20 years of NSA Security Enhanced Linux, a Retrospective
summary
Maintains SELinux in Debian for 20 years, describes how initial prototype takes three months to work locally and a year to be usable by others, drives kernel changes into LSM so AppArmor and Smack exist, shifts policy distribution to policy modules instead of compile‑time blobs, proves SELinux on constrained devices (iPAQ era) and Android, runs public “play” machines that reveal missing labels (shadow file, BIOS devices) and prompts concrete fixes that reduce attack surface.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 2:07Project Promotion
- 2:37Stockholm
- 3:15Hard Work
- 4:32Documentation
- 5:51Documentation doesnt require coding skills
- 6:47No one will be skilled enough to do it without doing it before
- 7:45If youre going to work on a major project
- 8:52Issues with SELinux
- 10:55History of SELinux
- 12:23Development Process
- 16:09File Labelling
- 16:38Policy Development
- 17:05Training Policies
- 18:10Easylinks
- 19:20De daemons
- 20:37Antivirus
- 22:16Unix Domain Socket
- 24:05Debian Kernel Patch Packages
- 26:28Excluding Play Machines
- 28:05Software Design
- 31:25Competition Drives Interest
- 32:53X Logo Program
- 33:47Conspiracy Theories
- 35:00Overall Experience
- 36:27Containers
- 38:38Binary Policy
- 39:59Distro Policies
related talks
09mSub-system Update: State of SELinux
19mSELinux Update
59mKeynote: Retrospective: 26 Years of Flexible MAC
31mOverview and Recent Developments: SELinux
51m10 Years of Linux Security - A Report Card
30mSecurity-Enhanced Android
28mOverview of the Linux Kernel Security Subsystem
11mSubsystem Update: State of SELinux, 2019