Security in Large Scale Embedded Linux Projects
summary
Three generations of Yocto-based infotainment platforms produce a hardened baseline called node zero that enforces least privilege via a single user/group recipe, systemd unit sandboxing and ambient capabilities, and central review with a tool called blamead. More than 100 services and ~2–3k developers adopt SELinux after a year-long rollout that ships in the 2022 BMW 7 series; dm-verity, secure boot with multiple key slots, PKCS#11 signing and a lightweight policy helper smallkit handle signing, debugging tokens and field-safe updates.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 6:21Core security principles
- 11:57Security team responsibility
- 17:16Group management and config
- 21:31Automated service checks with blamead
- 23:18Deploying SELinux
- 27:52SELinux rollout lessons
- 29:16Secure boot tradeoffs
- 33:51Debug mode pitfalls
- 34:5610 years of embedded security
- 37:30Q&A
related talks
01h 04mModern Security Model for Embedded Linux Distributions
59mGetting Started with Embedded Linux Security
48mHardening IoMT Medical Devices: Defense‑in‑Depth on Yocto‑Based Embedded Linux
34mYocto Project/OpenEmbedded Meets Security
32mEmbedded Linux Security: Dr Jekyll and Mr Hyde
53mSecure Embedded Linux Product - A Success Story
28mOverview of the Linux Kernel Security Subsystem
46m20 years of NSA Security Enhanced Linux, a Retrospective