Enabling Hardware-Assisted Shields for Linux Security Subsystems
summary
A kernel abstraction called Hardware Shields provides memory isolation, code/data signing and read‑only metadata storage with two backends: Morello CHERI using capability instructions and hickey/KVM hypervisor using protected address regions and new hypercalls. A prototype wraps these as shield_protect_address, makes signatures immutable, and ships a SELinux Shield mode that prevents toggling enforcement; initial runs target Android Morello and estimate ~10% overhead. User API and compartment management remain future work and will be opened in Rust.
AI-written summary · about
chapters (11)
- 0:00Hardware-Assisted Shields project
- 1:03Project scope and background
- 3:10Hardware features for privilege separation
- 5:41Hypervisor security advancements
- 8:17Virtualization and hardware protections
- 10:30Hardware Shields abstraction design
- 14:23Memory protection as primitive
- 16:32Code and data signing mechanisms
- 19:02Isolated execution units and future work
- 21:34Prototyping challenges and next steps
- 23:19Q&A
related talks
38mKernel Hardening: Protecting the Protection Mechanisms
18mLITESHIELD: Secure Containers via Lightweight, Composable Userspace μKernel...
24mShielding Software From Privileged Side-Channel Attacks
23mHardware security for critical national infrastructure
17mHardening Linux and FreeBSD on RISC-V with CHERI
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
42mOpportunities and Challenges on Merging HW Security Features into Linux Mainline Kernel
30mKernel Hardening With Protection Keys