Integrity Policy Enforcement: Full System Integrity Verification

on YouTube ↗43m

" summary

A kernel LSM called Integrity Policy Enforcement implements user-authored rules that map logical operations (execute, read, kernel-module load) to integrity mechanisms. It supports dm-verity as a verified-backend, stores PKCS7-signed plaintext policies in securityfs, parses key=value rules at load time, and evaluates them on LSM hooks. The demo shows policy activation, denial and un-denial by revocation by root-hash, blocks anonymous-code execution and intercepts LD_PRELOAD abuses; scripts via interpreters remain a known gap.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 1:27Code Integrity (CI) 101
3. 2:38Let's design a locked down system
4. 6:03What makes a good policy?
5. 8:47Diagnosability
6. 11:10What makes a good integrity mechanism?

" related talks

• 26mIntegrityMimi Zohar · Linux Security Summit 2016
• 36mOverview and Recent Developments: Linux IntegrityMimi Zohar · Linux Security Summit Europe 2018
• 39mIntegrity Protection and Access Control - Who Do You Trust?Glenn Wurster · Linux Security Summit 2016
• 34mTying EVM into LSM PolicyMatthew Garrett · Linux Security Summit Europe 2018
• 44mInfoflow LSMRoberto Sassu · Linux Security Summit North America 2019
• 16mSub-system Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2018
• 01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...KP Singh, Roberto Sassu, Paul Moore, John Johansen · Linux Security Summit Europe 2023
• 28mOverview of the Linux Kernel Security SubsystemJames Morris · Linux Security Summit Europe 2018