LSM Stacking - What You Can Do Now and What's Next
summary
Kernel supports stacking for LSMs that restrict themselves to 5.3 infrastructure-managed blobs (credential, inode, file; now expanding to sock security blob), so SELinux can run alongside Landlock, Smack or others without exclusivity. Next steps target removing AppArmor’s exclusive tag in the 5.5 timeframe by adding blobs, new compound proc/socket formats (a null-separated context list), a per-process display selector for legacy daemons, expanded audit fields (subs=) and work on netlabel/secmark and labeled NFS integration.
AI-written summary · about
chapters (13)
- 0:00Linux Security Modules
- 2:10LSM Types
- 2:31Restricted Stacking
- 3:42Infrastructure Managed Blobs (5.3)
- 6:04Goals
- 7:15Infrastructure Managed Blobs (5.X)
- 7:58Compound Contexts
- 11:57Classic Contexts - Choices
- 16:41Enhanced Audit Data
- 19:56Infrastructure Managed Blobs (5.Y)
- 21:18Netlabel
- 24:23Secmarks
- 25:44Labeled NFS4
related talks
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
33mSecurity Module Stacks That Don't Fall Over
30mSecurity Module Stacks that Don't Fall Over
41mThe State and Direction of LSM Stacking
23mStacked LSMs and User Space
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
52mLSM Maintainers Panel
27mBPF LSM - Updates and What next?