Linux Security Summit North America 2026

Hornet LSM addresses a longstanding trust gap in the eBPF ecosystem by enabling strong integrity guarantees for eBPF programs and maps in locked-down production environments. While eBPF has become a powerful foundation for observability, networking, and security, safely deploying it in hardened systems remains a challenge.
In this talk, we present the architecture, implementation, and practical usage of Hornet LSM, an in-kernel, composable Linux Security Module designed to complement existing upstream mechanisms. We will explore how Hornet enables verification and auditing of eBPF programs and maps, allowing operators to confidently leverage eBPF while maintaining a strong security posture.
The session will also examine the current upstream eBPF security model, discuss its strengths and limitations, and show how Hornet builds upon and extends these foundations without imposing policy. Attendees will leave with a clear understanding of how Hornet LSM can be integrated into hardened production systems to safely unlock the full potential of eBPF.