albinismtip

https://media.ccc.de/v/ASG2018-169-ke...

How to debug your crashed system

Kdump is a vital tool for debugging severe kernel crashes, especially if the failure can't be reproduced easily or an direct access to the system is not possible.



Kdump is a vital tool for debugging severe kernel crashes, especially if the failure can't be reproduced easily or an direct access to the system is not possible.

When an sever error happens in the kernel, a new crash kernel get loaded which saves the memory of the crashed system. These dump can be used to analyze the state of the machine and hopefully give insights on what has happened.

This talks will dive into the internals of kexec and kdump. How the crash kernel get set-up, how it's execution get triggered. We will also look into kexec-tool, the user-space part needed to set up a system to use kdump. Where necessary, the architectural specific details will be explained by looking at the arm64 implementation. This talk is thought for people who want to have an insight into how kdump is working.

Matthias Brugger

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-181-fl...



Flatpak is a desktop-focused application distribution and deployment
system for linux. This talk will walk through the technical
details of the core functionallity and explain how it work and
why it works that way.



Flatpak has now had a major stable release and the rate of change is
slowing down. This is a good time to take a look at how the
things work behind the scenes.


This talk will go through the technical details behind flatpak,
explaining things like ostree, bubblewrap and how flatpak uses this to
implement the sandbox and basic flatpak commands. It will also explain
in high-level terms how the portals and other desktop integration
features work.


Alexander Larsson

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-191-co...

Use cases and implementation challenges

Traceleft is a framework built upon eBPF which allows generation of system events such as file operations and network calls via a configuration driven system. It can act as a foundation for building auditing and incident analysis or monitoring tools that work at the system level and need targeted and filtered information. While traditionally, eBPF based analysis requires writing scripts in a limited C subset, Traceleft aims at providing a configuration based definition system events to be monitored over which filters can be set as required. This talk shares our experiences of developing Traceleft along with some use cases and challenges faced.

The tiny eBPF VM in the Linux kernel has given us unprecedented flexibility in developing tooling for analyzing systems. In this talk we discuss Traceleft - a new auditing and incident analysis framework that can be used to build monitoring tools for filesystem and network events. Traceleft is a configuration driven framework that latches on to syscalls and other relevant Linux kernel functions identified in Traceleft. The eBPF programs are generated, compiled on the fly and inserted in the kernel, based on a set of JSON based configurations. Traceleft supports tracing network calls, file operations such as opening/closing of a target files, for a given set of processes and the aggregation of these events. Traceleft is built using Go and uses Gobpf library and allows the configurations to be sent over the wire using Protobuf format. Traceleft started as a joint effort between ShiftLeft and Kinvolk to develop an easy, repeatable way to provide a configurable way to audit syscalls and classify security events filtered on processes and files. The tools built over Traceleft can be used for live monitoring and alert generation.

Implementing Traceleft presented many challenges.

eBPF tracing programs need to be recompiled for each kernel version and updated for each application profile. It needs to keep track of new processes and match them with new applications in a race-free way. Reading information from different sources bring many race possibilities. Catching syscalls and their parameters bring limitations: matching specific syscalls with specific syscalls or remote hosts for network calls. We will discuss how we overcame some of the challenges.


Suchakra Sharma Alban Crequy

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-230-sy...




Lennart Poettering

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-172-fe...



Whether you are interested in multimedia programming in specific or curious about how Rust programming language can enable you to write almost-bug-free code without having to compromise on efficiency, this talk is for you.

GStreamer is a popular framework of choice for multimedia programming in the Linux world, especially for embedded. Since efficiency is a typical core requirement for embedded solutions, traditionally C/C++ have been the languages of choice for writing GStreamer applications and plugins. Unfortunately, this efficiency comes at the price of safety. Even the most skilled C/C++ developers make mistakes with memory management and the results could potentially be catastrophic. Thread safety is another aspect that is central to multimedia solutions but is extremely difficult to achieve with C/C++.

Rust language is designed to be both efficient and safe at the same time. In this talk, Zeeshan will present how GStreamer's Rust bindings not only make multimedia programming a lot safer, easier and fun but also allow developers to write even more efficient code than C/C++ in certain cases.

While the talk will be focused on multimedia and GStreamer in specific, most of the concepts presented shall be very generic.

Zeeshan Ali

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-194-us...



There is so much more than you can so, than just starting and stooping your service, when you start to interact with systemd from within your application. Lets find out!!!

We'll explore how can you interact with systemd from your aplication, by describing how pystemd, a python binding for systemd, was created at facebook, and what type things your programs can take advantage if you just interact with systemd more.

From executing section of your code securely to create development environment on the fly, There is so much more than you can so, than just starting and stooping your service, when you start to interact with systemd from within your application.

Alvaro Leiva Geisse

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-216-sc...



The Linux Audit daemon is responsible for writing audit records to the disk, which you can then access with ausearch and aureport. However, it turned out that parsing and centralizing these records is not as easy as you would hope. Elastic's new Auditbeat fixes this by keeping the original configuration, but ships them to a centralized location where you can easily visualize all events.

You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. This talk shows you what can you do to discover changes, events, and potential security breaches as soon as possible on interactive dashboards. Additionally, we are combining Auditd events with logs, which are security relevant.

Philipp Krenn

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/v/ASG2018-224-pa...



System containers, the oldest type of containers, focus on running an entire Linux distribution, including all its services in very much the same way it would on a physical system or virtual machine.

System containers come with some unique challenges, users of those containers expect to be able to do pretty much everything that they can on a normal system. This means it’s not possible to restrict those containers quite as much as application containers can be.

It also means that there are extra expectations to be met:


Being able to add/remove devices to/from a running container
Loading security profiles inside a container
Using file capabilities in the container
Mounting file systems
Proper reporting of uptime, resource consumption and limits
Live-migration


In this presentation, we’ll explore some of the existing technologies in use by LXC and LXD to address some of those expectations as well as upcoming kernel and userspace features that will allow system containers to do even more than they do today.

Stéphane Graber

https://cfp.all-systems-go.io/en/ASG2...

https://media.ccc.de/c/asg2017/ASG201...



Updating embedded systems reliably requires more than just the actual
update process. This presentation gives an overview of the overall design
and components needed for successful system updates.




Michael Olbrich

https://media.ccc.de/v/ASG2018-185-pa...

(and massage)

A more generic approach to ensure you have what you'd expect to have

A side effect of the many new ways to package filesystems (here's looking at you, containers!), is that filesystems are being copied around without many of the features that traditional packaging provided (i.e. `rpm -qV ...`). Much progress has been made for reproducible digests of containers. In this talk Vincent Batts will review options for distributing filesystems with reproducibility, and verifying the at-rest outcomes.

Vincent Batts

https://cfp.all-systems-go.io/en/ASG2...