Open Source Summit Europe 2024

Despite all controversies, Rust in recent times has gained popularity as the second Linux kernel high-level language. There’s been discussions about its applicability in various kernel subsystems which yielded tentative conclusions. People have been advised by kernel gurus to use Rust for subsystem implementations rather than for drivers, and the author totally shares that stance. With that said, the author had a zswap backend called zblock ready for but still not accepted into the mainline, so the idea came naturally: to rewrite it in Rust and compare performance and complexity of the two implementations. Whichever wins gets submitted. This talk will cover the main principles of zblock (which stay the same no matter the language used), the obstacles the author met while implementing it in Rust, and finally the comparison of the two. It will be fun.

Landlock's goal is to make it possible for Linux applications to sandbox themselves. On Linux, many traditional access control mechanisms are only available to the system administrator, which do not follow the principle of least privilege. As a result, sandboxing policies were created independently of an actual program execution, leading to unnecessarily broad policies. With Landlock, unprivileged processes can safely create sandboxing policies well-tailored to the expected needs of a running application. Landlock also solves the organizational aspect of keeping policy and software in sync with each other, by putting the policy definition and maintenance in the developer's hands. In this talk, we explain how Landlock works and how it can be used to protect Linux users, without being noticed, except by attackers.

IT infrastructure is all over the place: Cloud VPC's, edge servers, data centers, office networks, and more. Much of it exists on private networks or behind routers and firewalls. IT administrators are often tasked with making these resources available over the internet to employees or remote servers that are elsewhere on earth. In this tutorial, we'll use just a couple of VM's running Linux and WireGuard to set up a minimal, secure, and easily-maintainable remote access system. We'll demonstrate with a fictional business that has a physical office, uses the cloud, and has remote IT staff, an extremely common scenario. We'll walk attendees through: 1. How to set up secure access to the office network from the remote staffs' workstations. 2. How to establish access to a cloud VPC from servers in the office network. 3. How to account for corporate firewalls and other common networking challenges. By the end of this tutorial, attendees will have a good understanding of how they can use Linux and WireGuard in common IT networking scenarios.

The Cyber Resilience Act is reshaping the landscape for Yocto-based products. Join us as we navigate the implications of this ever-changing legislation. • Introduction to the Cyber Resilience Act: an overview of the CRA, its objectives, and its relevance to the IoT and embedded systems industry. • Understanding the Key Provisions of the CRA/CSA that are relevant to Yocto-based product developers. • Yocto Project and Security Compliance: how Yocto supports security measures, including secure boot, code signing, and vulnerability management. • Regulatory and Compliance Challenges: the challenges and complexities associated with complying with cybersecurity regulations in the embedded systems space. • Building Secure Yocto-Based Products: best practices for building secure Yocto-based products that align with the CRA's requirements. • Impact on Product Development Lifecycle: how the Act affects different stages of the Yocto-based product development lifecycle.

Testing is an integral part of the software lifecycle. For software which are in continuous development it's even more important to have regular testing so that any bugs or errors can be detected early. In this talk, I will present how I started testing the Linux Kernel in a personal capacity and the status of Kernel testing that is now being done as part of Codethink. I will also present how that testing infrastructure has evolved to test Debian Sid on a RPI4 from a CI pipeline and the problems we had to overcome. That same infrastructure is now being modified to test Yocto from a gitlab CI pipeline.