The Netflix TechBlog

DECEMBER 23, 2020

We already use the default settings offered by Docker, such as AppArmor, and seccomp, but by adding user namespaces, we can achieve a superior defense-in-depth security model. These CVEs did not affect our infrastructure because we were using user namespaces for all of our containers.

Media 286

Media Metrics Systems Processing 286

Brendan Gregg

SEPTEMBER 25, 2021

apparmor?). Browsing the flame graph shows it is calling the gettimeofday(2) syscall which enters the tracesys() and syscall_trace_enter/exit() kernel functions. This gave me two theories: A) Some syscall tracing is enabled in Ubuntu (auditing? Theory (A) is most likely based on the frame widths in the flame graph.

Speed 126

Speed Java AWS Virtualization 126

Brendan Gregg

SEPTEMBER 25, 2021

apparmor?). Browsing the flame graph shows it is calling the gettimeofday(2) syscall which enters the tracesys() and syscall_trace_enter/exit() kernel functions. This gave me two theories: A) Some syscall tracing is enabled in Ubuntu (auditing? Theory (A) is most likely based on the frame widths in the flame graph.

Speed 52

Speed Java AWS Virtualization 52

Brendan Gregg

SEPTEMBER 25, 2021

apparmor?). Browsing the flame graph shows it is calling the gettimeofday(2) syscall which enters the tracesys() and syscall_trace_enter/exit() kernel functions. This gave me two theories: A) Some syscall tracing is enabled in Ubuntu (auditing? Theory (A) is most likely based on the frame widths in the flame graph.

Speed 40

Speed Java AWS Virtualization 40

Brendan Gregg

SEPTEMBER 5, 2017

. ## Security Key Linux security technologies to learn: - LSM : Linux Security Modules - AppArmor : application access control (LSM) - seccomp : secure computing mode, restricts system call usage - SELinux : Security-Enhanced Linux (LSM), for access control and security policies (alternate to apparmor) - Linux audit : event logging - eBPF (which is (..)

Virtualization 76

Virtualization AWS Engineering Hardware 76