Linux Security Summit Europe 2018
2018-10-25..2018-10-26
Edinburgh, United Kingdom
[Linux Security Summit Europe 2018, Linux Security Summit Europe 2019, Linux Security Summit Europe 2022, Linux Security Summit Europe 2023, Linux Security Summit Europe 2024, Linux Security Summit Europe 2025]
who it's for
kernel security engineers, kernel developers, platform engineers, container security engineers, virtualization engineers, distribution security engineers, embedded security engineers
topics
kernel keyrings subsystem; AMD SEV and SEV-ES; TPM 2.0 ecosystem; TPM encrypted channel mitigations; kernel self-protection project defenses; refcount_t adoption and hardening; namespaces and capabilities updates; LSM stacking and AppArmor/Smack/SELinux; IMA and EVM file integrity; seccomp via BPF syscall filtering; protected execution facility memory protections; remote attestation protocol
| title | author | length |
|---|---|---|
| Overview and Recent Developments of Keyrings Subsystem | David Howells | 35m |
Kernel keyrings provide per-thread, per-process, session, user and persistent stores for tokens and keys, with add_key, request_key, keyctl and /proc/keys as… | ||
| AMD Encrypted Virtualization Update | David Kaplan | 33m |
Update on AMD SEV progress: Linux kernel support is upstream (SME in 4.14, SEV guest bits in 4.15, KVM hooks in 4.16), QEMU/KVM + OVMF tooling runs SEV VMs and… | ||
| Overview and Recent Developments: TPM | Jarkko Sakkinen | 25m |
Short overview of the TPM subsystem and claim that TPM 2.0 adoption is replacing TPM 1.x. Kernel work over the past 12 months adds validation against buffer… | ||
| TPM Software Stack - Enabling the TPM2.0 Ecosystem in Linux | Peter Hüwe, Joshua Lock | 36m |
TPM2.0 userspace becomes a usable Linux ecosystem: kernel drivers land in v4.0 and embedded support in v4.9, a resource manager moves partly into the kernel… | ||
| Linux Kernel Security Contributions by ANSSI | Yves-Alexis Perez | 30m |
ANSSI reports active kernel work: a decade-old internal distribution (CLIP) runs hardened defaults like no writable+executable pages and multi-level isolation… | ||
| Overview and Recent Developments: Kernel Self-Protection Project | Kees Cook | 33m |
Shows that KSP lands concrete defenses across kernels 4.14–4.18: vmapped stacks, SLUB freelist obfuscation, structure randomization, set_fs() checking, fast… | ||
| Does Making the Kernel Harder Make Making the Kernel Harder? | Casey Schaufler | 35m |
Argument that kernel hardening measurably raises exploitation cost by changing real code: adoption of refcount_t prevents classic refcount bugs and touches… | ||
| Overview and Recent Developments: Namespaces and Capabilities | Christian Brauner | 35m |
Covers concrete kernel work from roughly 4.10–4.18: libcap adds libcap ambient capability support and namespace filesystem-capability handling; UID/GID map… | ||
| Overview of the Linux Kernel Security Subsystem | James Morris | 28m |
Overview lists concrete kernel features and their effects: LSM hooks provide the pluggable access points used by SELinux, AppArmor and Smack; seccomp via BPF… | ||
| Kernel Hardening: Protecting the Protection Mechanisms | Igor Stoppa | 38m |
Implements page-granular memory protections for kernel data: read-only dynamically allocated memory, write-rare statically allocated memory, and a… | ||
| Overview and Recent Developments: Linux Integrity | Mimi Zohar | 36m |
Linux integrity is two parts: ima/EVM subsystem plus supporting pieces (trusted and encrypted keys, TPM, rpm/packaging hooks). Files are measured into an IMA… | ||
| Tying EVM into LSM Policy | Matthew Garrett | 34m |
EVM gets tied into LSMs by using AppArmor profile attachments based on extended attributes so files with a protected security.EVM xattr run in a trusted… | ||
| A Simple Protocol for Remote Attestation of System Integrity | Roberto Sassu | 29m |
Proposes implicit remote attestation by using TLS endpoints plus a TPM-sealed key certified via the TCG X.509 extension Subject Key Attestation Evidence (SKAE)… | ||
| Using Linux as a Secure Boot Loader for OpenPOWER Servers | Nayna Jain, Thiago Jung Bauermann | 35m |
Linux IMA is extended to act as a secure boot loader for OpenPOWER by adding three concrete features: appended PKCS7 signatures on kernel images so network/USB… | ||
| Overview and Recent Developments: AppArmor | John Johansen | 29m |
Project moves to GitLab, picks up CII badge and new logo; upstreaming finishes most patches except AF_UNIX. AppArmor remains a path-based, modified DTE with… | ||
| Overview and Recent Developments: Smack | Casey Schaufler | 22m |
Smack is a focused mandatory‑access module that uses simple text labels are 24‑character text strings on subjects and objects and one deterministic rule to… | ||
| Overview and Recent Developments: SELinux | Paul Moore | 31m |
SELinux presents a flexible mandatory access control model with a separate policy language and kernel enforcement, used by Fedora (targeted/strict/base) and… | ||
| Security Module Stacks That Don't Fall Over | Casey Schaufler | 33m |
Work is adding kernel support for multiple concurrent LSMs by having the infrastructure manage the blobs and hand each module an offset so SELinux and Smack no… | ||
| Protected Execution Facility | Guerney D. H. Hunt | 41m |
An architecture modification to Power called Protected Execution Facility creates a new firmware layer Protected Execution Ultravisor and a secure memory… | ||
| Overview and Recent Developments: seccomp and Small Linux Security Modules | Kees Cook | 23m |
Crash-course on three kernel features and what actually changed: LoadPin with dm-verity pins kernel reads to a cryptographically verified backing filesystem so… | ||
| Implement Android Tamper-Resistant Secure Storage and Secure it in Virtualization | bing-zhu | 37m |
Implements a full software stack for tamper‑resistant Android storage using RPMB: RPMB key generation, hardware root binding, factory provisioning, and… | ||
| nothing matches | ||