veyepar: How To Write A Linux Security Module That Makes Sense For You

Author(s):	Casey Schaufler
Location	D4.303 Costa Theatre
Date	feb Wed 03	Days Raw Files
Start	11:35	First Raw Start	11:26
Duration	0:45:00	Offset	0:08:57
End	12:20	Last Raw End	13:20
Chapters	00:00
Total cuts_time	41 min.

https://linux.conf.au/schedule/30136/view_talk
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

assets release.pdf How_To_Write_A_Linux_Security_Module_That_Makes_Sense_For_You.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

The traditional Linux security model traces it's fundamental concepts to the mini-computers of the 1970's. It makes a lot of sense when you consider a machine without a network connection that is being shared by a handful of friendly collaborators. Linux security modules (LSM) were introduced at the turn of the century to address the needs of high security environments. A recent and ongoing rework of the LSM infrastructure makes it significantly easier to implement and upstream small, targeted security features.

This talk will teach you want you can accomplish with a Linux security module, and what you can't. You'll learn the difference between a major module and a minor one. Techniques for implementing access controls on files, inter process communications and sockets will be covered, as will the underlying mechanisms required to maintain the data needed. You'll find out what a secid is, how it relates to a security context. and why it matters to CIPSO. The difference between inode based schemes and path name based ones will be made clear.

When the talk is over you'll have the tools you need to create a security module that protects what you care about instead of what seemed like a good idea to a government researcher during the Cold War.

Comment:

production notes