Linux Security Summit 2021

Code integrity is widely recognized as one of the most effective security mitigations for modern threats, especially those targeting high-value systems. However, code integrity policies typically apply to an entire system, which may not be possible depending on the system's workload. This presentation will cover the newest update to Integrity Policy Enforcement (IPE), namespaces, which allows system builders to apply a code integrity namespace to a specific process and all of its descendants, allowing more targeted policy enforcement for systems such as docker hosts. There will be a live, proof-of-concept example, demonstrating its functionality. The presentation will work through an example where a system's workload is not acceptable for full-integrity verification, and how that issue is solved through namespaces, and some of the more interesting design decisions around the namespace implementation within IPE.