"Present Absence - A character who does not appear for much of or all of the plot, but whose absence is most significant." Linux filesystem security had appeared before security was an issue. It stagnated for a long time, while the world changed. A look from the trenches on what is there, what the problems are and what is missing. Older than he looks, Philip Derbeko has been programming for over 20 years. He was using Linux since days of Slackware 3.0 with kernel 2.0 Most of the years worked on storage, security systems and machine learning. Currently, develops and herds a team of Linux, OS X and Windows kernel developers at enSilo. YouTube: https://www.youtube.com/watch?v=IC-Uf96aUj4

1. Present Absence of
Linux Filesystem Security
Philip Derbeko
January, 2018

2. About Me (philip@ensilo.com)

3. Present Absence
A character who does not appear for
much of, if not all the plot, but whose
presence is nevertheless felt. More
accurately, the absence of the
character is most significant.

4. Recap of FS Security

5. Recap of FS Security

6. Recap of FS Security

7. Recap of FS Security

8. Recap of FS Security

9. Recap of FS Security

10. Recap of FS Security
1. Read/Write/Execute
2. Inheritance
3. Only “Allow” permissions

11. Recap of FS Security

12. Recap of FS Security

13. Privacy vs. Security

14. The “Root” of the problem
Permanent link to this comic: https://xkcd.com/149/

15. Capabilities Anyone?

16. Capabilities Anyone?

17. LSM to the rescue ???
Issues:
- Not mandatory
- Single active module
- Kernel compilation
- Limited Hooks

18. 3 Security Gaps
1.Context of operations
2.Weird Operations
3.Destructive Operations

19. Context of operations

20. Do you really know what is going on?

21. Do you really know what is going on?

22. Context of Operations

23. Weird Operations

24. Weird Operations

25. Weird Operations

26. Weird Operations

27. Destructive Operations

28. Destructive Operations

29. Destructive Operations
KillDisk –
encryption loop

30. Destructive Operations
Encoder –
encryption loop

31. Destructive Operations

32. Destructive Operations – ShieldFS assumptions/findings
1. # of folder listing operations
2. # of read files
3. # of written files
4. # of renamed or moved files
5. # of accessed files
6. Average entropy of file-write operations

33. Solution ?

35. contact@enSilo.com www.ensilo.com company/enSilo @enSiloSec
Thank You

36. Weird Operations