Subsystem Update: LSM Stacking - What You Can Do Now and What's Next
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 16:50· Sapphire D, Hilton San Diego Bayfront·
summary
Linux 5.1 ships infrastructure-managed blobs so a limited set of extended security labels can be shared across LSMs, letting Tomayo and others run alongside SELinux/AppArmor/Smack. Patches in development (targeting 5.4) add conversion of the key, sock, inode and superblock blobs and new proc interfaces that export per-LSM labels in an LSMname\0value format and a proc_self_context mechanism for legacy compatibility. Audit records gain per-LSM blob fields so tools can tell which module denied access.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:37Infrastructure Managed Blobs
- 2:06Whats Next
- 3:27What We Need to Do
- 4:35Security Context
- 7:00Legacy Applications
- 8:42Audit Records
- 10:21NFS Issues
- 11:26Netlabel
- 13:19Demo
related talks
30mLSM Stacking - What You Can Do Now and What's Next
41mThe State and Direction of LSM Stacking
33mSecurity Module Stacks That Don't Fall Over
23mStacked LSMs and User Space
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
30mSecurity Module Stacks that Don't Fall Over
27mBPF LSM - Updates and What next?
52mLSM Maintainers Panel