LinuxCon+ContainerCon Europe 2016

The traditional Linux security model traces it's fundamentals to the mini-computers of the 1970's. It makes a lot of sense for a machine without a network connection, shared by a handful of friendly collaborators. Linux security modules (LSM) were introduced to address the needs of high security environments. This talk will teach you what you can do with a Linux security module, and what you can't, the difference between a major module and a minor one. Techniques for implementing access controls on files, IPC and sockets will be covered, as will the underlying mechanisms required to maintain the data needed. The difference between inode based schemes and path name based ones will be made clear. In the end you'll have the tools you need to create a module that protects what you care about instead of what seemed like a good idea to a government researcher during the Cold War.