LVBS and Advanced Kernel Integrity
summary
LVBS creates a VTL1 minimal Linux secure OS using Hyper‑V/VSM to enforce immutable EPT permissions for every guest kernel page at boot and injects intercepts on violations; a hypervisor‑agnostic layer (works on Hyper‑V and KVM, AMD/Intel x64) adds vtl calls like load_kernel_data and validate_module vtl call so VTL1 reconstructs and authenticates module blobs with guest build/certs, atomically flips EPT permissions and returns a token. Demo blocks unsigned modules and kills a tampering thread; module loading currently working, ftrace/livepatch/kprobes in progress; code on GitHub.
AI-written summary · about
chapters (12)
- 0:00LVBS and kernel integrity intro
- 1:06Motivation behind LVBS
- 2:12LVBS architecture and hypervisor
- 4:42Threat model for kernel integrity
- 6:05LVBS software architecture
- 8:35LVBS boot sequence
- 11:25Memory protections with LVBS
- 16:47Enabling kernel features
- 22:10Demo: LVBS memory protections
- 28:19Lessons from LVBS implementation
- 29:43Future plans for LVBS
- 30:32Q&A
related talks
47mLinux Virtualization Based Security
50mLinux Virtualization Based Security (LVBS)
48mBooting a Linux Kernel in a Higher Privilege Level
23mHyper-V's Virtual Secure Mode in KVM project update
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
15mRemote Attestation in AMD SEV-SNP Confidential VMs