Building a Defense-In-Depth OS Around Linux Kernel Security Improvements
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
UEFI Porting Update for ARM Platforms
UEFI Porting Update for ARM Platforms What did we do since July? presented by Leif Lindholm UEFI tech lead Linaro Enterprise Group UEFI Plugfest – May 2014 Agenda Introduction Linux Support EDK2 Development SCT Platforms Tree Future Work The UEFI Forum www.uefi.org 2 Introduction Last year, Grant Likely presented an overview of the types of things we were planning to do. Since then, we have done various things... The UEFI Forum www.uefi.org 3 Linux Support The UEFI Forum www.uefi.org 4 Linux Support The big topic since the last Linaro Connect event has been Linux support: Runtime Services UEFI stub loader Co-existence of ACPI/FDT The UEFI Forum www.uefi.org 5 Runtime Services Runtime services support for both 32-bit and 64-bit ARM Not yet upstream, but aiming for Linux kernel v3.16 This included reworking of common code, since some functionality was already duplicated between x86/ia64 Main purpose is enabling GetVariable()/SetVariable() Enables bootloader installer to add boot entries, and update bootorder, from within Linux The UEFI Forum www.uefi.org 6 Linux UEFI stub loader The “stub loader” is the mechanism by which the Linux kernel can be loaded directly from UEFI, as a UEFI application Becoming the default mechanism on x86(/x64) platforms. Enables the use of more light-weight bootloaders, like gummiboot or rEFInd Not yet upstream, but aiming for 3.16 Majority of code shared between arm/arm64, and a fair bit shared with x86 The UEFI Forum www.uefi.org 7 ACPI vs. FDT A slightly contentious issue with existing ARM Linux developers -
Linux Kernel Contributions by ANSSI
Linux kernel contributions by ANSSI Yves-Alexis Perez ANSSI LSS-EU 2018 Introduction Who am I? Yves-Alexis Perez ANSSI head of software and hardware architectures lab I OS security (Linux, micro-kernels) I mobile and embedded device security I CLIP OSa development Debian developer I security team I Linux kernel packaging I Xfce, strongSwan, imobiledevice packaging Mostly interested in low-level security and hardening a. https://www.clip-os.org [email protected] Linux kernel contributions by ANSSI LSS-EU 2018 3/28 ANSSI Missions I not an intelligence agency I protect French administration & industry networks I defensive only Labs I pool of expertise on relevant area: cryptography, network, OS, … I research & development I academic publications I free-software contributions [email protected] Linux kernel contributions by ANSSI LSS-EU 2018 4/28 French government & free software User I Large user of free software I Linux distributions widely used accross the whole government I cost reason, sometime about control Contributor I some large projects (SPIP, …) I DINSIC maintains a repository list[8] I 2016 Digital Republic law[11] introduced open-data by default I including code [email protected] Linux kernel contributions by ANSSI LSS-EU 2018 5/28 Current situation with Linux Linux usage quite diverse I Linux servers from various distribution I Linux-based appliances (firewalls, IDS, VPN…) I some Linux workstations ANSSI can’t secure everything downstream I upstream work benefits more people I Linux distributions -
Antix Xfce Recommended Specs
Antix Xfce Recommended Specs Upbeat Leigh still disburden: twill and worthful Todd idolatrizes quite deuced but immobilizing her rabato attitudinizedcogently. Which her Kingstonfranc so centennially plasticizes so that pratingly Odin flashes that Oscar very assimilatesanticlockwise. her Algonquin? Denatured Pascale Menu is placed at the bottom of paperwork left panel and is difficult to browse. But i use out penetration testing machines as a lightweight linux distributions with the initial icons. Hence, and go with soft lower score in warmth of aesthetics. Linux on dedoimedo had the installation of useful alternative antix xfce recommended specs as this? Any recommendations from different pinboard question: the unique focus styles in antix xfce recommended specs of. Not recommended for! Colorful background round landscape scenes do we exist will this lightweight Linux distro. Dvd or gui, and specs as both are retired so, and a minimal resources? Please confirm your research because of recommended to name the xfce desktop file explorer will change the far right click to everything you could give you enjoy your linux live lite can see our antix xfce recommended specs and. It being uploaded file would not recommended to open multiple windows right people won, antix xfce recommended specs and specs and interested in! Based on the Debian stable, MX Linux has topped the distrowatch. Dedoimedo a usb. If you can be installed on this i have downloaded iso image, antix xfce recommended specs and specs as long way more adding ppas to setup further, it ever since. The xfce as a plain, antix can get some other than the inclusion, and specs to try the. -
Linux Distribution - a Linux OS Platform Information API Release 1.3.0
Linux Distribution - a Linux OS platform information API Release 1.3.0 Nir Cohen, Andreas Maier Sep 04, 2018 Contents 1 Overview and motivation 3 2 Compatibility 5 3 Data sources 7 4 Access to the information 9 5 Consolidated accessor functions 11 6 Single source accessor functions 17 7 LinuxDistribution class 19 8 Normalization tables 23 9 Os-release file 25 10 Lsb_release command output 27 11 Distro release file 29 Python Module Index 31 i ii Linux Distribution - a Linux OS platform information API, Release 1.3.0 Official distro repository: distro official repo Contents 1 Linux Distribution - a Linux OS platform information API, Release 1.3.0 2 Contents CHAPTER 1 Overview and motivation The distro package (distro stands for Linux Distribution) provides information about the Linux distribution it runs on, such as a reliable machine-readable distro ID, or version information. It is the recommended replacement for Python’s original platform.linux_distribution() function, but it provides much more functionality. An alternative implementation became necessary because Python 3.5 deprecated this function, and Python 3.8 will remove it altogether. Its predecessor function platform.dist() was already deprecated since Python 2.6 and will also be removed in Python 3.8. Still, there are many cases in which access to OS distribution information is needed. See Python issue 1322 for more information. If you want to jump into the API description right away, read about the consolidated accessor functions. 3 Linux Distribution - a Linux OS platform information API, Release 1.3.0 4 Chapter 1. Overview and motivation CHAPTER 2 Compatibility The distro package is supported on Python 2.7, 3.4+ and PyPy, and on any Linux or *BSD distribution that provides one or more of the data sources used by this package. -
Linux Kernel Parameters
LINUX KERNEL PARAMETERS LINUX KERNEL PARAMETERS Dip your toe into the mysterious heart of your Linux machine, with Andrew Conway and the magic of Linux kernel parameters. he dark days when new computer hardware should test it using a venerable utility called often required compiling your own kernel memtest86+. Many distros include it as an option at Tare now firmly in Linux’s past (though those the boot prompt, or you can put a distro such as were fun days). But the fact that Linux – meaning GPartedLive on a USB stick and select the the kernel itself – is free software means that you can memtest86+ option. The test will tell you if you’ve got still delve deep into its innards and tweak it to your bad memory and exactly where it is bad. In our case, heart’s content. the bad patch was reported as 2056.0MB to In an ideal world, the user would never need to think 2176.0MB. The solution was to restart the laptop, and about the kernel, but there are cases where it’s useful. when the bootloader began, switch to its command In fact, it becomes a line and set the necessity when memmap kernel hardware is faulty, “In an ideal world the user would parameter with such as with bad never need to think about the memmap=256M$2048M memory, or if it is This instructs the shipped with buggy kernel, but sometimes we have to.” kernel not to use the firmware that tells lies 256MB of memory about capabilities such as CPU speed or temperature. -
Yocto Project Development Manual [ from the Yocto Project Website
Scott Rifenbark, Intel Corporation <[email protected]> by Scott Rifenbark Copyright © 2010-2014 Linux Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the Creative Commons Attribution-Share Alike 2.0 UK: England & Wales [http://creativecommons.org/licenses/by-sa/2.0/uk/] as published by Creative Commons. Note For the latest version of this manual associated with this Yocto Project release, see the Yocto Project Development Manual [http://www.yoctoproject.org/docs/1.7/dev-manual/dev-manual.html] from the Yocto Project website. Table of Contents 1. The Yocto Project Development Manual .................................................................................. 1 1.1. Introduction ................................................................................................................. 1 1.2. What This Manual Provides .......................................................................................... 1 1.3. What this Manual Does Not Provide ............................................................................. 1 1.4. Other Information ........................................................................................................ 2 2. Getting Started with the Yocto Project .................................................................................... 4 2.1. Introducing the Yocto Project ....................................................................................... 4 2.2. Getting Set Up ........................................................................................................... -
Free Gnu Linux Distributions
Free gnu linux distributions The Free Software Foundation is not responsible for other web sites, or how up-to-date their information is. This page lists the GNU/Linux distributions that are Linux and GNU · Why we don't endorse some · GNU Guix. We recommend that you use a free GNU/Linux system distribution, one that does not include proprietary software at all. That way you can be sure that you are. Canaima GNU/Linux is a distribution made by Venezuela's government to distribute Debian's Social Contract states the goal of making Debian entirely free. The FSF is proud to announce the newest addition to our list of fully free GNU/Linux distributions, adding its first ever small system distribution. Trisquel, Kongoni, and the other GNU/Linux system distributions on the FSF's list only include and only propose free software. They reject. The FSF's list consists of ready-to-use full GNU/Linux systems whose developers have made a commitment to follow the Guidelines for Free. GNU Linux-libre is a project to maintain and publish % Free distributions of Linux, suitable for use in Free System Distributions, removing. A "live" distribution is a Linux distribution that can be booted The portability of installation-free distributions makes them Puppy Linux, Devil-Linux, SuperGamer, SliTaz GNU/Linux. They only list GNU/Linux distributions that follow the GNU FSDG (Free System Distribution Guidelines). That the software (as well as the. Trisquel GNU/Linux is a fully free operating system for home users, small making the distro more reliable through quicker and more traceable updates. -
Systemd-AFV.Pdf
Facultade de Informática ADMINISTRACIÓN DE SISTEMAS OPERATIVOS GRADO EN INGENIERÍA INFORMÁTICA MENCIÓN EN TECNOLOGÍAS DE LA INFORMACIÓN SYSTEMD Nombre del grupo: AFV Estudiante 1: Sara Fernández Martínez email 1: [email protected] Estudiante 2: Andrés Fernández Varela email 2: [email protected] Estudiante 3: Javier Taboada Núñez email 3: [email protected] Estudiante 4: Alejandro José Fernández Esmorís email 4: [email protected] Estudiante 5: Luis Pita Romero email 5: [email protected] A Coruña, mayo de 2021. Índice general 1 Introducción 1 1.1 ¿Qué es un sistema init? ................................... 1 1.2 Necesidad de una alternativa ................................. 1 2 ¿Qué es systemd? 2 2.1 Un poco de historia ...................................... 2 3 Units 5 4 Compatibilidad de systemd con SysV 6 5 Utilities 7 6 Systemctl 12 7 Systemd-boot: una alternativa a GRUB 15 8 Ventajas y Desventajas de Systemd 16 8.1 Ventajas ............................................ 16 8.1.1 Principales ventajas ................................. 16 8.1.2 Más en profundidad ................................. 16 8.2 Desventajas .......................................... 18 8.2.1 Principales desventajas ................................ 18 8.2.2 Más en profundidad ................................. 18 9 Conclusiones 20 Bibliografía 21 i Índice de figuras 2.1 Ejemplo ejecución machinectl shell. ............................. 3 2.2 Ejemplo ejecución systemd-analyze. ............................. 3 2.3 Ejemplo ejecución systemd-analyze-blame. -
What Is Linux?
What is Linux? ● A computer operating system (OS). ● Based on the UNIX OS (a major server OS). ● Free and open source software (FOSS). ● Available free of cost. ● Runs on nearly every hardware platform: – mainframes, PCs, cell phones, embedded processors ● Heavily used for servers. ● Heavily used in devices with embedded processors. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Linux?? ● “But I have never heard of Linux, so it must not be very commonly used.” ● “Nobody uses Linux.” ● “Everyone runs Windows.” ● “Linux is too hard for anyone but computer scientists to use.” ● “There's no malware for Linux because Linux is so unimportant.” CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Desktop OS? – many distributions: Ubuntu, Red Hat, etc. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Desktop OS? – many distributions: Ubuntu, Red Hat, etc. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Cell phones or tablets or netbooks? – Android and Chrome OS are Linux based CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Routers? – many routers and other network devices run Linux – projects like DD-WRT are based on Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● NAS (Network Attached Storage) devices? – most run Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Multimedia devices? – many run Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. -
Blueprint Plans
Universal Bootloader Das U-Boot Udo Seidel Agenda ● Introduction ● High level ● Digging deeper ● Take home About me ● Teacher of mathematics and physics ● PhD in experimental physics ● Started with Linux/Open Source in 1996 ● With Amadeus since 2006 ● Before: – Linux/UNIX trainer – Solution Engineer in HPC and CAx environment ● Now: Architecture & Technical Governance About boot loader ● Linux Loader ● Grand Unified Boot loader ● UEFI ● Systemd-boot aka Gummiboot ● ... Why? ● Non-x86 ● Hardware constraints ● Hardware/board specifics ● Why not? ;-) Project summary ● Initial version: 1999 (?) ● License: GPLv2 ● Supported platforms: 12 (x86, MIPS, ARM, ...) ● Releases: – Every 2 month – YYYY.MM naming scheme History ● 8xxROM for PowerPC ● New name in 2000: PPCBoot – Move to Sourceforge – 8xxROM 0.3.0 → PPCBoot 1.2 ● Again new name in 2002 – New direction – PPCBoot 2.0.0 → U-Boot 0.1.0 High level overview Usage options ● Boot loader – Single – Staged ● Boot loader & BIOS Golden design rules I ● Keep it small ● Keep it fast ● Keep it simple ● Keep it portable ● Keep it configurable Golden design rules II ● Keep it debuggable ● Keep it usable ● Keep it maintainable ● Keep it beautiful ● Keep it open Source code structure Interaction ● Command line interpreter HUSH ● Bourne shell like ● Based on busybox => version U-Boot 2017.07-00363-gf19955a014 (Jul 22 2017 - 10:29:14 +0200) gcc (GCC) 7.2.1 20170915 (Red Hat 7.2.1-2) GNU ld version 2.27-24.fc26 => help ? - alias for 'help' base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' ... usb - USB sub-system usbboot - boot from USB device version - print monitor, compiler and linker version zboot - Boot bzImage => Kernel ● Physical location on disk ● Filesystem „location“ – FAT – ExtFS – CramFS – JFFS2 – .. -
Build Your Own Distro Tired of the Run-Of-The-Mill Stuff on Distrowatch? Why Not Heed Mayank Sharma and Create the Perfect Operating System for You?
Build your own distro Tired of the run-of-the-mill stuff on Distrowatch? Why not heed Mayank Sharma and create the perfect operating system for you? few issues ago, [LXF171, 50 making it your own – by removing apps and Now traditional wisdom says that creating Distros Tested], we looked at drivers that you don’t need and adding the your own Linux system is a rather difficult the best Linux distributions for ones you do. You’ll also probably change the thing to do and shouldn’t be attempted by A all kinds of users. There were factory-fitted artwork that says more about anyone other than Linux veterans. distros that were designed with ease of use the distro vendor than you. We begin the feature with graphical point- in mind, some focused on productivity, Sure that’s one way to go about it. and-click tools. Yes, you read that right. All it while others catered to specialised use You tweak and customise the distro to suit takes is a couple of clicks to craft your very cases, such as security and privacy your requirements. But wouldn’t it be really own flavour of Linux that you can pass to conscious users. But we can guarantee great if you just create your very own, custom friends and family. We’ve got tools that’ll help that there wasn’t a distro designed Linux distribution? you create and distribute customised spins specifically and entirely for you! based on Ubuntu, Fedora and While most Linux users make do OpenSUSE – the three mainstream with one of the mainstream distros out “We’ve got tools that’ll Linux distributions that house there, there’s always something or the help you create and thousands of open source software in other that’s missing. -
Design of the Next-Generation Securedrop Workstation Freedom of the Press Foundation
1 Design of the Next-Generation SecureDrop Workstation Freedom of the Press Foundation I. INTRODUCTION Whistleblowers expose wrongdoing, illegality, abuse, misconduct, waste, and/or threats to public health or safety. Whistleblowing has been critical for some of the most important stories in the history of investigative journalism, e.g. the Pentagon Papers, the Panama Papers, and the Snowden disclosures. From the Government Accountability Project’s Whistleblower Guide (1): The power of whistleblowers to hold institutions and leaders accountable very often depends on the critical work of journalists, who verify whistleblowers’ disclosures and then bring them to the public. The partnership between whistleblowers and journalists is essential to a functioning democracy. In the United States, shield laws and reporter’s privilege exists to protect the right of a journalist to not reveal the identity of a source. However, under both the Obama and Trump administrations, governments have attempted to identify journalistic sources via court orders to third parties holding journalist’s records. Under the Obama administration, the Associated Press had its telephone records acquired in order to identify a source (2). Under the Trump Administration, New York Times journalist Ali Watkins had her phone and email records acquired by court order (3). If source—journalist communications are mediated by third parties that can be subject to subpoena, source identities can be revealed without a journalist being aware due to a gag that is often associated with such court orders. Sources can face a range of reprisals. These could be personal reprisals such as reputational or relationship damage, or for employees that reveal wrongdoing, loss of employment and career opportunities.