Linux Security Summit North America 2020
2020-07-01..2020-07-02
-- online --
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
who it's for
linux kernel developers, cloud infrastructure engineers, security researchers, distribution maintainers, SELinux policy authors, site reliability engineers, kernel security testers, container platform engineers
topics
clang LTO control flow integrity; shadow call stack returns; Intel SGX enclaves; Graphene shielded containers; transparent memory encryption SME; dm-verity verified backend; SELinux policy static analysis; syzkaller continuous fuzzing; automatic exploit generation; stable kernel backports
| title | author | length |
|---|---|---|
| Opening Remarks | James Morris | |
Conference opens with a brief program committee welcome, noting 10th anniversary of the summit and that it started in Boston 2010, and thanking the many… | ||
| 10 Years of Linux Security - A Report Card | Bradley Spengler | 51m |
Analysis of ten years of kernel security shows concrete outcomes not platitudes: the Kernel Self-Protection Project mailing list peaks in 2017 and halves by… | ||
| Automatically Securing Linux Application Containers in Untrusted Clouds | ANJO VAHLDIEK-OBERWAGNER, DMITRII KUVAISKII | 46m |
Graphene implements a library OS that runs unmodified Linux apps inside Intel SGX enclaves, mapping >300 syscalls to ~40 PAL APIs and using ~50 host syscalls… | ||
| Control Flow Integrity in the Linux Kernel | Kees Cook | 45m |
Control Flow Integrity is implemented in the kernel by using clang LTO to generate per-prototype jump tables that validate indirect calls (assembly uses an… | ||
| Encrypting Memory at Scale | Derek Chamorro, Brian Bassett | 30m |
Cloudflare enables AMD’s page-granular and transparent SME on gen x servers (EPYC 7642, 8×32 GB DIMMs, Debian 9, kernel 5.4.12) using the BIOS mem_encrypt=on… | ||
| Integrity Policy Enforcement: Full System Integrity Verification | Deven Bowers | 43m |
A kernel LSM called Integrity Policy Enforcement implements user-authored rules that map logical operations (execute, read, kernel-module load) to integrity… | ||
| Panel Discussion: What is Lacking in Linux Security and What Are or Should We be Doing about This | Elena Reshetova, Allison Marie Naaktgeboren, Alexander Popov, Mimi Zohar, Kees Cook | 01h 00m |
Panel lays out concrete gaps and fixes: too few tests and regression suites, reliance on continuous fuzzing (syzkaller) but no oracle to mark security‑relevant… | ||
| Panel Discussion: What is Lacking in Linux Security and What Are or Should We be Doing about This | Elena Reshetova, Andrew Lutomirski, Nayna Jain, Emily Ratliff, Dmitry Vyukov, Christian Brauner | 01h 07m |
Calls for treating testing as core: integrate static analysis, unify test formats and crash reporting, and require regression tests for fixes because sisbot… | ||
| SELint - An SELinux Policy Static Analysis Tool | Daniel Burgener | 30m |
SELint is a static-analysis tool for reference-policy SELinux sources (current release 1.1) that parses refpolicy plus its M4 subset, flags… | ||
| nothing matches | ||