Script Integrity

on YouTube ↗23m

" summary

Linux 6.14 adds a concrete kernel capability to control script execution: a new execveat(2) AT_EXEC_CHECK flag plus prctl successors to O_MAYEXEC, and two new securebits: enforce / deny-interactive flags to incrementally apply policies. Enforcement uses file-descriptor checks to avoid TOCTOU, integrates with IMA/LSMs, and requires “enlightened” interpreters (Python, Bash, Ruby) to open-then-verify scripts; a small test wrapper in the kernel tree demonstrates the feature and the kernel-side implementation is merged.

AI-written summary · about

" chapters (12)

1. 0:00Script integrity introduction
2. 1:30Why scripts need integrity
3. 3:17Kernel and script execution
4. 7:19Enforcing execution policies
5. 10:17Handling libraries and trusted code
6. 13:51Script interpreter considerations
7. 14:34History of the solution
8. 16:24Configuring restrictions incrementally
9. 17:31Next steps and docs
10. 18:13Q&A on file descriptors
11. 19:40Q&A on interpreter pitfalls
12. 21:29Q&A on user space support

" related talks

• 46mControlling Script ExecutionMickaël Salaün · Linux Security Summit North America 2023
• 26mA Practical Approach to Control Unauthorized Execution of InterpretersJunghwan Kang · Open Source Summit + Embedded Linux Conference + OSPOCon 2021
• 43mIntegrity Policy Enforcement: Full System Integrity VerificationDeven Bowers · Linux Security Summit North America 2020
• 26mIntegrityMimi Zohar · Linux Security Summit 2016
• 30mLinux Kernel Security Contributions by ANSSIYves-Alexis Perez · Linux Security Summit Europe 2018
• 47mApplication WhitelistingSteven Grubb · Linux Security Summit North America 2019
• 19mSubsystem Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2019
• 36mSeccomp For Developers - Writing More Secure ApplicationsAlexander Reelsen · sec4dev 2021