Integrity Measurements and the Cruel World
Talkat Linux Security Summit North America 2019 · on Tuesday, 2019-08-20· at 14:30· Sapphire D, Hilton San Diego Bayfront·
summary
Implements IMA on production embedded Android devices by building an IMA initializer that detects device state, generates and stores device keys, loads policy fragments and handles factory/reset and recovery states; adds mkfs support to embed IMA labels; creates a TPM-light trusted key helper in an initramfs-like userland to seal/generate keys; instruments mm page-flush and a per-CPU workqueue for delayed measurements via mm page-flush, achieving about 99.2% accuracy in a 24h user sample, ~1 ms measurement latency and ~10% overall appraisal overhead.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:24Background
- 1:32Use Cases
- 2:41What do we need
- 5:03Initializer
- 6:22TPM
- 10:16Policies
- 14:55Measurement Support
- 19:04Architecture
- 19:51Measurements
- 21:48MMM
- 28:22Performance Considerations
- 29:20Application Installation Support
- 30:50Factory Reset Support
- 33:21Recovery Mode
related talks
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
47mNamespacing the Linux Integrity Measurement Architecture
35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
36mOverview and Recent Developments: Linux Integrity
26mIntegrity
34mEnforcing Runtime Integrity with Maat
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
16mSub-system Update: Linux Integrity Status Update