Linux Kernel Security Subsystem - User contributions [en]

Linux Kernel Integrity

2017-09-15T17:13:30Z

JarkkoSakkinen:

'''linux-integrity@vger.kernel.org''' is the mailing list for TPM and IMA targeted patches and discussion. For non-trivial patch sets, such as patch sets that touch multiple subsystems, it is recommended to CC the '''linux-security-module@vger.kernel.org''' mailing list for more broad screening.

TPM and IMA have have their own maintainers and GIT trees:

* '''IMA:''' Mimi Zohar, git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
* '''TPM:''' Jarkko Sakkinen, git://git.infradead.org/users/jjs/linux-tpmdd.git

Linux Kernel Integrity

2017-09-14T19:16:03Z

JarkkoSakkinen: Created page with "'''linux-integrity@vger.kernel.org''' is the mailing list for TPM and IMA targeted patches and discussion. For non-trivial patch sets, such as patch sets that touch multiple s..."

'''linux-integrity@vger.kernel.org''' is the mailing list for TPM and IMA targeted patches and discussion. For non-trivial patch sets, such as patch sets that touch multiple subsystems, it is recommended to CC them also to '''linux-security-module@vger.kernel.org''' mailing list for more broad screening.

TPM and IMA have have their own maintainers and GIT trees:

* '''IMA:''' Mimi Zohar, git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git
* '''TPM:''' Jarkko Sakkinen, git://git.infradead.org/users/jjs/linux-tpmdd.git

Projects

2017-09-14T19:08:22Z

JarkkoSakkinen: /* Integrity */

== Kernel Security Projects ==

=== Access Control ===

* [http://vger.kernel.org/vger-lists.html#linux-security-module Linux Security Modules (LSM)], the API for access control frameworks
** Mailing list archive: http://kernsec.org/pipermail/linux-security-module-archive/
* [http://www.novell.com/linux/security/apparmor/ AppArmor], a pathname-based access control system
* [http://selinuxproject.org/page/Main_Page Security Enhanced Linux (SELinux)], a flexible and fine-grained MAC framework
* [http://www.schaufler-ca.com/ Smack], the Simplified Mandatory Access Control Kernel for Linux
* [http://tomoyo.sourceforge.jp/ TOMOYO], another pathname-based access control system (LiveCD available)
* [http://grsecurity.net/features.php grsecurity], extensive security enhancement patch for the Linux kernel (RBAC, chroot hardening, auditing, stack/heap protection randomization and more...)
* [http://www.rsbac.org/why Rule Set Based Access Control (RSBAC)], Linux kernel patch implementing a security framework
* [http://schreuders.org/FBAC-LSM FBAC-LSM] aims to provide easy to configure (functionality-based) application restrictions
* [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/security/Yama.txt;hb=HEAD Yama] adds restrictions to ptrace, providing a programmatic way to declare relationships between processes

=== Integrity ===

This is a rapidly developing area, see the following LWN article for an overview:

* [[Linux Kernel Integrity]]
* [http://lwn.net/Articles/309441/ System integrity in Linux]

=== Privileges ===

* [http://www.friedhoff.org/posixfilecaps.html POSIX File Capabilities]
** [http://lwn.net/Articles/313047/ Filesystem capabilities in Fedora 10 LWN article]

=== Networking ===

There are several separately maintained projects relating to network security, including:

* [http://www.netfilter.org/ Netfilter] packet filtering
* Labeled Networking, including NetLabel, CIPSO, Labeled IPsec and SECMARK, see [http://paulmoore.livejournal.com/ Paul Moore's blog]
* [http://www.nufw.org/ NuFW] authenticating firewall based on Netfilter

=== Storage ===

* [http://selinuxproject.org/page/Labeled_NFS Labeled NFS], a project to add MAC labeling support to the NFSv4 protocol
* [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=blob;f=Documentation/device-mapper/verity.txt dm-verity], a device mapper target for efficient, integrity-assured block devices

=== Cryptography ===

The cryptographic subsystem is maintained separately by Herbert Xu, refer to the [http://vger.kernel.org/vger-lists.html#linux-crypto mailing list].

=== Working Group ===

* [[Linux Security Workgroup]]

=== Self Protection ===

* [[Kernel Self Protection Project]]