Securing a Yocto-based Distribution: The Case of AllScenariosOS
summary
AllScenariosOS is a Yocto-based, source distribution that applies kernel hardening, image hardening, permission tightening and service removal and reports that the built images show CVE matches for roughly half of packages when using CV checking. An extension is published to map package product names to CVE records and meta-security and parts of meta-hardening are integrated into the distro so hardening ships by default. Work in progress includes secure boot and image verification, automated package update checks and machine‑readable CVE output.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:19Marta Rybczynska: about me
- 3:00Scary? Examples of issues from...
- 4:19What will we talk about?
- 5:13Yocto security basics - a subjective view (2/2)
- 8:52What can you have out of the box? (and easily)
- 14:08What a developer should know about CVES
- 17:39Cve-check in Yocto: HOWTO
- 19:27Cve-check console output (fragment)
- 21:52Research on cve-check
- 24:31Proposed cve-check extension (fragment)
- 26:14Security-related layers in Yocto
- 27:19Adding meta-security or sublayers
- 28:03Special case: meta-hardening
- 28:39Using meta-hardening
- 30:15Linux kernel hardening in AllScenariosos
- 33:30Next steps
- 35:41Lessons learnt
- 38:25If you want to learn more about security
related talks
34mYocto Project/OpenEmbedded Meets Security
44mSecuring a Yocto Built System
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
19mScanning for known vulnerabilities in an embedded distribution- 53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
42mNavigating the Sea of CVEs: Securing Your Linux Distributions