Getting Started with Embedded Linux Security
summary
Overview lists concrete defenses and checks: use fortify_source and GCC stack protectors plus ASAN or Valgrind for memory bugs, run checksec/ckkc to audit binaries, and track CVEs/CWEs (example: a past sudo/pseudo off‑by‑one leading to privilege escalation). At system level enable seccomp syscall filters, SElinux or AppArmor policies, containerize with LXC, use fsverity/device‑mapper for integrity/encryption, sign kernel modules and enforce secure boot and hardened U‑Boot.
AI-written summary · about
chapters (15)
- 0:00Embedded Linux security intro
- 2:11Why embedded needs security
- 4:41Threat modeling & attack vectors
- 12:16Tracking vulnerabilities with CVE and CWE
- 15:31Secure compilation with GCC
- 25:48Linux access control
- 29:21MAC with SELinux & alternatives
- 34:25Worst-case design
- 37:36File system security & encryption
- 39:19Restricting syscalls with SECCOMP
- 41:08Kernel security & updates
- 43:56Kernel config best practices
- 47:22Secure boot basics
- 51:59Vendor security features
- 53:04Secure dev lifecycle
related talks
32mELC 2013 Security: Best Practices for Embedded Systems
32mEmbedded Linux Security: Dr Jekyll and Mr Hyde
46mDesigning Secure Containerized Applications for Embedded Linux Devices
28mOverview of the Linux Kernel Security Subsystem
23mOverview and Recent Developments: seccomp and Small Linux Security Modules
42mSecurity in Large Scale Embedded Linux Projects
34mYocto Project/OpenEmbedded Meets Security
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel