veyepar: The Twisting, Turning, Narrow Road That Is Security

Author(s):	Casey Schaufler
Location	Green Theatre CB07.02.25
Date	jan Wed 24	Days Raw Files
Start	11:40	First Raw Start	11:12
Duration	0:45:0	Offset	0:27:35
End	12:25	Last Raw End	12:42
Chapters	00:00 0:01:44 0:31:44
Total cuts_time	45 min.

http://lca2018.linux.org.au/schedule/presentation/27/
raw-playlist raw-mp4-playlist encoded-files-playlist host archive public tweet mp4 svg png

assets release.pdf The_Twisting_Turning_Narrow_Road_That_Is_Security.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

The road to computer security can't be especially smooth or straight for us to have wound up where we are. Why are there so many start-up options in systemd? Why is CAP_SYS_ADMIN so broad, when CAP_CHOWN is so specific? Who came up with the "mask" in access control lists? Are namespaces a security feature, or not? How did SELinux get so complicated? How did we come up with all these peculiar behaviors?

Let a kernel programmer from the 1970's take you through some of the history, mindset and all too often politics that have created the security paradigms, facilities and features we know in Linux today. We'll cover a few things from before the epoch (1 January, 1970) and the early days of UNIX. There will be a bit about the American "Orange Book", and how "C2 in '92" drove a frenzy of security feature development. We'll discuss how that lead to the POSIX P1003.1e/2c DRAFT and it's implications for security features as well as how it created an early cooperative development mindset within the security community. The arrival of Linux and the internet introduce new opportunities. The emergence of Linux Security Modules and their disappointing impact gets mentioned, too. Of course, the move from open systems to open source is next. The move to isolation, using virtualization and namespaces and the inevitable discovery of containers comes next.

We wrap up with some predictions of direction and possible disappointments in the future.

Comment:

production notes