Download as PDF, PPTX
Uploaded byKernel TLV
Present Absence of Linux Filesystem Security
The document discusses the challenges and gaps in Linux filesystem security, highlighting issues such as the context of operations, unusual operations, and destructive actions. It outlines fundamental security concepts like permissions and capabilities while noting the limitations of existing solutions. Recommendations for addressing these issues are suggested, inviting further contact for detailed discussions.
Present Absence of Linux Filesystem Security
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10. Recap of FS Security 1. Read/Write/Execute 2. Inheritance 3.Only “Allow” permissions
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17. LSM to the rescue ??? Issues: - Not mandatory - Single active module -Kernel compilation - Limited Hooks
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32. Destructive Operations – ShieldFS assumptions/findings 1.# of folder listing operations 2. # of read files 3. # of written files 4. # of renamed or moved files 5. # of accessed files 6. Average entropy of file-write operations
- 33.
- 35. contact@enSilo.com www.ensilo.com company/enSilo@enSiloSec Thank You
- 36.