Enforcing Runtime Integrity with Maat
summary
Maat is an open source framework that performs continuous integrity measurement and appraisal across hypervisor, kernel, and user space, using TPM-based signing and an STMPE start point for layered attestation of hypervisor → kernel → userspace. It splits duties into an attestation manager that negotiates contracts, lightweight APBs that orchestrate work, and privileged ASPs that collect measurements, with SELinux constraining components. Demo code for user‑space and layered attestations exists and runs; lchem and XM remain closed, but user‑space tooling and IoT demos are available.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:12Maat: A Framework for Runtime Integrity
- 1:43Runtime Integrity Measurement
- 3:47Measurement and Attestation Roles
- 6:05Maat Contract Flow
- 7:56Runtime Measurement and Attestation Background
- 11:40Maat Components
- 15:10Walkthrough: Userspace Measurement
- 17:44Walkthrough: Layered Attestation
- 18:49Open Source Release
- 19:34Summary
related talks
59mLayered Attestation of a Cross-Domain System
29mA Simple Protocol for Remote Attestation of System Integrity
36mOverview and Recent Developments: Linux Integrity
38mMeta-security: Past, Present, and Future
41mTPMs, Merkle Trees and TEEs: Enhancing SLSA with Hardware-Assisted...
42mTPM based attestation - how can we use it for good?
41mKeylime - An Open Source TPM Project for Remote Trust of IoT
15mRemote Attestation in AMD SEV-SNP Confidential VMs