Surviving in the Wilderness: Integrity Protection and System Update
Talkat Embedded Linux Conference + OpenIoT Summit North America 2017 · on Wednesday, 2017-02-22· at 14:00· Galleria South·
summary
Compares block- and file-based update models and shows a working reference integration that combines meta-integrity and meta-swupd with Yocto/OpenEmbedded, adds dm-verity + TPM protection for a read-only root, and an installer image that initializes per-device keys and signs hash metadata. Demonstrates QEMU patches to pass a software TPM, describes fragile failure modes with IMA/EVM (open files and missing directory protection), and reports the prototype boots and enforces verification though some patches remain unmerged.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:19MOTIVATION FOR THE TALK
- 0:39PERSONAL BACKGROUND
- 3:15WHY BOTHER?
- 7:08MECHANISMS COMPARED FOR YOCTO PROJECT
- 7:47KEY CRITERIA
- 8:54BLOCK VS. FILE UPDATE
- 10:58PARTITION LAYOUT
- 12:33INTEGRATION WITH BOOT PROCESS
- 13:31INTEGRATION WITH UPDATE SERVER
- 18:34IMA/EVM
- 27:07DM-VERITY
- 31:08COMPATIBILITY BETWEEN UPDATE AND INTEGRITY
- 33:01ARCHITECTURE
- 38:06TARGET MACHINE
- 40:54INSTALLER IMAGE
- 44:57INITRAMES
- 45:28WHOLE-DISK ENCRYPTION
- 47:54DEMO
- 49:07OPENS
related talks
19mSubsystem Update: Linux Integrity Status Update
16mSub-system Update: Linux Integrity Status Update
01h 05mImmutable and Stateless Systems with systemd
26mIntegrity
34mAuthenticated and Encrypted Storage on Embedded Linux
36mOverview and Recent Developments: Linux Integrity
56mComparison of Linux Software Update Technologies
43mOTA Updates in the Wild: Lessons from the Field