BPF LSM.

A Linux Security Module that lets verified eBPF programs attach to LSM hooks and enforce custom Mandatory Access Control decisions on syscalls, files, sockets, and capabilities. It belongs to the Identity & Access category of cybersecurity.

A Linux Security Module that lets verified eBPF programs attach to LSM hooks and enforce custom Mandatory Access Control decisions on syscalls, files, sockets, and capabilities.

BPF LSM (BPF Linux Security Module) was merged in Linux 5.7 (2020) by KP Singh and others at Google. The Linux Security Module framework defines hundreds of security hooks across the kernel (inode_permission, socket_connect, bprm_check, file_open, capable, etc.) that traditional LSMs such as SELinux, AppArmor, Smack, and Tomoyo plug into. BPF LSM lets verified eBPF programs attach to those same hooks at runtime, so operators can ship policy as compiled bytecode rather than patching the kernel. Tools such as Cilium Tetragon, KubeArmor, and bpfd use BPF LSM to enforce MAC controls — for example denying execve of /tmp binaries inside a container or blocking ptrace on a sensitive process — while remaining hot-loadable and cgroup-aware. It complements rather than replaces SELinux and AppArmor.

Defences for BPF LSM typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: LSM BPF, eBPF LSM.