Keynote: Retrospective: 26 Years of Flexible MAC
Talkat Linux Security Summit North America 2019 · on Tuesday, 2019-08-20· at 09:00· Sapphire D, Hilton San Diego Bayfront·
summary
Work documents 26 years of building a flexible MAC architecture, producing Flask and a SELinux reference implementation (released 2000, merged 2003) and adapting it to Android (reference 2012, per‑app contexts by Android 9). Claims SELinux code from this work runs in many Linux and iOS/macOS/FreeBSD builds and that SELinux is fully enforcing on ~90% of 2 billion Android devices. Shows prototypes and deployments: Flask security server + access‑vector cache, Xen security modules and NetTop/SVP virtualization experiments.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:58MAC: Background & Motivation
- 4:51MAC: Desired Properties
- 6:54Traditional MAC • Feed security policy models derived from government clearance/classification system
- 8:07Traditional MAC: Gaps • Required trusted subjects that could override the security model • Ladied a mechanism to effectively contine and protect the trusted
- 9:38Type Enforcement (TE)
- 11:07TE vs Traditional MAC
- 15:39Flexible MAC Architecture
- 17:09DTOS Approach to MAC: Benefits • Assurable implementation
- 20:13Flask & Dynamic Security Policies
- 21:44Going Mainstream: SE Linux
- 23:49SELinux Flask in a Monolithic Kernel
- 26:25SELinux Flask in Linux Userspace
- 28:39Branching Out: SE BSD and SE Darwin
- 32:46Android: MAC applied
- 36:23MAC meets Virtualization
- 38:24Hypervisors: Microkernels Revisited
- 41:24SVP: MAC in a system architecture
- 45:14MAC Futures • Advancing usability without sacrificing security . Composing MAC models Distributed MAC enforcement and management
related talks
46m20 years of NSA Security Enhanced Linux, a Retrospective
09mSub-system Update: State of SELinux
44mKeynote: 25 Years in AppSec: Looking Back, Looking Forward
31mOverview and Recent Developments: SELinux
30mSecurity-Enhanced Android
51mKeynote |The Microarchitectures That I Saw And The Ones That I Hope To One Day See
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
15mSELinux