Linux Security Summit 2013/Abstracts/Schaufler

Title

Multiple Concurrent Security Models? Really?

Presenter

Casey Schaufler, Intel

Abstract

This talk will cover the ongoing work to update the Linux Security Module (LSM) infrastructure to allow multiple concurrent security modules.

The talk starts with a statement of the problem being solved, that the existing infrastructure allows only a single LSM (plus Yama) to be active at a time. The rationale for the current scheme will be discussed as well as what has changed so that the new scheme is in the works.

The talk continues with a description of the externally visible changes and the reasons they've been made. The peculiar configuration issues with networking will be covered in some detail. The additions in /proc/.../attr will be noted.

Next the structure of the stacking mechanism is detailed, with special attention to the allocation and freeing of security blobs. The handling of networking hooks and secids will be examined.

Finally, the current project plan and status will be described.