LSM Maintainers Panel
summary
Panel argues that LSM stacking is the single most important change and shows progress toward composition but no final namespacing solution; eBPF-as-LSM is labeled risky with past hook ordering bugs and opaque proprietary policies; IO_uring and interpreter execs expose integrity gaps; proposals include breaking capabilities into LSM calls, container IDs to group resources, stronger eBPF signing policies (IMA alone insufficient), and small Rust LSMs like loadpin as a practical experiment.
AI-written summary · about
chapters (9)
- 0:00LSM maintainers panel intro
- 1:02Biggest LSM challenges today
- 7:03Most important LSM change under development
- 11:21Emerging Linux threats
- 16:50LSM and eBPF security role
- 28:15Rust in LSM layer
- 38:41BPF LSM concerns
- 43:28Security namespaces and IDs
- 51:53Closing remarks
related talks
41mThe State and Direction of LSM Stacking
30mLSM Stacking - What You Can Do Now and What's Next
27mBPF LSM - Updates and What next?
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
23mStacked LSMs and User Space
30mSecurity Module Stacks that Don't Fall Over
33mSecurity Module Stacks That Don't Fall Over