Overview and Recent Developments: Smack
summary
Smack is a focused mandatory‑access module that uses simple text labels are 24‑character text strings on subjects and objects and one deterministic rule to decide access so policies never need compiling. It adds special labels — floor, star, hat — for system data, world access and backup reads. Network packets carry labels and unlabeled traffic uses an ambient label, and recent fixes close memory leaks, IPv4/IPv6 and UDP/DCCP edge cases. Upcoming work: netlabel cleanup, namespaces, InfiniBand, libvirt/eBPF integration and a pending test suite and distro ruleset.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:11WHAT IS SMACK?
- 3:14LABEL BASICS
- 5:10ACCESS BASED ON LABEL RELATIONSHIPS
- 7:44SPECIAL LABELS
- 9:12NETWORK LABELS
- 11:10WHO'S USING SMACK?
- 12:06WHAT'S NEW IN SMACK?
- 12:51WHAT'S FIXED IN SMACK?
- 14:01NETWORKING PROJECTS
- 17:06RULE SET FOR DISTRIBUTIONS
related talks
06mSubsystem Update: The 2019 Smack Update
45mFinally, a Smack Reference Policy
08mSub-system Update: Smack Update 2018
10mSmack in 2016
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
30mLSM Stacking - What You Can Do Now and What's Next
01h 35mTutorial: How to Write a Linux Security Module