Linux Security Summit North America 2022
2022-06-23..2022-06-24
-- online --
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
who it's for
kernel developers, security researchers, container runtime engineers, cloud and VM engineers, distribution maintainers, filesystem developers, crypto engineers, SELinux policy authors
topics
kernel memcpy bounds checking; seccomp notify syscall interception; confidential VM guest hardening; per-namespace IMA implementation; transient execution CI tests; HCTR2 wide-block encryption; coordinated vulnerability disclosure practices; build-aware tracer with clang AST; SELinux high-level language; platform keystore via securityfs; fs-verity integrated IMA appraisal; Landlock file and network rules
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel | James Morris, Kees Cook | 52m |
Analyzes three years of kernel CVEs and finds 25 heap buffer overflows with 11 memcpy overflows that the compiler could have detected; instruments an… | ||
| Improving Container Security with System Call Interception | Stephane Graber, Christian Brauner | 50m |
Describes using seccomp notify (Linux 5.9+) to pause a syscall, send its args to a privileged host monitor, and return the host’s response; LXD implements… | ||
| Hardening the Linux Guest for the Confidential Cloud Computing: Deep Dive and Results | Elena Reshetova | 50m |
Project hardens mainline Linux guests for confidential VMs by auditing and fuzzing the host-controlled inputs that now constitute a huge attack surface. It… | ||
| Namespacing the Linux Integrity Measurement Architecture | Stefan Berger, Christian Brauner | 47m |
Work produces a prototype and >100 patches that add per-container IMA: it piggybacks on user namespace by creating a mountable, per-namespace securityfs that… | ||
| How Can We Effectively Test Transient Execution Mitigations? | Russell Currey | 30m |
Describes a prototype pass‑fail CI test suite that runs transient execution exploits as regression tests, rewritten in C from Google SafeSide and using the… | ||
| Wide-Block Cipher Support and HCTR2 | Nathan Huckleberry | 26m |
Linux adds HCTR2 to the Crypto API as a wide-block HCTR2 construction that targets 4096-byte sectors and filename encryption in ext4 and f2fs, trading… | ||
| Preparing for Zero-Day: Vulnerability Disclosure in Open Source Software | Christopher R Robinson, Anne Bertucio, Art Manion | 01h 08m |
OpenSSF publishes a coordinated vulnerability disclosure guide with runbooks, communication templates and a recommendation to coordinated disclosure over… | ||
| Welcome Back & Remarks & Code Aware Services in the Service of Vulnerability Detection | James Morris, Bartosz Zator | 45m |
System captures build actions with a low‑overhead build-awareness kernel tracer (ftrace module) and parses C with a clang AST processor to produce per‑module… | ||
| Cascade - A New High Level SELinux Policy Language | Daniel Burgener | 01h 00m |
Cascade is a Rust library that compiles to SIL and targets making SELinux policy authoring simpler for app developers by offering typed domain/resource… | ||
| PowerVM Platform Keystore - Securing Linux Credentials Locally | Nayna Jain | 27m |
Proposes a new firmware securityfs kernel layer plus a PowerVM driver that talks to the platform keystore (PKS) via hypervisor HCON calls, exposing… | ||
| IMA Policy Support for fs-verity: A Win-win for IMA & fs-verity | Mimi Zohar | 35m |
Integrates fs‑verity digests and signatures into the IMA measurement list so IMA can appraise and enforce verity‑signed read‑only files without rereading full… | ||
| Establishing Trust in Linux Keyrings - Is Trust Built-in, Imputed, or Transitive? | Elaine Palmer, George Wilson | 32m |
Linux 5.18 adds a .machine keyring that links to the secondary trusted keyring and can verify kernels, modules and kexec images using keys imported via UEFI… | ||
| Update on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules | Mickaël Salaün | 40m |
Landlock is in mainline since kernel 5.13 and gains a new file refer right that lets renames and links work without policy bypass by requiring… | ||
| BPF LSM - Updates and What next? | KP Singh | 27m |
BPF LSM is shipping in mainline and is already deployed for telemetry and enforcement at Google, using BPF atomics to count events and bpf local storage blobs… | ||
| nothing matches | ||