Application Whitelisting
Talkat Linux Security Summit North America 2019 · on Tuesday, 2019-08-20· at 10:50· Sapphire D, Hilton San Diego Bayfront·
summary
An open‑source daemon uses the kernel’s file access notifications API to intercept execs, looks up paths in an RPM‑derived trust DB (LMDB cache with LRU), computes SHA‑256, and enforces a whitelist policy that denies runtime‑linker execution and untrusted binaries while allowing approved ELF and system Python files; demo shows about 1,200 accesses allowed vs 11 denied, a watchdog protects the monitor, in‑memory payloads via memfd_create/SnakeEater are detected, and upcoming PEP 578 adds Python audit hooks.
AI-written summary · about
chapters (25)
- 0:00SECURITY
- 1:14Whitelisting Basics
- 2:03Common Criteria Requirements
- 2:31Brief Comparison
- 3:14ATTACK to Kill Chain Mapping
- 3:50How programs execute
- 7:52Mobile Code example
- 12:22Attack points
- 13:03How to monitor file access?
- 13:54Fanotify Event
- 16:13Access Control Policy
- 17:24Subject statements
- 19:26Sample Policy
- 21:02Shipped policy design goals
- 21:44Fapolicyd Design
- 24:40Safety Measures
- 25:09Sources of Trust
- 27:57Top level SWID tag example
- 28:12Demo
- 36:33Statistics report
- 36:59Fapolicyd coverage
- 38:22Refinements
- 39:22Short term improvements
- 39:53Unifying the pieces
- 41:00IDS Ensemble Model
related talks
22mApplication Whitelisting in Linux environment
26mA Practical Approach to Control Unauthorized Execution of Interpreters
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
52mIntra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
37mUsing RHEL built in Security Technologies daily
26mContainers: Your Ally in Improving Security
28mAgent Runtime Security: Enforce, Attest, Decide
42mResolving Performance and Security Issues with eBPF