Linux Kernel Security Contributions by ANSSI
summary
ANSSI reports active kernel work: a decade-old internal distribution (CLIP) runs hardened defaults like no writable+executable pages and multi-level isolation, and CLIP OS v5 moves to public development with modular design. Contributions include a Landlock LSM prototype, a new open() flag dubbed o'may exec to enforce no-exec semantics for scripts (patches for Python, Perl, bash exist), and plans to upstream CLIP kernel patches in coming months. Landlock LSM and CLIP OS v5 aim to provide usable isolation primitives.
AI-written summary · about
chapters (4)
related talks
51m10 Years of Linux Security - A Report Card
46mThe State of Kernel Self Protection Project
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
01h 00mPanel Discussion: What is Lacking in Linux Security and What Are or Should We be Doing about This
45mLooking at Linux as a SEooC
30mProactive Software Defense against Side Channel Attacks
46m20 years of NSA Security Enhanced Linux, a Retrospective