BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Monitor\, Compile\, Enforce: A Compiler Pipeline for
  Container\n   Security Policy in Rust and eBPF\n   Tags: DEF CON Demo Lab
 s | Advanced | Cloud | Defense/Blue Team | DEF\n   CON Demo Labs\n   When:
  Saturday\, Aug 8\, 10:00 - 10:45 PDT\n   Where: LVCCW Level 1 Hall 3 902 
 (Demo Labs Track 6) - [1]Map\n\n   Description:\n\n   Container security t
 ools observe behavior (eBPF) and enforce policy\n   (BPF-LSM\, AppArmor\, 
 Seccomp). But the translation between observation\n   and enforcement is m
 anual and incomplete. We present the first tool\n   that treats this trans
 lation as a compilation problem. Built in Rust\n   with the Aya eBPF frame
 work\, three monitoring modules serve as\n   compiler frontends feeding a 
 normalized behavioral IR. Optimization\n   passes operate on this IR: patt
 ern classification\, rule deduplication\,\n   dead rule elimination\, conf
 lict detection\, and cross-category\n   dependency linking. The backend co
 mpiles optimized IR into BPF-LSM\n   enforcement rules across three LSM ho
 oks: security_file_open\,\n   security_bprm_check_security\, and security_
 socket_connect. Enforcement\n   is default-deny: any operation not in the 
 compiled profile is blocked.\n   We demo end-to-end: a container is profil
 ed\, the profile compiled\n   through the pipeline\, and enforcement block
 s unauthorized file access\,\n   process execution\, and network connectio
 ns at the kernel level. Zero\n   manual policy writing. We document the fr
 iction points where\n   monitoring context diverges from enforcement conte
 xt. No existing\n   tool\, including vArmor and KubeArmor\, implements thi
 s compilation\n   architecture with a true IR\, optimization passes\, and 
 multi-category\n   LSM enforcement.\n\n   SpeakerBio:  Buğrahan Yücel\n\
 n   Buğrahan Yücel is a software engineer at a SaaS company in Turkey\,\
 n   where he works on infrastructure security. He currently builds\n   eBP
 F-based behavioral profiling and enforcement tooling in Rust using\n   the
  Aya framework. This is his first DEF CON presentation.\n\n   Links:\n    
    GitHub - [2]https://github.com/BugrahanYucel/ebpf-mon\n   '\n\n   1. #L
 VCCW_Level1_Hall3\n   2. https://github.com/BugrahanYucel/ebpf-mon\n\n\n
DTEND:20260808T174500Z
DTSTART:20260808T170000Z
LOCATION:Demo Labs - LVCCW Level 1 Hall 3 902 (Demo Labs Track 6)
SUMMARY:Monitor\, Compile\, Enforce: A Compiler Pipeline for Container Secu
 rity Policy in Rust and eBPF
END:VEVENT
END:VCALENDAR