Integrity
summary
Linux integrity work standardizes file appraisal by adding unified pre/post hooks across kernel, firmware and module paths (touches six to seven subsystems), enables signature verification of IMA policies and initramfs, and implements the ability to carry measurement list across kexec (serialization, endian canonization included). Keyrings become a built-in keyring with restrict_link to extend a Secure Boot trust chain into userspace; distro signing mirrors (RPM/tar support) and reserved memory for runtime built-in keys exist. TPM 2.0 support plans use pad/truncate hashes for TPM banks to map SHA‑1 and SHA‑256.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:51Closing the Measurement Appraisal Gaps
- 1:42Closing Measurement Gaps
- 15:31Transition to User Space
- 18:27Tar Support
related talks
36mOverview and Recent Developments: Linux Integrity
19mSubsystem Update: Linux Integrity Status Update
43mIntegrity Policy Enforcement: Full System Integrity Verification
42mTPMs and the Linux Kernel: unlocking a better path to hardware security
16mSub-system Update: Linux Integrity Status Update
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
32mEstablishing Trust in Linux Keyrings - Is Trust Built-in, Imputed, or Transitive?
51mApplications of TPM 2.0