Binary Policy with IMA and AppArmor
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 15:10· Sapphire D, Hilton San Diego Bayfront·
summary
Google signs binaries from its central repos and enforces them with IMA/EVM signatures applied via a dpkg hook, uses AppArmor profiles that match security extended attributes, and employs keyring restrictions to update keys without forcing reboots. The pilot covers about a quarter million machines and lets unsigned locally built binaries run for developers but blocks credential access unless the whole process tree is signed. Results are functional but noisy: process‑tree appraisal causes many false positives, heavy logging and tooling were required, and full enforcement is not yet practical.
AI-written summary · about
chapters (38)
- 0:00Introduction
- 0:13Platform Security
- 0:39Devices at Google
- 1:27Execution Control
- 1:49Santa
- 2:21Upload
- 2:54Linux
- 4:12Experiment
- 4:41Auditing
- 5:16Protecting
- 7:00Appraisal
- 7:20IMA EVM
- 7:55Extended Attributes
- 8:14Signatures
- 8:32Derivation
- 9:11Demo
- 10:38Keyring Restrictions
- 10:56TLDR
- 11:27Keybinding Restrictions
- 12:10Using Information
- 12:53Triggering Appraisal
- 13:23Untrusted vs Trusted
- 13:45Trust Chapters
- 14:26Scripts
- 15:05Shebangs
- 15:55NoNewPrince
- 17:09SECMark
- 17:41IP Table
- 17:52Roulette
- 18:03Log Event
- 19:45Log Pipeline
- 20:48Process Trees are Messy
- 21:51Whats Next
- 22:39Security Domain Transition
- 28:38Binary Signing
- 30:55Swift Signatures
- 31:21Working with David Sanford
- 32:12D Package
related talks
29mOverview and Recent Developments: AppArmor
34mTying EVM into LSM Policy
36mOverview and Recent Developments: Linux Integrity
25mVerified Debian Packaging at Scale
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
16mSub-system Update: Linux Integrity Status Update
28mAgent Runtime Security: Enforce, Attest, Decide
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...