The Digest_cache LSM
Talkat Linux Security Summit North America 2024 · on Thursday, 2024-04-18· at 16:05· Terrace Suite 1+2·
summary
digest_cache LSM is a standalone kernel LSM that serves signed package metadata on demand to IMA/IPE without changing on-disk formats, can unload and reload references at runtime, and supports early‑boot operation and deterministic directory scanning so a TPM‑sealed key only unlocks when accessed files have known digests. It improves IMA performance up to 65%, ships TLV‑based and RPM parsers formally verified with Frama‑C, is extendable via eBPF, and makes no appraisal decisions itself.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:04Integrity Measurement Architecture overview
- 2:08TPM problems in integrity systems
- 5:01Digest_cache LSM introduction
- 9:57LSM instead of existing methods
- 11:20Digest_cache LSM data structures
- 13:10Digest_cache LSM API for integrity providers
- 18:45Predictable measurements with Digest_cache
- 21:37Performance improvements with Digest_cache
- 25:13Conclusion and future steps
- 26:20Q&A
- 27:03Comparison with TCG measured boot manifest
- 30:22Future formats and extensibility
- 31:03Q&A
related talks
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
35mIMA Policy Support for fs-verity: A Win-win for IMA & fs-verity
27mBPF LSM - Updates and What next?
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
16mSub-system Update: Linux Integrity Status Update
36mOverview and Recent Developments: Linux Integrity
34mTying EVM into LSM Policy
47mNamespacing the Linux Integrity Measurement Architecture