The State and Direction of LSM Stacking
Talkat Linux Security Summit North America 2025 · on Friday, 2025-06-27· at 09:05· Bluebird Ballroom (BBB) 3GH·
summary
LSM stacking is moving from ad hoc per-module state to infrastructure-managed data: security blobs hold per-object/process pointers, LSM properties replace single SECIDs, and LSM contexts carry string+ID. Auxiliary subject/object audit records and dynamic mount-option blobs are proposed and patches are in review; mount option and secmark/netlabel conflicts remain order-dependent so the first requester wins today. Some pieces are merged and working, others (netlabel multitag, calypso, full context syscalls replacing /proc) are drafted but not yet landed.
AI-written summary · about
chapters (9)
- 0:00LSM stacking challenge
- 2:50Preventing general LSM stacking
- 5:24Cleaning up LSM infrastructure
- 11:50Audit rules in multi-LSM systems
- 17:50Handling mount options
- 20:45Network security attributes and LSM conflicts
- 31:15User interface clashes
- 35:14LSM stacking progress and future work
- 37:21Q&A
related talks
30mLSM Stacking - What You Can Do Now and What's Next
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
30mSecurity Module Stacks that Don't Fall Over
33mSecurity Module Stacks That Don't Fall Over
23mStacked LSMs and User Space
52mLSM Maintainers Panel
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
01h 35mTutorial: How to Write a Linux Security Module