

The Linux kernel provides a massive interface to userspace through system calls (syscalls), /proc, and /sys filesystems. An attacker who gains control of a user process typically attempts to exploit vulnerabilities in these interfaces to trigger kernel-level code execution or elevate privileges. Hardening the host involves enforcing the "Principle of Least Privilege" at the syscall level, ensuring processes can only interact with the kernel features they absolutely require.

Restricting Syscalls with Seccomp

The most effective way to harden the host against userspace is by implementing seccomp-bpf filters. By applying a whitelist, you can define exactly which syscalls a service is permitted to execute. If a compromised application attempts to invoke a dangerous syscall—such as mount or ptrace—which it doesn't need for its primary function, the kernel will immediately kill the process or deny the request.

For example, if you are running a simple web worker, it likely has no business calling reboot or kexec_load. You can apply a policy that blocks these:

// Conceptual seccomp filter snippet
struct sock_filter filter[] = {
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr))),
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_reboot, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
};

Sanitizing the Interface

Beyond syscalls, you must limit access to the /proc and /sys virtual filesystems. Many kernel interfaces expose sensitive information (like memory maps or hardware details) that can be used to bypass ASLR or identify kernel structures. Using your Mandatory Access Control (MAC) system, you should apply strict labeling to ensure that only authorized administrative services can read from /proc/kallsyms or modify kernel parameters via /proc/sys.

By restricting the kernel’s exposure to only the specific inputs required for an application to operate, you effectively shrink the target area for potential exploits, forcing attackers to operate within an severely constrained sandbox.

Key Takeaway: Hardening the host kernel requires a proactive "deny-by-default" approach, using seccomp filters and MAC policies to strip away all unnecessary syscalls and virtual file access from user processes.