the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ the door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocat Door override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAcce Successfully set AccessCode to 999 Securing Access to a gRPC

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

process confinement from the ground up. 3 / 7 bpfbox Implementation ▶ Userspace daemon using the Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints

#/home/manashuk/Documents# kernel.pid_max = 4194304 [1]+ Done sysctl kernel.pid_max root@ubuntu:/home# python breakpoint.py 0xffffffffaa2623b0 -1 3 Kernel Stack : scan_block scan_gray_list kmemleak_scan kmemleak_scan_thread