Introducing Linux integrity mechanisms and how they can help to protect the container runtime security.
Linux Integrity Mechanisms, such as Integrity Measurement Architecture (IMA) and Extended Verification Framework (EVM), were implemented in the Linux kernel for many years. Currently, almost all Linux-based systems ranging from the embedded system running Android to Enterprise and Data Center systems have adopted IMA and EVM.
With the prevalent of Container, the security of the container runtime is gaining more and more attention. To solving the security challenges of the container runtime, we could leverage IMA and EVM in the Linux kernel.
In this talk, I will explore the security challenges of the container runtime, walkthrough IMA, and EVM, and introduce the use of IMA and EVM to protect the container runtime. We can see how those mature integrity mechanisms help in the case of container runtime.
About Clay Chang
Researcher and Engineer, with interests in designing system software utilizing emerging software and hardware technology.