Microsoft Aims For Greater Script Execution Control On Linux

This week alongside several other Linux Foundation events in Vancouver was the Linux Security Summit. Commanding a significant presence at the Linux Security Summit was Microsoft.

The Linux Security Summit this week featured talks by systemd creator Lennart Poettering who has been employed by Microsoft the past year as well as various other Microsoft engineers with efforts they are taking to enhance Linux security. Yes, the irony.

One of the interesting talks at LSS NA 2023 was by Microsoft's Mickaël Salaün on how they are working on new means of controlling script execution on Linux systems. From new open flags to new kernel system calls they are working on allowing Linux system administrators greater control over what scripts could be executed on Linux systems in the future.

Those interested in the script execution control topic can see this PDF slide deck from the presentation. In addition to the O_MAYEXEC flag, faccessat2() flags, and the trusted_for() system call, Microsoft is working on a new "EXECVE_OK" and "AT_EXECVE_COMPAT" proposal that should be published soon for comments. The talk laid out that controlling script execution is being targeted for user security and not about removing a user's ability to execute scripts.

There was also a presentation by Microsoft's Mickaël Salaün for hypervisor-enforced kernel integirty based on KVM. You can see those slides here.

Other presentation slides and more details on this week's Linux Security Summit North America can be found via events.linuxfoundation.org.