Overview and Recent Developments: Linux Integrity

on YouTube ↗36m

" summary

Linux integrity is two parts: ima/EVM subsystem plus supporting pieces (trusted and encrypted keys, TPM, rpm/packaging hooks). Files are measured into an IMA measurement list, appraised against signatures or hashes in extended attributes, and metadata is HMACed or signed by EVM. Recent work adds portable immutable EVM signatures, RPM support to ship signatures, staged container support (IMA audit first, measurement needs securityfs virtualization, appraisal needs keyring namespacing), a userland IBM attestation stack, and noticeable TPM performance improvements enabling many more measurements with the trusted keyring model.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 1:56Goals
3. 4:03Example Policy
4. 17:48Methods for loading IMA Loca-CA
5. 34:02How can you help?

" related talks

• 26mIntegrityMimi Zohar · Linux Security Summit 2016
• 16mSub-system Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2018
• 19mSubsystem Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2019
• 47mNamespacing the Linux Integrity Measurement ArchitectureChristian Brauner, Stefan Berger · Linux Security Summit North America 2022
• 43mIntegrity Policy Enforcement: Full System Integrity VerificationDeven Bowers · Linux Security Summit North America 2020
• 35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verityMimi Zohar · Linux Security Summit North America 2022
• 01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...KP Singh, Roberto Sassu, Paul Moore, John Johansen · Linux Security Summit Europe 2023
• 35mIntegrity Measurements and the Cruel WorldJanne Karhunen · Linux Security Summit North America 2019