Are you Sure your System Applications are Secure? Reduce Exploit...
summary
An Apertis-based IoT image hardens three real services—Mosquitto, connman, bluez—by switching them from root to dedicated users, adding AppArmor profiles, and applying AppArmor + systemd hardening knobs (NoNewPrivileges, MemoryDenyWriteExecute, ProtectSystem, private tmp, cgroups). Network features require CAP_NET_ADMIN and CAP_NET_RAW when moving off root. Disabling connman’s DNS/NTP and adjusting D‑Bus and temp directory ACLs proves necessary. Result: reduced attack surface and harder privilege escalation, but integration testing, upstream coordination and ongoing maintenance take significant effort.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:38SYSTEM SECURITY ASPECTS
- 0:52Secure System Architecture
- 2:55Security-by-Design SW Components
- 4:50Secure Software? Not in general!
- 8:37APPLICATION HARDENING: LINUX SECURITY FEATURES
- 8:51Application Hardening Linux Security Features
- 15:55APPLICATION HARDENING: HANDS-ON
- 17:02Hands-On: Security Features
- 25:28Application Hardening Hands-On: Connman
- 29:21Hands-On: Bluetooth tethering - Connman & BlueZ
- 30:54APPLICATION HARDENING: CONCLUSION
related talks
50mImproving Unmodified Classic Application Confinement
38mThe 'S' in IoT stands for Security
48mHardening IoMT Medical Devices: Defense‑in‑Depth on Yocto‑Based Embedded Linux
33mContainers Security Layers and How Not to Break them
45mUsing Linux Securely in the Cloud
35mNew security features in systemd
39mVulnerabilities in Old Third-Party Software Components- Importance of Having SBoM for IoT/OT Devices
21mIndustrial IoT security issues and countermeasures