Tying EVM into LSM Policy

on YouTube ↗34m

" summary

EVM gets tied into LSMs by using AppArmor profile attachments based on extended attributes so files with a protected security.EVM xattr run in a trusted profile while others run untrusted; IMA appraises signatures after credentials commit via the IMA creds_check hook so elevated rights require a valid signature. Supports HMAC and non–SHA1 hashes, handles 500 MB binaries (FUSE forces rehash on every open), Debian packaging integration remains work in progress, and runtime overhead is minimal.

AI-written summary · about

" chapters (11)

1. 0:00Intro
2. 0:40How do you secure a fleet of developer machines?
3. 5:31Integrity Measurement Architecture (IMA)
4. 6:56Taking IMA further - Extended Validation Module
5. 9:03EVM wasn't ideally suited for what we wanted
6. 11:28How do we tie these together?
7. 16:07What does it look like?
8. 17:00But what about interpreted languages?
9. 19:39We can add more complexity
10. 21:25But hashing is slow
11. 27:25Summary

" related talks

• 01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...KP Singh, Roberto Sassu, Paul Moore, John Johansen · Linux Security Summit Europe 2023
• 16mSub-system Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2018
• 43mIntegrity Policy Enforcement: Full System Integrity VerificationDeven Bowers · Linux Security Summit North America 2020
• 39mIntegrity Protection and Access Control - Who Do You Trust?Glenn Wurster · Linux Security Summit 2016
• 33mBinary Policy with IMA and AppArmorEric Chiang · Linux Security Summit North America 2019
• 32mUsing a Different LSM from the Host in a ContainerJohn Johansen · Linux Security Summit Europe 2019
• 19mSubsystem Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2019
• 30mLSM Stacking - What You Can Do Now and What's NextCasey Schaufler · Linux Security Summit Europe 2019