Subsystem Update: Linux Integrity Status Update
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 16:40· Sapphire D, Hilton San Diego Bayfront·
summary
Summary of upstream changes and work in progress: appended signature support is queued for the next kernel and firmware platform keyring now loads pre‑boot firmware keys separately for kexec and appended signatures; a build‑time option requires signed kexec images; a runtime template option lets IMA measure boot command line and choose IMA modsig (xattr plus appended signature) or ima-buf templates; overlayfs xattr fixes, execution-locking while signature verification runs, new EVM/IMA utils release, added KUnit/LTP tests, CPI-O changes pending review, and improved mutable-file hashing to survive power loss.
AI-written summary · about
chapters (7)
- 0:00Linux Integrity overview
- 1:46IMA policy vs performance
- 3:37Secure boot upstreaming
- 7:14Runtime policy updates
- 10:10IMA/EVM fixes
- 14:13IMA testing future
- 16:44Summary Q&A
related talks
16mSub-system Update: Linux Integrity Status Update
36mOverview and Recent Developments: Linux Integrity
26mIntegrity
35mUsing Linux as a Secure Boot Loader for OpenPOWER Servers
52mSurviving in the Wilderness: Integrity Protection and System Update
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space