Project about? What are the Landlock, SARA and WhiteEgret...
Transcript of Project about? What are the Landlock, SARA and WhiteEgret...
![Page 1: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/1.jpg)
1
Why is Linux kernel security getting so much attention all of a sudden, and where is it going? What is the Linux Hardening Project about? What are the Landlock, SARA and WhiteEgret security modules for? This can't be all about side channel attacks, can it? Is security a good place to contribute? Casey Schaufler, who has been working in kernels and security for a very long time, will talk about the current state of Linux kernel security development. The efforts to make the kernel less susceptible to attack will be outlined. New developments in access controls will be described. Infrastructure changes, including expanded security module stacking, will be covered. You'll hear about integrity, TPMs, trusted boot and more. The talk will wrap up with predictions and some areas that aren't getting the attention they may deserve.
![Page 2: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/2.jpg)
Kernel Security Is Cool Again
LINUX.CONF.AU21-25 January 2019 Christchurch, NZ The Linux of Things | #LCA2019 | @linuxconfau
![Page 3: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/3.jpg)
Casey Schaufler
Kernel developer from the 1970’s
Supercomputers in the 1990’s
Smack Linux Security Module
Security module stacking
3
Photo Curtesy Ann Forrister
![Page 4: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/4.jpg)
WhatHappened?
![Page 5: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/5.jpg)
Spectre and Meltdown Published
• Extremely high profile
5
![Page 6: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/6.jpg)
grsecurity Went Dark
• Refocused to the community
6
https://de.wikipedia.org/wiki/Figuren_in_Tolkiens_Welt#/media/File:Wax_Museum_Plus_(6344811177).jpg
![Page 7: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/7.jpg)
Containers Are Popular
• Want enhancements
7
![Page 8: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/8.jpg)
1980’s Security Is For Squares
• Bell & LaPadula? Really?
8
![Page 9: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/9.jpg)
What isto be done
about hardware?
![Page 10: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/10.jpg)
Fix Hardware Security Bugs
• Sidechannel attacks
• Multiple architectures
10
![Page 11: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/11.jpg)
Support Hardware Security Features
• Isolation
• Memory protection
• Encryption
11
![Page 12: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/12.jpg)
The boot process
• Attestation
• Signatures
12
https://commons.wikimedia.org/wiki/File:Atomic_Energy_Act_of_1946_signing.jpg
![Page 13: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/13.jpg)
What iskernel hardening?
13
![Page 14: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/14.jpg)
50 years of bad coding
• We’ve learned a lot
• 24 million lines
• 24 one in a million errors
strncpy(buff, user_buff, user_len);
14
![Page 15: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/15.jpg)
New techniques
• Scanning tools
• Compiler tricks
• Anyone remember lint(1)?
15
https://commons.wikimedia.org/wiki/File:Transmission_electron_microscope_(Morgagni_268D)_1pl.jpg
![Page 16: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/16.jpg)
Containers areneither a kernel nor
a security feature
16
![Page 17: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/17.jpg)
Namespaces, on the other hand …
• What’s next?
• LSM namespaces
17https://commons.wikimedia.org/wiki/File:Lone_Ranger_and_Silver_1955.JPG
![Page 18: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/18.jpg)
Newsecurity models
18
![Page 19: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/19.jpg)
Landlock
• eBPF on system calls
• Self control
19
https://commons.wikimedia.org/wiki/File:Dog_with_treat.jpg
![Page 20: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/20.jpg)
SARA
• Memory protections
• USB filtering
• Plugins
20
https://www.flickr.com/photos/ajc1/10994593713
![Page 21: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/21.jpg)
WhiteEgret
• Execution whitelisting
21
https://commons.wikimedia.org/wiki/File:Great_White_Egret_197.jpg
![Page 22: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/22.jpg)
Security module stacking
• Infrastructure data management
• Incremental implementation
22
![Page 23: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/23.jpg)
How canI join in the
fun?
23
![Page 24: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/24.jpg)
Linux Kernel Hardening Project
• https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
24https://www.linuxfoundation.org/blog/2017/12/linux-kernel-developer-kees-cook/attachment/kees-cook-2/
![Page 25: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/25.jpg)
Linux security modules
• What do you call secure?
25
![Page 26: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/26.jpg)
What does thefuture hold?
26
![Page 27: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/27.jpg)
Connected devices
• No users
• Too smart by ½
27
![Page 28: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/28.jpg)
Storage
VectorSHA
GPUTCP
Offload
Special purpose processors
• Graphics
• Cryptography
28
CPU
![Page 29: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/29.jpg)
Lots and lots of bugs
• New devices
• New exploits
29
https://commons.wikimedia.org/wiki/File:H96566k.jpg
![Page 30: Project about? What are the Landlock, SARA and WhiteEgret …lca-kernel.ozlabs.org/2019-Schaufler-Kernel-Security-is-Cool-Again.pdf · Project about? What are the Landlock, SARA and](https://reader033.fdocuments.in/reader033/viewer/2022052006/601a3644203a86303e2b207b/html5/thumbnails/30.jpg)
LINUX.CONF.AU21-25 January 2019 Christchurch, NZ The Linux of Things | #LCA2019 | @linuxconfau
Thank [email protected]