Overview of the Linux Kernel Security Subsystem
summary
Overview lists concrete kernel features and their effects: LSM hooks provide the pluggable access points used by SELinux, AppArmor and Smack; seccomp via BPF enforces syscall whitelists to block entire classes of kernel exploits; POSIX capabilities decompose root but remain hard to reason about; DM‑Verity disk integrity and TPM‑backed keys enable measured and signed boot plus key protection; namespaces plus cgroups isolate temp and container views; audit, netfilter, crypto API and the kernel self‑protection project are all shown as practical, upstreamed defenses.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:40Overview
- 2:18Linux Security Model
- 7:25Linux kernel Security Extensions
- 7:44POSIX Access Control Lists (ACLS)
- 8:31POSIX Capabilities
- 10:52Audit
- 11:29Seccomp
- 13:19Namespaces
- 14:24Netfilter
- 15:05Cryptography API
- 15:39Key Management
- 16:27Linux Security Modules (LSM)
- 18:18Security Enhanced Linux (SELinux)
- 19:14Smack
- 19:33AppArmor
- 19:54Platform Security
- 20:39Integrity Management
- 23:29Resources
- 24:45Questions?
related talks
59mGetting Started with Embedded Linux Security
01h 35mTutorial: How to Write a Linux Security Module
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
26mKernel Runtime Security Instrumentation
38mSecure the Linux Kernel with eBPF Linux Security Module
51m10 Years of Linux Security - A Report Card
01h 02mLinux Kernel Security: Theory and Practice
42mSecurity in Large Scale Embedded Linux Projects