Linux Security Summit 2016
2016-08-25..2016-08-26
Toronto, Canada
who it's for
kernel developers, container engineers, security engineers, distribution maintainers, system administrators, Android platform engineers, hypervisor developers
topics
Coccinelle semantic patches; kernel self protection; measured boot with TPM2; per-namespace kernel audit; AMD SME and SEV memory encryption; securing unprivileged container images; Minijail sandboxing helper; seccomp and AppArmor for containers; LXD live migration and cgroups; SELinux overlayfs layer labeling; TPM 2.0 virtual device support; integrity measurement across kexec
| title | author | length |
|---|---|---|
| Keynote: Inside the Mind of a Coccinelle Programmer | Julia Lawall | 56m |
Coccinelle is a user‑scriptable tool that searches 13M lines of kernel C for precise patterns and emits patch‑style fixes; it matches and rewrites code using… | ||
| The State of Kernel Self Protection Project | Kees Cook | 46m |
Project quantifies risk and ships mitigations: analysis of 557 CVEs shows about a 5 year average lifetime for many kernel bugs, so defenses must assume bugs… | ||
| Towards Measured Boot Out of the Box | Matthew Garrett | 39m |
CoreOS adds practical measured boot: UEFI + TPM2 support in the bootloader, PCR-based measurement with log replay verification, and a working demo that seals a… | ||
| Current State of Kernel Audit and Linux Namespaces, Looking Ahead to Containers | Richard Guy Briggs | 46m |
Kernel audit currently requires a single daemon living in the initial user and PID namespaces and uses capabilities CAP_AUDIT_CONTROL and CAP_AUDIT_WRITE to… | ||
| AMD x86 Memory Encryption Technologies | David Kaplan | 44m |
AMD adds on-chip AES to encrypt DRAM and manages keys in the isolated AMD Secure Processor so memory encryption happens transparently with low runtime impact… | ||
| Securing Filesystem Images for Unprivileged Containers | James Bottomley | 42m |
Claims that unprivileged containers can run bare‑metal in production using only user namespaces and shows prototypes for fixing UID/GID mismatch when sharing… | ||
| Minijail: Running Untrusted Programs Safely | Jorge Lucangeli Obes | 38m |
Minijail is a Google-built sandboxing helper that composes namespaces, capabilities, seccomp and pivot_root into one tested binary and API, and it already runs… | ||
| On the Way to Safe Containers | Stephane Graber | 38m |
LXD builds system containers that combine user namespace isolation with apparmor, seccomp, dropped capabilities, filesystem quotas and cgroups to aim for… | ||
| Smack in 2016 | Casey Schaufler | 10m |
Smack reports concrete adoption numbers: 36% Smart TV market, 16% smartwatch market, and is the fourth largest smartphone OS security LSM, positioning it as… | ||
| Integrity | Mimi Zohar | 26m |
Linux integrity work standardizes file appraisal by adding unified pre/post hooks across kernel, firmware and module paths (touches six to seven subsystems)… | ||
| TPM | Jarkko Sakkinen | 23m |
TPM 2.0 support is landing in the kernel with concrete work: moved from misc to a dedicated device, a growing patch set (big spike for TPM 2.0 in 4.0) and… | ||
| SELinux | Paul Moore | 15m |
SELinux now supports rkt and runC (joining Docker support, with Docker leveraging runC), adds overlayfs layer labeling that brings per-layer enforcement… | ||
| AppArmor | John Johansen | 17m |
AppArmor moves from bzr to git, speeds parallel compiles, and releases 2.10 with 2.11 betas while most work focuses on upstreaming a large patch set. Policy… | ||
| Seecomp | Kees Cook | 19m |
Covers seccomp work landing between Linux 4.3 and 4.8: adds architecture support for powerpc tile usermode linux parisc, expands the regression test suite… | ||
| Design and Implementation of a Security Architecture for Critical Infrastructure | David Safford | 40m |
GE claims responsibility for over 50% of global power generation and prototypes a cross-architecture security stack running on x86, PPC and ARM that uses… | ||
| Android: Protecting the Kernel | Jeffrey Vander Stoep | 42m |
Dataset covers 2014–2015 through April and shows most Android kernel vulnerabilities live in vendor device drivers and are overwhelmingly missing bounds… | ||
| Opportunistic Encryption Using IPsec | Paul Wouters | 54m |
Libreswan uses the kernel XFRM kernel hooks to get netflow events, dynamically run IKEv2 to create XFRM states and encrypt host-to-host traffic, and it can… | ||
| (Ab)using Linux as a Trusted Bootloader | Eric Richter | 21m |
Petitboot boots the next kernel via kexec while reusing Linux drivers; a set of kernel changes adds an kexec_file_load hook so the kernel and initramfs get… | ||
| Integrity Protection and Access Control - Who Do You Trust? | Glenn Wurster | 39m |
Describes a small LSM called Path Trust that ties elevated capabilities and SEAndroid types to partition integrity by checking DM‑Verity at mount time… | ||
| nothing matches | ||