Sub-system Update: Linux Integrity Status Update

on YouTube ↗16m

" summary

EVM now uses the file hash as a portable identifier so EVM portable signature binds metadata to file data and supports larger digests for stronger algorithms; a new build-time policy guarantees certain checks (for example qemu exec verification) survive later custom policies; unprivileged FUSE mounts are treated as untrusted while privileged mounts force remeasurement options; TPM access latency drops with an observed 83% TPM speedup from hrtimer and other work; IMA/EVM regression tests and audit-based IMA namespacing are landing, and more sample policies and reviewers are requested.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 0:15The Linux Integrity Subsystem
3. 4:00Bill Time Policy
4. 7:18Fuse File System

" related talks

• 36mOverview and Recent Developments: Linux IntegrityMimi Zohar · Linux Security Summit Europe 2018
• 19mSubsystem Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2019
• 34mTying EVM into LSM PolicyMatthew Garrett · Linux Security Summit Europe 2018
• 52mSurviving in the Wilderness: Integrity Protection and System UpdatePatrick Ohly · Embedded Linux Conference + OpenIoT Summit North America 2017
• 01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...KP Singh, Roberto Sassu, Paul Moore, John Johansen · Linux Security Summit Europe 2023
• 26mIntegrityMimi Zohar · Linux Security Summit 2016
• 07mSubsystem Update: AppArmor Update 2019John Johansen · Linux Security Summit North America 2019
• 35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verityMimi Zohar · Linux Security Summit North America 2022