Securing a Yocto Built System
summary
Step-by-step demo implements Yocto manual guidelines by building a distro with development, production, and production-test images, adding first-boot root-password unit (systemd) to generate device-unique credentials, using package-exclude and manifest inspection to drop packages, enabling compiler hardening flags, running lighttpd as non-root with CAP_NET_BIND_SERVICE, and booting a read-only root (overlayfs) filesystem; meta-security layer supplies kernel hardening fragments but is not a silver bullet; vulnerability auditing uses Vanscout/SPDX consumer to generate actionable reports — all proofs of concept work.
AI-written summary · about
chapters (13)
- 0:00Yocto security challenges
- 3:32Modern embedded security
- 5:16Secure Yocto distributions
- 8:05Attack surface reduction
- 10:59Device credentials at boot
- 14:29Compiler and user space security
- 17:39Restricting service privileges
- 22:22Kernel and bootloader hardening
- 26:14Read-only root filesystem
- 29:06Vulnerability checks maintenance
- 33:54Yocto product vulnerabilities
- 35:38Security best practices
- 39:10Q&A
related talks
40mSecuring a Yocto-based Distribution: The Case of AllScenariosOS
48mHardening IoMT Medical Devices: Defense‑in‑Depth on Yocto‑Based Embedded Linux
34mYocto Project/OpenEmbedded Meets Security
42mPractical Application of Verified Boot
35mSecuring build platforms- 42mPractical Application of Verified Boot
49mSecure Boot from A to Z
39mFrom a Security Expert's Diary: DOs and DON'Ts When Choosing Software for your...