Linux Security Summit Europe 2022
2022-09-15..2022-09-16
-- online --
[Linux Security Summit Europe 2018, Linux Security Summit Europe 2019, Linux Security Summit Europe 2022, Linux Security Summit Europe 2023, Linux Security Summit Europe 2024, Linux Security Summit Europe 2025]
as the organisers put it
A technical forum for collaboration between Linux developers, researchers, and end users to foster community efforts in solving Linux security challenges.
who it's for
linux kernel developers, security researchers, trusted execution developers, embedded systems engineers, cloud infrastructure engineers, distribution maintainers, systems engineers
topics
io_uring credential delegation issues; flexible array transformations; array-bounds checking with compilers; on-the-fly eBPF memory protection; SPDM device attestation flows; AMD SEV-SNP guest attestation; dynamic hardware partitioning management; KASAN and dynamic bug finding; Smack reference policy for desktop; VFS idmapped mounts for user namespaces; Intel SGX mainline support; introducing IO devices into TEEs
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | Elena Reshetova | 03m |
First European Linux Security Summit since the pandemic returns with a much larger room than usual and a deliberately hybrid format: half onsite half virtual… | ||
| io_uring: So Fast. It's Scary. | Paul Moore | 50m |
io_uring originally bypasses Linux audit and all LSM access checks by letting processes store and transfer credentials as “personalities” and add a command… | ||
| Flexible Array Transformations and Array-bounds Checking | Gustavo A. R. Silva | 46m |
Kernel code is being converted from one-element and zero-length trailing arrays into C99 flexible-array members so compilers and fortified memcpy can actually… | ||
| HotBPF - An On-demand and On-the-fly Memory Protection for the Linux Ker... | Yueqi Chen, Zhenpeng Li | 27m |
HotBPF identifies vulnerable slab objects from sanitizer and kernel crash reports, maps source allocation sites to binary addresses with debug info, and… | ||
| Device Attestation in Hardware TEE based Confidential Computing | Jiewen Yao, Jun Nakajima | 30m |
Describes a concrete device-attestation flow for hardware TEEs that uses SPDM management sessions and the TDISP/TDI interface to fetch x.509 chains, firmware… | ||
| AMD SEV-SNP Attestation: Establishing Trust in Guests | Jeremy Powell | 47m |
SEV‑SNP produces a signed attestation report that lets a guest owner release secrets only after verifying concrete measurements: a committed TCB plus… | ||
| Secure and Dynamic Hardware Partitioning Management on Heterogeneous SoC | Zahra Tarkhani | 29m |
Hardware-assisted dynamic partitioning framework that modifies Linux, trusted firmware and TEE kernels to reconfigure peripheral and memory assignments at… | ||
| Welcome Back & Remarks | Elena Reshetova | 02m |
Welcome notes thank submitters, sponsors, program committee and organizers for a full-day hybrid conference, note travel remains difficult, and recordings and… | ||
| Sanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools | Andrey Konovalov | 59m |
Generic KASAN uses compiler instrumentation plus a kernel runtime with shadow memory (x86 maps 16 TiB) and per-allocator red zones to catch out‑of‑bounds and… | ||
| Finally, a Smack Reference Policy | Casey Schaufler | 45m |
A Smack reference policy targets an Ubuntu desktop using systemd support and Smack’s bring up mode to log permitted-but-unexpected accesses, implements a three… | ||
| What's New in the User Namespace | Stephane Graber, Christian Brauner | 42m |
User namespaces exist for ~9 years but remain uncommon; the kernel now offers VFS idmapped mounts (landed in recent kernels for ext4, xfs, vfat, btrfs, f2fs… | ||
| State of Intel SGX in Linux | Jarkko Sakkinen, Roman Volosatovs | 46m |
Linux has mainline SGX support since late 2020 with the kernel interface (create/extend/finalize enclaves, EENTER/ERESUME, EREPORT) and userland attestation… | ||
| Introducing IO Devices into Trusted Execution Environments | Jun Nakajima | 41m |
Adds a concrete path to let a TDX guest directly use PCIe devices by building a per-device trust chain: SPDM attestation between device and host TSM/DSM, TDX… | ||
| Improving Unmodified Classic Application Confinement | John Johansen, Georgia Garcia | 50m |
Canonical uses AppArmor plus snap sandboxing and DBus endpoint labeling to tighten confinement for unmodified apps, and pulls an upstream AppArmor patch into… | ||
| nothing matches | ||