SELinux

on YouTube ↗15m

" summary

SELinux now supports rkt and runC (joining Docker support, with Docker leveraging runC), adds overlayfs layer labeling that brings per-layer enforcement (queued for 4.9), and introduces separate capability checks for initial vs non‑initial user namespaces so Chrome can run confined. Type‑bounding behavior is fixed for no userns, distributed filesystems get file label revalidation (GFS in since 4.5) and FUSE can validate trans constraints, labeled IPv6 networking (Calipso) is upstream for 4.8, userspace 2.5 adds fine‑grained ioctl controls, kernel module load and per‑thread exec‑stack checks land, and Android now ships SELinux widely (≈80% KitKat+, ~50% Lollipop, ~1B+ devices).

AI-written summary · about

" chapters (7)

1. 0:00Intro
2. 0:13Containers
3. 3:15File Systems
4. 5:04Networking
5. 8:17Android
6. 10:51Other
7. 11:55Questions

" related talks

• 31mOverview and Recent Developments: SELinuxPaul Moore · Linux Security Summit Europe 2018
• 09mSub-system Update: State of SELinuxPaul Moore · Linux Security Summit North America 2018
• 19mSELinux UpdatePaul Moore · Linux Security Summit Europe 2025
• 11mSubsystem Update: State of SELinux, 2019Paul Moore · Linux Security Summit North America 2019
• 45mSELinux All the Way Down: Namespaces for SELinuxStephen Smalley · Linux Security Summit North America 2025
• 30mSecurity-Enhanced AndroidM A al-Kabir · DevFestMN 2016
• 44mUsing SELinux with container runtimesDaniel Walsh, Lukas Vrabec · DevConf.CZ 2019
• 28mOverview of the Linux Kernel Security SubsystemJames Morris · Linux Security Summit Europe 2018