Linux Security Summit North America 2026

BPF LSM has become a cornerstone for fine-grained security enforcement, yet it often operates in isolation from the kernel's primary reporting mechanism: the Linux Audit Subsystem. This disconnection creates a visibility gap where programmable security policies cannot easily communicate events through standard, compliance-ready audit channels.

This session explores the value of exposing the Linux Audit Subsystem to BPF LSM programs via kfuncs. By allowing BPF-based security modules to emit formal audit records, we can bridge the gap between flexible, high-performance enforcement and the standardized logging required for incident response and regulatory compliance. We will discuss the operational implications of this integration, highlighting how it enables BPF to function as a first-class citizen within the existing enterprise security stack, providing both the power of programmable enforcement and the transparency of traditional auditing.