Christian Brauner
where else to find them
website:https://brauner.io
github:brauner
mastodon:@brauner@mastodon.social
x:brau_ner
linkedin:christian-brauner
what they talk about
where they keep going back
- Linux Security Summit North America3 editions2019–2022
- Linux Security Summit Europe3 editions2018–2022
all 7 in the filters
on a stage with
all 7 in the filters
who talks about the same things
- Stephane Graber31 talks
- James Bottomley25 talks
- Michael Kerrisk12 talks
- Kees Cook23 talks
- Paul Moore13 talks
- Ignat Korchagin36 talks
| title | conference | date |
|---|---|---|
| State of Linux Kernel Container Features | LinuxCon @ OSS NA 2023 | 2023-05-10 |
Current kernel work makes unprivileged containers practical: unprivileged user namespaces can be blocked via an LSM hook and distributions no longer must patch… | ||
| What's New in the User Namespace | Linux Security Summit Europe 2022 | 2022-09-15 |
User namespaces exist for ~9 years but remain uncommon; the kernel now offers VFS idmapped mounts (landed in recent kernels for ext4, xfs, vfat, btrfs, f2fs… | ||
| Closing session | Linux Plumbers Conference 2022 | 2022-09-12 |
Conference closes with thanks to everyone who presented, attended in person and remotely, and helped run sessions; organizers are publicly thanked and the room… | ||
| Improving Container Security with System Call Interception | Linux Security Summit North America 2022 | 2022-06-23 |
Describes using seccomp notify (Linux 5.9+) to pause a syscall, send its args to a privileged host monitor, and return the host’s response; LXD implements… | ||
| Namespacing the Linux Integrity Measurement Architecture | Linux Security Summit North America 2022 | 2022-06-23 |
Work produces a prototype and >100 patches that add per-container IMA: it piggybacks on user namespace by creating a mountable, per-namespace securityfs that… | ||
| Container Kernel Development | Open Source Summit + Embedded Linux Conference + OSPOCon 2021 | 2021-09-27 |
Kernel 5.9 adds the close_range syscall, replacing slow proc-based loops and giving a striking performance win for mass-closing fds; a new close-on-exec flag… | ||
| Idmapped Mounts | Open Source Summit + Embedded Linux Conference + OSPOCon 2021 | 2021-09-27 |
Kernel support for per-mount UID/GID translation makes it possible to expose the same files at multiple mountpoints with different ownership without modifying… | ||
| Idmapped Mounts | FOSDEM 2021 | 2021-02-06 |
Flexible file ownership
On most POSIX systems including Linux file ownership can only be changed globally, i.e. for all users through the chown*() syscall… | ||
| Panel Discussion: What is Lacking in Linux Security and What Are or Should We be Doing about This | Linux Security Summit North America 2020 | 2020-07-01 |
Calls for treating testing as core: integrate static analysis, unify test formats and crash reporting, and require regression tests for fixes because sisbot… | ||
| Tutorial: Using Linux Primitives to Build Your Own Containers | Linux Security Summit Europe 2019 | 2019-10-31 |
Step-by-step build of a container from kernel primitives: create user namespaces and remap UIDs so root inside ≠ root outside, unshare mount and pivot_root to… | ||
| Making Containers Safer | Linux Security Summit North America 2019 | 2019-08-19 |
Describes concrete defenses and recent kernel work: running 18 distros across six architectures and building ~300 images daily, users count in the hundreds of… | ||
| Overview and Recent Developments: Namespaces and Capabilities | Linux Security Summit Europe 2018 | 2018-10-25 |
Covers concrete kernel work from roughly 4.10–4.18: libcap adds libcap ambient capability support and namespace filesystem-capability handling; UID/GID map… | ||
| Filesystem mounts in user namespaces | Container Camp UK 2018 | 2018-09-06 |
Kernel 4.18 already allows mount FUSE from 4.18 by keeping filesystem code in userspace; the VFS now records superblock stores owning user namespace and adds a… | ||
| nothing matches | ||