# 2017-06-21 Time: **9am PDT** (12pm EDT, 5pm BST) [see the time in your timezone](https://www.timeanddate.com/worldclock/fixedtime.html?msg=Linuxkit+Security+SIG&iso=20170621T09&p1=224) Meeting location: https://docker.zoom.us/j/779801882 Announcement: [Moby project forum post](https://forums.mobyproject.org/t/2017-06-21-linuxkit-security-sig-meeting/74) Video recording: https://youtu.be/TN3p7dR7r3M Previous meeting notes: [2017-06-07](2017-06-07.md) ## Agenda - Introductions & Administrivia (5 min) - signing: followup on last meeting's buildchain security discussion (15 min) - current state of signing in LinuxKit, explanation of delegations for auditing - propose pinning, policy, removing signatures - `landlock` deep dive - @l0kod (30 min) - What is it Landlock LSM? What is eBPF? Why do we care? - current state of the project, future patchsets and direction - architecture deep dive - demo - Project updates (10 min) - Next meeting: 2017-07-05 - deep dive TBD - we can propose additional deep dives and discussion topics! ## Meeting Notes Scribe: @mgoelzer - Next meeting July 5 - Recap of Moby Summit - slides for [linuxkit update](https://docs.google.com/presentation/d/1Y4ZI2r-O8NNp3geq0Q_Ud07YnhTX6G7Q2T_iaeWnAME/edit#slide=id.g1e55e362fb_0_0) and [linuxkit security](https://docs.google.com/presentation/d/1ld5nUgPKMEwaiR7EgGPJeJU29YZkww8e_9Aa1ONSXvs/edit), videos coming soon - Lots of bare metal linuxkit interest - auditd requested - Another Summit at Open Source Summit in LA - Package Signing - Based on Notary (based on The Update Framework) - implemented in Docker Content Trust in Docker CLI - all `linuxkit/` images on Docker Hub are signed by maintainers - Guarantees: - authenticity - integrity - freshness - survivability after key compromise - Linuxkit yaml files container `trust:` block - tells moby builder that you want to verify all images in a given organization or per image control - Moby builder will first check the signatures for all images and validate expiration dates before pulling images - Future directions: - key pinning for signed packages - enforce multi-sig thresholds actively remove sigs for old packages (or let them expire) - private notary servers - Landlock LSM (presentation by @l0kod) - [Presentation slides here](https://landlock-lsm.github.io/talks/2017-06-21_landlock-linuxkit-sig.pdf) - Threat: compromised processes (like browsers) -> privilege escalations -> access data on the system - Today we have: - access control through SELinux (fine grained) - seccomp-bpf (not an AC mechanism) - namespaces - Landlock is trying to do three things: - fine grained control - unprivileged - embedded in applications - Landlock = programmatic access control - Landlock rules: - written in C - compiled down to eBPF bytecode - embedded in application - application executes - Landlock rule loaded into running kernel - Example: rule that says application cannot write to files but can write to FIFOs - Key data structure: `struct landlock_context` - Overview of eBPF (extended Berkeley Packet Filtering) - In-kernel bytecode - For network filtering, tracing - Landlock Roadmap: - MVP - cgroups - new eBPF maps for fs checks - unprivileged mode