Security Module Stacks That Don't Fall Over
summary
Work is adding kernel support for multiple concurrent LSMs by having the infrastructure manage the blobs and hand each module an offset so SELinux and Smack no longer overwrite inode pointers; that blob allocator is likely to land in a release or two. Remaining hard limits include a 32-bit secid used in secmark which requires that the kernel replace secid with structure to carry multiple labels, netlabel disagreements that must deny unless modules agree, mount option handling, and procfs per-LSM entries.
AI-written summary · about
chapters (10)
- 0:00Intro
- 3:00Blob pointers
- 5:17SEC IDs
- 10:18Format Options
- 11:50Netlabel
- 17:03Stacking
- 19:35Tips for Stacking
- 23:14How to Bug
- 24:44Friendly Heperm
- 28:34Stacks
related talks
30mSecurity Module Stacks that Don't Fall Over
30mLSM Stacking - What You Can Do Now and What's Next
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
41mThe State and Direction of LSM Stacking
23mStacked LSMs and User Space
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
01h 35mTutorial: How to Write a Linux Security Module
52mLSM Maintainers Panel