Linux Security Summit North America 2023
2023-05-10..2023-05-12
-- online --
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
who it's for
kernel developers, linux security engineers, systemd maintainers, container runtime developers, cloud platform engineers, hypervisor developers, lsm maintainers, security researchers
topics
OCI machine image signing and verification; systemd TPM integration for LUKS unlocks; new LSM syscalls and APIs; kernel supply chain signing and transparency; eBPF-based runtime mitigations (HotBPF++); MPK/PKS kernel compartmentalization; hypervisor-enforced kernel integrity with Heki; confidential containers on Arm CCA; AppArmor profile generation at scale; automated syscall description generation (SyzDescribe); bounds checking in C and the Linux kernel; SecurityPerf benchmarking framework
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | James Morris | 04m |
Conference organizers report far more proposals than fits the schedule and accepted talks average score ≥4/5 on committee reviews so content skews technical… | ||
| Verifiable End To End Secure OCI Native Machines | Serge Hallyn, Joy Latten | 46m |
End to end toolchain that signs and ships entire machine images as OCI artifacts and verifies them at boot using UEFI secure boot plus TPM sealed policies… | ||
| systemd and TPM2 | Lennart Poettering | 47m |
systemd now unlocks LUKS volumes by embedding TPM2 metadata in the LUKS superblock and supports PCR 11 for boot-phase/kernel measurements, PCR 15 for machine… | ||
| System Calls for the Linux Security Module Infrastructure | Casey Schaufler | 45m |
Linux introduces three new syscalls to replace messy /proc and securityfs interfaces: lsm_list_modules, lsm_self_get_attr and lsm_self_set_attr. They use a… | ||
| How to Backdoor the Linux Kernel (and fail?) | Konstantin Ryabitsev | 32m |
Survey of realistic attack paths into the kernel release pipeline concludes that patch submission, merge and publish points are all attackable but are usually… | ||
| HotBPF++: A More Powerful Memory Protection for the Linux Kernel | Zicheng Wang, Yueqi Chen | 43m |
HotBPF++ automatically generates and installs eBPF programs from syzkaller/kernel sanitizer reports to stop vulnerabilities from being triggered rather than… | ||
| Controlling Script Execution | Mickaël Salaün | 46m |
Proposal adds a kernel-managed execution check so interpreters can ask the kernel “is this file allowed to be executed” using a new faccessat mode XAV_OK that… | ||
| Welcome Back & Daily Announcements Day 02 | James Morris | 02m |
Day two opens with logistics and attendance notes saying roughly almost 100 people are registered and some planned in person talks become pre-recorded remote… | ||
| Welcome Back & Daily Announcements Day 03 | James Morris | 01m |
Brief announcements state no shuttle service this afternoon and no official travel buses available, with informal meetups and lunch conversations encouraged… | ||
| MPK/PKS Linux Kernel Compartmentalization | Sebastian Österlund | 50m |
Prototype uses Intel PKS to flip protection via two MSR writes on entry/exit, turning most kernel pages inaccessible and leaving a minimal eBPF isolation set… | ||
| Enforcing Runtime Integrity with Maat | Jonathan Myers, Andrew Guinn | 34m |
Maat is an open source framework that performs continuous integrity measurement and appraisal across hypervisor, kernel, and user space, using TPM-based… | ||
| Heki: Hypervisor-Enforced Kernel Integrity for Linux with KVM | Mickaël Salaün | 39m |
Heki moves selected kernel self‑protections out of the kernel into a KVM hypervisor layer, providing a guest API and a KVM backend that uses EPT/MBAC… | ||
| When Confidential Containers Meet Arm CCA | Jia He | 32m |
CoCo is implemented end-to-end on Arm CCA with a proof‑of‑concept runtime and modified containerd that boots realm guests via cloud‑hypervisor/KVM, performs… | ||
| Building the Largest Working Set of Apparmor Profiles | Alexandre Pujol | 33m |
Claim: a public repo now holds 1400+ profiles covering most distro packages so common system processes run confined. Tooling uses integration testing with Go… | ||
| SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers | Yu Hao | 39m |
A static analysis tool called SyzDescribe automatically generates Syzkaller‑compatible syscall descriptions for Linux kernel device drivers by modeling driver… | ||
| Dynamic Key Managed PowerPC Guest Secure Boot | Sudhakar Kuppusamy, George Wilson | 45m |
Power secure boot for Power LPARs moves from static keys to a dynamic scheme that stores authenticated variables in a new Platform KeyStore (plpks) and submits… | ||
| Progress On Bounds Checking in C and the Linux Kernel | Kees Cook, Gustavo A. R. Silva | 46m |
Effort converts trailing zero/one-length arrays into real C99 flexible array members, adds -fstrict-flex-arrays and per-struct size annotations, and wires… | ||
| SecurityPerf: A New Open-Source Framework for Benchmarking the Performance Impact of Linux Security Solutions | Austin Gadient | 36m |
SecurityPerf is an open source Python + Docker framework that builds containerized benchmarks for Apache, MySQL, WordPress, MongoDB and RabbitMQ, runs a… | ||
| Coupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm) | Pankaj Gupta, Varun Sethi | 27m |
Proposes linking kernel keyring attributes into Linux Crypto-API TFMs so drivers can enforce usage, algorithm and lifetime restrictions at crypto time… | ||
| LSM Maintainers Panel | John Johansen, Mickaël Salaün, Casey Schaufler, Mimi Zohar, Paul Moore | 52m |
Panel argues that LSM stacking is the single most important change and shows progress toward composition but no final namespacing solution; eBPF-as-LSM is… | ||
| nothing matches | ||