Comment on Using Linux IMA with eBPF to protect a workload from supply chain riskparentComments−natas2ydoesn't have to be that fancy, you can run python (which is ima/evm signed) and run arbitrary stuff. ptrace shouldn't be allowed in prod, but yes you could memfd some code segment and exec into it... still python is easier...
Comments
doesn't have to be that fancy, you can run python (which is ima/evm signed) and run arbitrary stuff. ptrace shouldn't be allowed in prod, but yes you could memfd some code segment and exec into it... still python is easier...