Tutorial: How to Write a Linux Security Module
Talkat Linux Security Summit North America 2019 · on Wednesday, 2019-08-21· at 09:00· Sapphire D, Hilton San Diego Bayfront·
summary
Covers how to implement an LSM end to end: which kernel hooks to use (inode/file/socket vs packet), how to store labels in per-object infrastructure-managed blobs, and how to expose context via /proc and sysfs; shows path-hook pitfalls—d_path reconstruction misses symlinks and struggles with hard links and mount namespaces—and warns packet labeling options: secmark and netlabel are practical, while labeled IPSec can explode into thousands of SAs; recommends netfilter/BPF for packet drops and audit integration for decisions.
AI-written summary · about
chapters (31)
- 0:00Introduction and context
- 1:44Understanding LSMs
- 3:22LSM functionality limitations
- 4:29LSM inappropriate use cases
- 6:03LSM alternative mechanisms
- 8:23LSM design best practices
- 11:07Security module design phases
- 13:36Threat modeling in security
- 15:52Hooks and access control
- 21:22State maintenance and hooks
- 23:44Security blobs management
- 25:52Registering a new LSM
- 28:20SecID and Context handling
- 31:15Process attribute management
- 33:53Proc interfaces and security
- 37:14Object-based hooks and files
- 42:39Extended attributes usage
- 45:31Path-based hooks and aliasing
- 52:37Handling namespaces and mounts
- 55:07Network access control
- 59:17Network labeling protocols
- 1:02:54Socket option interfaces
- 1:07:06Networking limitations and risks
- 1:10:35Audit subsystem overview
- 1:13:39Audit record management
- 1:17:09Best practices for auditing
- 1:21:35Performance impact of auditing
- 1:24:11LSM interface configuration
- 1:25:48Adding new security hooks
- 1:28:27LSM boot configuration
- 1:31:09Conclusion and Q&A
related talks
33mSecurity Module Stacks That Don't Fall Over
28mOverview of the Linux Kernel Security Subsystem
30mSecurity Module Stacks that Don't Fall Over
38mSecure the Linux Kernel with eBPF Linux Security Module
30mLSM Stacking - What You Can Do Now and What's Next
41mThe State and Direction of LSM Stacking
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
27mBPF LSM - Updates and What next?