Subsystem Update: Seccomp, Yama, and LoadPin
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 16:30· Sapphire D, Hilton San Diego Bayfront·
summary
Update surveys three small kernel defenses and their concrete changes: LoadPin pins modules and any kernel-read files to the first block device, extended to kexec images and firmware and reported as stable; Yama restricts ptrace to process ancestors or explicit whitelist, raising the time needed for credential-stealing attacks; seccomp adds a user-notification FD that pauses syscalls and lets a userspace handler return specific errno or decision (demo intercepts mount and injects error codes), with a caution about allowing silent syscall continuation.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:17Agenda
- 1:04LoadPin
- 2:13Yama
- 3:15Task Death
- 4:10What is Seccomp
- 5:08Second Return User Notification
- 6:15Demo
related talks
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
19mSeecomp
28mOverview of the Linux Kernel Security Subsystem
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
26mReinventing Seccomp for Fun and Profiles
01h 29mUsing Seccomp to Limit the Kernel Attack Surface
11mSub-system Update: Kernel Self-Protection Project
45mContainer Kernel Development