Linux Security Summit North America 2017

System security is a big challenge faced by all of everyone these days and Linux has a considerable array of built-in security mechanisms and sub-systems. However, system security is determined not by a single component but by the overall security of the software and the hardware as an integrated unit and how well the two are integrated together. A hardware capability which has the potential to increase system security will only do so if the software makes good use of it. This talk will describe the work the author is doing in driving better integration between hardware security provider components and the relevant Linux subsystems – from verified boot and root of trust services, via better storage security via DM-Crypt and DM-Verity to key management and TEE integration and how the kernel can evolve to offer better generic support of hardware capabilities in this area.