Open Source And Linux

Locking Down Your Systemd Services

systemd is the system and service manager of most of today's popular Linux distributions. This talk will focus on security features of systemd, that help developers and administrators to lock down system services in powerful ways, in order to build a more secure Operating System. Topics covered are: file system namespace features for services, networking lock-in, seccomp sandboxing, Linux security capabilities, integration with MAC security and many more. The talk will explain how many default services shipped in the various Linux distributions already make use of these security features to minimize impact of services, and how developers, devops engineers and administrators can enable this features easily for their own services, with just a few settings.

About speaker:

Lennart Poettering works at Red Hat in the Server Experience Group. He's one of the creators of PulseAudio, Avahi and systemd.

Forwarding syscalls to userspace in containers

Containers are ever popular, and are increasingly presented as an alternative to virtual machines. However, there are some obvious gaps in the API available to containers vs. what's available to root on the host. For example, containers cannot safely load kernel modules, or mount arbitrary filesystems. In this talk, Tycho will present a kernel patchset in development for passing syscalls off to a userspace handler, which can perform actions on behalf of the task that performed the syscall. For example, if a container tries to load a kernel module, the userspace daemon might check that the module is in a whitelist, and load the host's version of the module instead. The container is safely allowed to load kernel modules, whereas before it was not.

About speaker:

Tycho is an engineer at Cisco working Linux platforms. He holds degrees from the University of Wisconsin--Madison and Iowa State University, and has co-authored several peer-reviewed papers. In his spare time he rides bikes and does improv comedy. Tycho has been fortunate to speak at a number of industry conferences including linux.conf.au, Linux Plumber's Conference, Linux Piter, OpenStack Summit, ContainerCon, Docker Con (EU), Linux Con (EU), etc. as well as give industry keynotes at academic conferences like IEEE's I2CE.

Filesystem mounts in user namespaces

User namespaces have become one of the most important security features for container workloads. But since they can be created by any user on the system they restrict access to a wide range of features including mounting of filesystems. In recent years a lot of work went into making mounts of filesystems from non-initial user namespaces safe. Starting with kernel 4.18 it is possible to mount FUSE filesystems in user namespaces. It is expected that overlayfs will follow in future kernel releases. In this talk we will take a closer look at the infrastructure that was added to the kernel, the underlying security mechanisms, and upcoming filesystems that might be available to unprivileged containers in the future.

About speaker:

Christian Brauner is a core developer and maintainer of the LXD and LXC projects. He works mostly upstream as part of the Ubuntu Server team on lower-level problems. He’s been active in the open source community for a long time and is a frequent speaker at various large Linux events; he is also strongly committed to working in the open, and a strong proponent of Free Software.

Locking Down Your Systemd Services

This talks shows you how GNOME tries to be ahead of the curve regarding potential security and privacy breaches. Sandboxing and containerisation have been big topics over the last development cycles and we are happy to present the result which we hope improves various aspects of using your GNU/Linux machine. For one, we have created a technology for sandboxing applications which makes computing more secure as it confines the application and mitigates harm done by buggy or even malicious apps. But it also brings application developers closer to the users by shortcutting the traditional software distributions. While this has its shortcomings it's generally seen as an improvement and I'm happy to discuss, why. Another area of sandboxing is thumbnailing as a service for desktop applications. Traditionally, desktop systems try to display files more nicely by presenting a thumbnail of the file content. The code which produces the actual thumbnail traditionally ran with full privileges of the user session. With sandboxing, this is a thing of the past. We are now running thumbnailers (also third party ones) in a confined environment which mitigates many of the bad side effects an attacker can cause when exploiting a badly written file parser.

About speaker:

Tobias Mueller is a lead member of the GNOME Bugsquad for the last years and thus responsible for managing the bug database as well as the team around it. He is involved in deciding on effective policies for the bug database, actually dealing with the bugs in the database and recruiting new members who will help triaging. He also got elected to the Board of Directors in 2012 where he serves the GNOME Foundation to achieve their goals of creating and distributing great Free Software products. Besides being a Free Software and GNOME lover, Tobias is involved in the German security research community around the Chaos Computer Club. Topics of interest include Platform- and System-Security, Cryptography and Security Protocols.

Development of Linux kernel, from what to begin?

About speaker:

Andriy has over ten years of software development experience in Linux environment, especially in a serial bus drivers area in the kernel programming. During this time he has contributed hundreds of patches to the Linux kernel. In his current position, he has been designing and developing a glue layer between ACPI and pin control framework.

Go as a scripting language in Linux

Are you a fan of Go? Do you like Go so much and use it in every software project? Do you think Go is a truly universal language? How about taking it to the next level and trying Go as a scripting language for your favourite Linux distribution?

About speaker:

Ignat is a systems engineer at Cloudflare working mostly on platform and hardware security. Ignat’s interests are cryptography, hacking, and low-level programming. Before Cloudflare, Ignat worked as senior security engineer for Samsung Electronics’ Mobile Communications Division. His solutions may be found in many older Samsung smart phones and tablets.

Amazon RDS Monitoring

AWS має managed рішення для запуску MySQL баз даних - Amazon RDS for MySQL та Amazon Aurora. Такі рішення маюсь свої переваги - можна запустити базу даних в декілька кліків, не потрібно переживати за high availability, встановлення апдейтів, налаштування бекапів та відновлення з них. Але такі рішення як чорний ящик, адміністратори не мають доступу до операційної системи. Отже performance моніторинг таких систем нетривіальний, але можливий.

About speaker:

AWS Certified Solutions Architect Professional
Mykola is monitoring lover and has been developing monitoring systems since 2004. He has been working as Release Engineer/DevOps for 10 years and most of his career has focused on automation of release procedures and infrastructure, development of monitoring, update and deployment systems.

Elliptic curves made easy або еліптичні курви, легкі й доступні

Gentle introduction to elliptic curves (EC) cryptography: math overview, comparsion to RSA, base operations; EC key pairs; ECDSA, ECDH, signing and encryption with EC. Presentation of C++ and Java opensource libraries of EC with very simple intrafce but military-grade cryptogrphy inside.