I'm moving this site to a new location, http://www.paul-moore.com/blog, please update your bookmarks.

I gave a brief presentation on virtualization security at the Linux Plumbers Conference this year as well as a lightning talk on seccomp/libseccomp at the Linux Security Summit. The slides for both presentations are available below.

Virtualization Security Discussion: http://www.paul-moore.com/files/lj/virt_security-pmoore-lpc2012-r1.pdfSyscall ( Read more... )

Just a few minutes ago we announced the second release of the libseccomp library, version 1.0.0. The libseccomp library is designed to provide an easy to use, platform independent, interface the Linux's syscall filtering mechanism: seccomp.

Significant changes in this release include:

• The API is now context-aware; eliminating all internal state but ( Read more... )

One of the most common complaints I hear about the labeled networking access controls in Linux is that users don't know how to configure them for their given scenario. To help solve that problem I'm going to try and document some basic use cases and the associated labeled networking "configuration recipes".

To start off, I'm going to tackle a ( Read more... )

Perhaps one of the largest shortcomings of the CIPSO network labeling protocol when used with SELinux is the fact that it can only convey the SELinux MLS attributes across the network.  There are plenty of good reasons for this: strict conformance with protocol specification, limited space in the IPv4 header, interoperability with non-SELinux ( Read more... )

This morning we announced the first release of the libseccomp library, version 0.1.0. The libseccomp library is designed to provide an easy to use, platform independent, interface the Linux's syscall filtering mechanism: seccomp. Linux Weekly News wrote up a nice summary of the project that I would encourage you to read as it provides a basic ( Read more... )

We just closed the doors on the 2011 Linux Security Summit a few hours ago and I wanted to jot down a few notes while everything was still fresh in my mind. Once again, a big thanks to all of our presenters, James Morris and the rest of the organizing committee; my personal opinion is that the summit was a success this year and I look forward to ( Read more... )

To add to the recent email updates, I thought I would mention that I'm now on twitter too at @paul_via_tweet. Not much there right now, but since all the "cool kids" are on the twitter these days, how could I resist?

Hello again, last week I made a quick post to say that my @hp.com email address was going away; the reason for that, as many had guessed, was that I was leaving HP for a new employer. As of this past Monday, August 8th, 2011, I'm happy to say that I am now working for Red Hat. This should be good news for anyone interested in the Linux labeled ( Read more... )

Just a quick update to let everyone know that my @hp.com email address is going to stop working on Friday, August 5, 2011. If you need to get in touch with me please send me email at paul@paul-moore.com.