LSM Updates: IMA, SELinux, AppArmor, SMACK &...
summary
IMA and EVM become regular LSMs via LSM stacking and shared security blobs, add machine keyring support, and ship IMA/EVM utils 1.5 with UML test pipelines; an integrity digest cache (digest lists from RPM/Debian manifests) makes PCRs deterministic and cuts appraisal work by verifying one signature for thousands of files. SMACK fixes overlayFS transmute bugs and needs IPv6 work. AppArmor rewrites permission encoding, adds a hybrid buffer pool and finer unconfined controls. BPF LSM lands static-call patches yielding ~200k branch-miss reduction, enabling flexible, user-driven container policies.
AI-written summary · about
chapters (20)
- 0:00Integrity subsystem updates
- 3:53IMA and EVM as LSMs
- 4:15Machine keyring for IMA appraisal
- 5:16IMA measurement digest cache
- 8:25IMA/EVM utils v1.5 highlights
- 8:45IMA/EVM documentation improvements
- 9:49IMA appraisal on CentOS 9/RHEL 9.3
- 10:30SMACK LSM updates and maintainer
- 12:58SMACK needs and test suite
- 13:21AppArmor mediation and performance
- 25:18AppArmor unconfined restrictions
- 29:11AppArmor tooling improvements
- 31:38SELinux four-year highlights
- 44:39SELinux policy and performance
- 51:34SELinux deprecations and contributions
- 53:17SELinux development involvement
- 54:21SELinux Q&A
- 55:19BPF LSM on ARM64 performance
- 1:06:30Static calls for LSM performance
- 1:12:11BPF LSM as major LSM
related talks
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
30mLSM Stacking - What You Can Do Now and What's Next
34mTying EVM into LSM Policy
52mLSM Maintainers Panel
32mUsing a Different LSM from the Host in a Container
33mSecurity Module Stacks That Don't Fall Over
23mStacked LSMs and User Space
16mSub-system Update: Linux Integrity Status Update