Look out for what’s in the security pipeline – Casey Schaufler
Old Protocols
- SeLinux
- No much changing
- Smack
- Network configuration improvements and catchup with how the netlable code wants things to be done.
- AppArmor
- Labeled objects
- Networking
- Policy stacking
New Security Modules
- Some peopel think existing security modules don’t work well with what they are doing
- Landlock
- eBPF extension to SECMARK
- Kills processes when it goes outside of what it should be doing
- PTAGS
- General purpose process tags
- Fro application use ( app can decide what it wants based on tags, not something external to the process enforcing things )
- HardChroot
- Limits on chroot jail
- mount restrictions
- Safename
- Prevents creation of unsafe files names
- start, middle or end characters
- SimpleFlow
- Tracks tainted data
Security Module Stacking
- Problems with incompatibility of module labeling
- People want different security policy and mechanism in containers than from the base OS
- Netfilter problems between smack and Apparmor
Container
- Containers are a little bit undefined right now. Not a kernel construct
- But while not kernel constructs, need to work with and support them
Hardening
- Printing pointers (eg in syslog)
- Usercopy
