Linux Security Summit North America 2024
2024-04-18..2024-04-19
Seattle, United States
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
who it's for
kernel developers, linux security engineers, virtualization engineers, security researchers, security tool developers, distribution maintainers
topics
confidential computing threat model; COCONUT-SVSM Rust hypervisor services; SVSM secure-BM service module; integer overflow sanitizers and attributes; wraps typedef attribute; RISC-V control flow integrity; hardware shadow stack implementation; virtualization based security VTL1; digest_cache LSM for IMA; provenance enrichment with eBPF and SELinux types; unprivileged AppArmor application profiles; IMA log snapshotting
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | James Morris | 03m |
Developer-focused event returns after the co interruption with a tightened schedule and concrete metrics: over 70 registrations for the in-person Summit, 45… | ||
| Protecting the Linux Kernel from Confidential Computing Threats in Virtual Environments | Carlos Bilbao, Elena Reshetova | 42m |
Kernel documentation now includes the Confidential Computing Threat Model for Virtual Environments and virtio declares compliance; engineers audit interrupt… | ||
| Securing Confidential VMs with COCONUT-SVSM | Jörg Rödel | 45m |
COCONUT-SVSM is a Rust platform that moves hypervisor services into a trusted guest context to shrink Linux’s trust boundary: written in Rust, runs today on… | ||
| Mitigating Integer Overflow in C | Kees Cook | 39m |
Kernel work shows hundreds of CVEs tied to integer overflow over the last decade and pushes concrete fixes: extend sanitizers to detect overflows regardless of… | ||
| Control Flow Integrity on RISC-V Linux | Deepak Gupta | 35m |
Hardware-backed CFI for RISC-V uses a landing‑pad instruction plus a hardware shadow stack and a new Z CFI LP extension; userland patches (v3) and kernel RFCs… | ||
| Linux Virtualization Based Security | Anna Trikalinou, Thara Gopinath | 47m |
Linux Virtualization Based Security builds a minimal VTL1 secure kernel (a tiny Linux) via Hyper‑V VSM to enforce immutable EPT permissions and register… | ||
| Provenance-Aware Integrity Monitoring with Linux Security Identifiers | Frederico Araujo, Teryl Taylor | 48m |
An eBPF-based collector enriches syscall provenance with SELinux types to compute integrity boundaries and tag processes and files, enabling detection of… | ||
| The Digest_cache LSM | Roberto Sassu | 31m |
digest_cache LSM is a standalone kernel LSM that serves signed package metadata on demand to IMA/IPE without changing on-disk formats, can unload and reload… | ||
| Welcome Back & Check-In | James Morris | 01m |
Welcome back to day two with an apology for yesterday’s streaming delay and a note that recordings are likely available later. There were BFFs sessions last… | ||
| Unprivileged Access Control in AppArmor | John Johansen, Georgia Garcia | 48m |
Extends AppArmor so applications can load application-directed profiles from user space: a tiny compiler converts text rules into AppArmor’s verified kernel… | ||
| Stacked LSMs and User Space | Casey Schaufler | 23m |
Linux 6.8 adds three new system calls to access LSM attributes and a small C library, liblsm, implements friendly wrappers plus proc emulation for older… | ||
| Snapshotting IMA Log | Tushar Sugandhi | 42m |
Proposal adds kernel IMA log snapshotting so the kernel can emit a snapshot aggregate event, user space copies the archived binary snapshots to a configured on… | ||
| Enhancing Kernel Bug Discovery with Large Language Models | Zahra Tarkhani | 28m |
A semi-automatic framework combines Assistant API retrieval, prompt engineering, and GPT-3.5 fine-tuning with vulnerability descriptions, Project Zero… | ||
| A Hybrid Alias Analysis Framework and Its Application to Protecting the Linux Kernel | Guoren Li | 36m |
Presents a hybrid alias analysis that unifies data‑flow and type shortcuts, implemented as an on‑demand, per‑variable graph reachability engine on top of… | ||
| SandBox Mode (SBM) - New Execution Mode Between Kernel and User Space | Petr Tesarik | 30m |
SandBox Mode (SBM) introduces a new CPU-level execution mode between kernel and user space that runs selected kernel functions in an isolated address space… | ||
| Enhancing Systemd Security Using TPM 2.0 | Bill Roberts | 33m |
Systemd initially reads LUKS DEKs from TPM 2.0 in cleartext (systemd v248), making I2C/bus MiTM theft trivial and demonstrated by TPM Genie. An attempted fix… | ||
| nothing matches | ||