Stacked LSMs and User Space

on YouTube ↗23m

" summary

Linux 6.8 adds three new system calls to access LSM attributes and a small C library, liblsm, implements friendly wrappers plus proc emulation for older kernels. The library exposes LSM context helpers, ID↔name mapping, get/set attribute calls and iterators, and currently reads/writes via proc when syscalls are absent; emulation mostly works but has edge cases (no SELinux subdirectory, policy-dependent write failures). Audit format and peer/file attribute helpers are planned; current implementation is minimal but functional.

AI-written summary · about

" chapters (7)

1. 0:00LSM and user space libraries
2. 3:55Traditional LSM admin
3. 8:12liblsm library design
4. 13:32LSM syscall emulation challenges
5. 16:28Applications LSM-agnostic
6. 19:40Future work and extensions
7. 22:30Summary and feedback

" related talks

• 15mSubsystem Update: LSM Stacking - What You Can Do Now and What's NextCasey Schaufler · Linux Security Summit North America 2019
• 30mLSM Stacking - What You Can Do Now and What's NextCasey Schaufler · Linux Security Summit Europe 2019
• 41mThe State and Direction of LSM StackingCasey Schaufler · Linux Security Summit North America 2025
• 45mSystem Calls for the Linux Security Module InfrastructureCasey Schaufler · Linux Security Summit North America 2023
• 33mSecurity Module Stacks That Don't Fall OverCasey Schaufler · Linux Security Summit Europe 2018
• 01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...KP Singh, Roberto Sassu, Paul Moore, John Johansen · Linux Security Summit Europe 2023
• 52mLSM Maintainers PanelMickaël Salaün, Casey Schaufler, Paul Moore, Mimi Zohar, John Johansen · Linux Security Summit North America 2023
• 30mSecurity Module Stacks that Don't Fall OverCasey Schaufler · Linux Security Summit North America 2018