Linux Security Summit North America 2025
2025-06-26..2025-06-27
Denver, United States
[Linux Security Summit North America 2018, Linux Security Summit North America 2019, Linux Security Summit North America 2020, Linux Security Summit North America 2022, Linux Security Summit North America 2023, Linux Security Summit North America 2024, Linux Security Summit North America 2025, Linux Security Summit North America 2026]
as the organisers put it
register sponsor VIEW THE SCHEDULE Submit a proposal Thank you to all who joined us for Linux Security Summit North America 2025! We look forward to seeing you at future events. To experience the best…
| title | author | length |
|---|---|---|
| Welcome + Opening Remarks | James Morris | 02m |
Brief welcome that explains logistics: the program mixes pre-recorded talks with in-person sessions because some speakers cannot travel, the event is not live… | ||
| Kernel Hardening: Ten Years Deep | Kees Cook | 52m |
Project started in 2015, created measurable results: average CVE lifetime drops after years of stagnation and many buffer and integer overflow classes fall… | ||
| Lessons Learned While Making an AppArmor Play Machine | Alexandre Pujol | 38m |
Demonstrates a VM where everyone logs in as root but is limited solely by AppArmor policies, using Full System Policies (FSP) mode and the apparmor.d toolchain… | ||
| SeaBee: Defense for the Defense | Alan Wandke, Jacob Satterfield | 33m |
An eBPF-based mandatory access control framework named SeaBee isolates privileged eBPF tools by labeling loader processes and their children, enforcing label… | ||
| Ubuntu Permission Prompting | John Johansen | 39m |
Ubuntu 24.10 ships an experimental permission-prompting system that adds per-file and per-operation prompts for snaps only, mediating kernel AppArmor events… | ||
| Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL | Xuan Xing, Eugene Rodionov | 46m |
Builds Linux as a user-space library (LKL) and hooks it to libFuzzer + KSAN to run fast, coverage-guided kernel fuzzers without VMs or hardware. Adds MMU… | ||
| Putting Together a Secure Virtualization and Containerization Platform | Stephane Graber | 47m |
Incus OS is a Debian‑based, image‑only platform built with systemd mkosi that boots an immutable dm-verity immutable A/B images, signs UKIs and bootloaders and… | ||
| Getting on the Same (Virtual Memory) Page: A Roundtable on Data-only Attack Mitigations | Maxwell Bland | 34m |
Kernel mutable state includes more than 20,000 mutable kernel data structures (example: corrupting struct file->f_op to hijack open/read/write). Survey… | ||
| Integrating Confidential Computing Into Cloud Infrastructure: Challenges and Opportunities | Carlos Bilbao | 23m |
Integration requires concrete changes to boot, attestation and runtime: attestation chains must include the confidential runtime and use a virtual TPM, memory… | ||
| Welcome Back + Remarks | James Morris | 03m |
Day two opens with the schedule shifted to finish slightly earlier and recordings available about a week later. Logistics and AV run by the Linux Foundation… | ||
| The State and Direction of LSM Stacking | Casey Schaufler | 41m |
LSM stacking is moving from ad hoc per-module state to infrastructure-managed data: security blobs hold per-object/process pointers, LSM properties replace… | ||
| Binding TDISP & Platform Attestation Reports for Confidential VMs | Anna Trikalinou | 42m |
Problem: a TDISP device attestation report and a platform attestation report are not cryptographically bound, allowing replay of old device reports to a CVM… | ||
| SELinux All the Way Down: Namespaces for SELinux | Stephen Smalley | 45m |
Proposal enables per-container policies by giving each SELinux namespace its own policy, AVC, enforcing mode and selinuxfs instance while requiring ancestor… | ||
| Handling New Syscalls in Seccomp Filters | Tom Hromatka, Paul Moore | 31m |
Proposal adds a max-kernel-version attribute to libseccomp so filters record the kernel they were written for and a second attribute that sets the action for… | ||
| SymBisect: Accurate Bisection for Fuzzer-Exposed Linux Vulnerabilities | Zheng Zhang | 30m |
Don't miss out! Join us at the next Open Source Summit in Hyderabad, India (August 5); Amsterdam, Netherland (August 25-29); Seoul, South Korea (November 4-5)… | ||
| Layered Attestation of a Cross-Domain System | Perry Alexander | 59m |
A full boot-to-runtime attestation system is built using TPM 2.0 for a sealed attestation-manager signing key, IMA and SELinux measurements via Elkim, and a… | ||
| eBPF as an Active Security Enforcement Layer Stop DNS Data Breaches : Beyond Passive Observability | Vedang Parasnis | 44m |
A kernel-integrated enforcement framework uses eBPF TC and sockets, BPF LSM and tracepoints to intercept DNS at the endpoint, perform DPI and either… | ||
| nothing matches | ||