The document discusses the kernel security features present in the 2.6 Linux kernel and outlines potential future enhancements for version 2.7 and beyond. Key features include SELinux, audit frameworks, and integration with resource management and virtualization. Additionally, it suggests improvements such as signed modules, better capabilities, and expanded applications for Linux Security Modules (LSM).

1. Kernel Security for 2.8
Linux Kernel Summit
Ottawa 2004
James Morris, Red Hat

2. Current Status
Several security features in 2.6:
● LSM
● Crypto API (software)
● Cryptoloop
● dm-crypt
● IPSec
● SELinux (MAC, RBAC)
● NX
● Audit Framework
● Syscall Auditing
Discussion?

3. Potential Future Directions (2.7+)
● SELinux:
● MLS (multilevel security)
● Labeled networking
● Integration with resource management
● NFSv4 integration
● Virtualization:
● Increased isolation
● Polyinstantiation
● Hardware Crypto API
● Kernel keyring management
● More LSM applications?
● Continued refinement of Netfilter
● Signed modules (2.6?)
● Signed binaries
● Exec-shield (2.6?)
● TPM
● LT
● Better capabilities (Chris Wright)
● Separate out DAC (Chris Wright)