Microsoft announces IPE, a new code integrity feature for Linux

guest · Apr 7, 2020

Microsoft announces IPE, a new code integrity feature for Linux
April 7, 2020
https://www.zdnet.com/article/microsoft-announces-ipe-a-new-code-integrity-feature-for-linux/

Microsoft published this week details about a new project the company has been working for the Linux kernel.

Named Integrity Policy Enforcement -- or IPE -- the project is a Linux security module (LSM). LSMs are optional add-ons for the Linux kernel that enable additional security features.
According to a documentation page published on Monday, IPE is Microsoft's attempt to solve the code integrity problem for Linux -- an operating system the company broadly uses in its Azure cloud service.

On Linux systems where IPE is enabled, system administrators can create a list of binaries that are allowed to execute and then add the verification attributes the kernel needs to check for each binary before allowing it to run. If binaries have been altered by an attacker, IPE can block the execution of the malicious code.
Click to expand...

NOT INTENDED FOR THE GENERAL LINUX USERBASE
Microsoft says that IPE is not intended for general-purpose computing. The IPE LSM was designed for very specific use cases where security is paramount, and administrators need to be in full control of what runs on their systems.

Microsoft has published today the specs for the new IPE module. The IPE is currently in an RFC (request for comments) state. It will take some time before it ships with the actual Linux kernel.

The Linux kernel already includes a LSM for code integrity, named Integrity Measurement Architecture (IMA). Microsoft said that IPE differs from IMA because "it has no dependency on the filesystem metadata" and because IPE attributes "are deterministic properties that exist solely in the kernel," meaning IPE doesn't need additional code like IMA needs IMA signatures.
Click to expand...

Log in or Sign up

Microsoft announces IPE, a new code integrity feature for Linux

guest Guest

Log in or Sign up

Microsoft announces IPE, a new code integrity feature for Linux

guest Guest

Useful Searches