Good local time, everyone. As some of you know, I was supposed to attend the Tokyo Olympics, but unfortunately I couldn't make it because of the pandemic. The silver lining, though, is that I have made some friends who are interested in sports and have gained a lot of knowledge about the games. Now I feel that I have come to a renewed understanding of the Olympic motto, faster, higher, stronger. Or I should say now, faster, higher, stronger, together, after the International Olympic Committee's decision to include together as an expression of unity. The same motto applies to the field of digital development. In the past, to strive for faster tech, higher tech, and stronger tech, many countries did their utmost to offer the most advanced facilities and services, to develop the most cutting-edge technologies, and also to nurture high-tech unicorns. But more and more countries are discovering that digital governance policies are like the Olympic spirit. It's not just about nurturing medalists, which is of course very important, but also about bringing people together, which is even more important. President Tsai Ing-wen announced the platform of Digital Nation Smart Island during her 2016 first election campaign. And Executive Yuan, in 2017, launched in response the DigiPlus program for digital nation innovation and inclusion. After her successful re-election, the idea of inclusion was further promoted, upgraded to the Smart Nation program of this year, with the vision of the Smart Nation is now labeled by innovation, inclusion, and also sustainability by 2030. This new vision of Smart Nation 2030 reveals a new direction for our digital governance policy. Any innovation today should be pluralistic and inclusive with sustainable development as its goals. And this means that it is no longer the case that the government should formulate policies from the top down only. We should not just dictate new development paths for industries, we should not direct people simply to new public services, but rather we should be receptive to building ecosystems of people, public-private partnerships to address the problems guided by the needs of the people. Now some may wonder how to cater to the needs of the member of the public in our diverse and increasingly evolving society and whether problems may arise as some issues are prioritized over others. But we need to simply look back at the history of the internet. The internet was not created by a single international organization or by a single standard setter. Rather, this is about people coming from all stripes scattered around the world, working together in an open fashion to establish an inter-network that connects people to each other. And on this interconnected system they engage in an iterative problem-solving process inventing new protocols according to our own needs and forming the internet as we know it. Now internet is indispensable for socioeconomic and political activities in every corner of the world. It's still in a constant state of evolution as the needs of people change.  But regardless of whether governments are willing to address them they are now civic technologists willing to tackle new problems with digital innovation. So our smart nation digital governance policy should not dominate over or prohibit these attempts but we should instead find ways to align with them. So this alignment of values I believe is the most important the first and foremost aspect of digital governance. Alignment. For example when the COVID-19 outbreak struck us last year medical grade masks the most essential PPE were in short supply and our central government had to adopt this real name rationing system for ordering face masks and everyone want to know where to buy them and in that time more than 100 different mask map applications appeared. Our government didn't discourage any of these efforts rather we release in real time the address and also the real-time number of remaining stock in each and every pharmacy through open data keeping the apps up to date and so in less than a week through more than 100 map applications for mask availability people from all walks of life can receive this information through like the messaging app line or with voice assistance through the seeing challenged helping apps and so on and in other words an alliance was forged between the government the civic technologist and the private sector and this allowed us to meet the diverse needs of the largest possible swath of the population in the shortest possible time and also at the lowest possible cost. This year when Taiwan was hit again by a wave of infections in May the Central Epidemic Command Center issued this nationwide level 3 alert requiring contact information to be supplied when entering and leaving public venues this is to facilitate accurate contact tracing and exposure notifications. However the long queues for writing on paper at each shop can be both time consuming and also counterproductive to increase exposure time in crowded areas. So naturally civic technologists began prototyping various digital solutions there's also many businesses in the private sector that start to introduce their own apps for registration. At one point I had to install like 10 different apps for registration. From these discussions of course the developers by the center gathered together and the government was then able to tell in a very short amount of time what was working and what was not and we wrote out again in three days the 192 to SMS check-in system. This system while not mandated by the central government soon became the most natural part of people's lives and this innovative design by the Gov0, G0V to make their community proved invaluable. People simply scan a QR code using the built-in camera of their phone and send a text message to 192 to so just scan and send no apps required. Not only is this convenient but it also address many of the concerns of the public like what if I don't have internet access well manually typing out the text message will suffice. What if I don't have a mobile phone or even a flip phone well one can still choose to write your contact information down on the paper now less crowded. So with the 192 to SMS system how do we store the huge amount of data being transmitted? Well it is stored within the very company the telecom company that provide the person's phone service and it can only be accessed by contact tracers. Everyone can require a full audit for 28 days since it's sent in because it's deleted after 28 days. All of these considerations are reflected in the second aspect of digital governance accountability. Accountability in digital innovation puts people's minds at ease because it inspires confidence that digital services will do what they say they will and also it will not compromise the privacy of people. And this is exactly why the personal data protection and cybersecurity communities are becoming increasingly important in digital development. Moreover accountability can ensure that our improvements are made on a rolling basis to be more and more accountable as new challenges arise. For example, a judge in Taiwan found that the evidence in a criminal investigation included some data from the 192 to SMS system and questioned its legality. And following the discussions by the communities including GovZero the Ministry of Justice concluded that the 192 to SMS system does not constitute a private communication and should not be accessed as per the Communication Security and Surveillance Act. And following this interpretation specific measures have now been taken by telecommunication companies and the judiciary to preclude communication surveillance wiretapping from accessing the SMS data as reserved for contact traces. As part of the national strategy for digital development alignment and accountability are equally important. It is not just about passively allaying concerns providing peace of mind. They are of course important but equally important is that we should proactively make the results of such people, public, private partnerships a reality. Another example is our annual presidential hackathon. It's now entering its fourth year. It serves as an opportunity for the social, public and private sectors to work together to come up with innovative ways of linking data across sectors and using digital technology to resolve imminent social and environmental issues. The presidential hackathon does not offer any prize money but the system designed by those winning teams they are a short government promotion. The team is invited to be part of our national initiatives and the government assistance often helped the teams finding opportunities for commercial application. As Taiwan's digital minister what digital means for almost to me then is the stimulation empowerment of social innovation increasing the connections between people through technology or in other words an emphasis on alignment and accountability. The good ideas under this strategy are taken seriously. Partners can be sought out to work together and this established a virtuous cycle that leads to innovative, inclusive and sustainable digital development. Or to put it another way, only when people coming from different sectors different fields and different roles join forces can our digital development be faster, higher and stronger together. Thank you. Live long and prosper.


Welcome to my talk on Landlock. My name is Michael. I work for KeenFolk. You probably have heard about KeenFolk by now. So this talk is about Landlock and Linux security module by Mikael Salyn. I hope I pronounced it right. And it's currently a proposal in version 7, so it's not yet merged upstream. The first IRC was published in March 2016. And it aims to be a Linux security module targeted at application developers. So in contrast to, for example, AppArmor or AssetLinux, the goal is to enable user processes, for example, your web application, to be able to restrict themselves by applying Landlock rules. This is not possible with the current version. The reason for that is that the scope right now is really minimal and the discussion focuses on the design. But once that is done, it will be changed. And in the end, everybody should be possible to restrict processes to the minimum required. Landlock is stackable. So I think stackable in two ways. The first way is that you can combine it with other Linux security modules. So it doesn't mean the administrator of a system doesn't have to care about security anymore. But it aims to make it possible that both the system administrator and the application developer can think about how this application should be secured, what should be possible, what not. And the second thing is that you can not only apply one Landlock rule, but you can apply many rules. So it's similar to a pledge from OpenBSD if you have heard about that. So there will be different families of rules covering different aspects of an application. And you can then combine this. What is unique about it is that it's using BPF. I won't touch any BPF specifics in this talk, but my next talk in the other room is actually about BPF. So if you want to learn about that, you can come. And the patch set right now is only focused on file system access controls, so it doesn't do anything else. And even that is a bit primitive right now because BPF is not yet powerful enough to really allow you to make or build rules that would enable you to do stuff like path checking. Path checking is just not possible in BPF to do reliable. So that's also work in progress. Why BPF or just BPF? It has a very limited kernel attack surface and a very strict verifier. It's used in a lot of places in the kernel nowadays. It has a lot of momentum. And since the future users of Landlock should not only be unprivileged but also untrusted, it's important that something is chosen which is properly verified by the kernel before it's applied. And BPF is perfect for that. So as long as there's no bug in the kernel verifier, you can be pretty sure that the rule will not interfere with the stability of your system. That's because the verifier, for example, makes sure that a program never has more than 4K instructions. Another thing is that you can't loop in your program, so you won't be able to denial of service the host system. Yeah, so that's what makes it a good candidate. I will show you how Landlock works right now. For that, I will use a demo application which can be found in the patch set in Linux. So I have a self-built kernel here with the Landlock patches applied. And we can also verify that Landlock is active. It is. And here we have a file, hello. And I can also touch this file, so this works. And I will now show you the same thing from a Landlock chain, so to say. One more thing. For that, I will load a Landlock rule. And this rule is an L file, so it's a BPF program compiled into an L object. And this program is the rule, and Landlock will load this rule to then contain the batch process that I'm about to start. So in K&Z, a new sandbox process was started, and I'm inside this new batch now. And when I repeat the same operation, I'm not allowed to do this anymore. And this is because this Landlock program does only allow read operations, not write operations. So I can still access the file, but not write to it anymore. And once I exit the process again, it works again. So I did this by using the Landlock subtype event file system. This is the only event which is available right now. We have learned before only the file system related events are considered for the first version, and other events can be added later then. And Landlock tries to target kernel objects with events, so it's not, for example, loading rules by syscalls, like SecComp does it. But it wants to separate those events by kernel objects. So in this case, the object is a struct file, and this object is used in many syscalls, for example, read and write. And for all those 33 hooks which group this file system-related actions, Landlock has loaded the rule. Landlock also knows about actions, so actions divide those events into sub-events or subtasks, so those enable you to decide what the event actually is about. So in the example that we just saw, writes were not allowed anymore, but reads still were allowed. And by checking the action in the rule, Landlock was able to decide if the request should be allowed or not. Sometimes there is no action parameter to an event, but something else, like an IOC control request, so that then depends on the event. And yeah, you have to look up the documentation to decide what you can do. So when the kernel starts, security modules gets loaded. So Landlock sets up its hooks there, and that happens at the start. We just started when I showed you the loaded Linux security modules. And then when a user application wants to use Landlock, it has to do two things. The first thing is using the BPF syscall to load the actual rule. And the second thing, using the second syscall to apply the rule to the process. The idea behind that was that in some scenarios, maybe the application that loads the rule is not the user application. So the first application could load the rule with BPF and then maybe pass the program file descriptor over a socket to the user application, which then applies the rule with secump. Once the program is loaded and applied, it gets triggered for all events which match the program subtype. We will see an example just in a moment. And this program then can do checks and signal the security module by return code if the action should be allowed or not. So either allow it, return code 0, or deny it, return code not 0. So the usual workflow to apply a rule is first restrict the own process to not gain any new privileges. And then by passing the proc file descriptor, which gets returned from the BPF syscall to secump. And after that, the process as well as the child processes will be restricted. To write a rule, we need two things. First the subtype, second the handler program. And this is the BPF specific part now. So in C, it looks like this. By convention, there should be a section subtype. So sec here is just defined to make sure that this struct ends up in the elf section subtype so that it can be found by the loader. And it defines two or three things. First the ABI, so which version of Landlock is required. Right now there is only version one. Then the subtype, this program is for. So we just use subtype event file system. And optionally, the ability this program should have that makes a difference in the BPF helper programs that are available for this handler. So for example, if you don't give this ability, the program won't be able to write messages into the trace pipe of the kernel. And this is how a handler program looks like so that's not the program we have seen in the demo before. It's just a short example. So you get a Landlock context which has a couple of fields. One of the fields is the event type. You need it to distinguish the events. And as said before, in the end, you can decide if you want to allow or deny. So this one would just print something to the trace pipe and then allow what you want to do. And it would also just print this message because this path of the if-else check actually can't be reached because there are no other types than subtype event file system. So if you are interested in the ongoing development of Landlock, you can check on the Linux kernel mailing list. The patch set is based on netnext because all the BPF development is happening in netnext. And since it also introduces a new BPF type, it had to choose the netnext tree and not, for example, master. And there is an org on GitHub. So you can find a Linux tree there with branches for each version of Landlock. So that's nice when you are interested in the history or want to have a look on older versions of the patch set. On the roadmap is C group handling. So the goal is to not only be able to apply rules to processes with a second, like we have seen, but also to C groups. And another one is a map type for file system related checks. So that's also the big blocker, so to say, why this can't fully work today because the BPF system itself does not bring the right tools to check for, for example, for a path of a file or stuff like that. Because you never get the full picture. You don't know in which mount neighbor space you are working. So you can never be sure which file actually is used. And also, as I said before, the unprivileged mode also is yet to be done. Yeah, that's it. Thank you. If you have any questions, I will try to answer those. So the talk. My question is, which part of that needs Capsus Admin right now? I thought both SecComp and that PR control, they could both be done as a normal user without capabilities. The BPF system needs it. And I'm not actually sure if they also have a check in SecComp. I think they do. So as I've seen, it's a special landlock rule call. And I think the decision was to also require privileges for that until the ABI is stabilized. But I'm not 100% sure if I recall correctly. OK, just didn't want to own everything. So how do you envision integrating this into actual applications? So do you put this landslide loader as a wrapper in system D units? Or do you start your program through that? Or how does it actually get applied to executables in the end? Well, I think both is possible. So I think there's the pledge use case. So you, as an application developer, can say, for example, OK, I only need to read and write from a var run foo. So I limit myself to this. But of course, it also would be possible that system D gains support for it. And you can set some flag or options in the unit file to restrict the process which is managed by system D. So I think both will be possible. So similar to the upperable profiles equals, that you can set that to the compiled rules file. Yeah, that could be OK. Are you looking at providing tools for programmers or for system administrators to actually watch programs that are running to get something like a profile for a program that is known good so that they can apply this set of capabilities to the application and then detect when it's deviating from that known good state? I think eventually that's something which would be nice to have. But I guess it's way too early right now to start working on that. So since the patch set is not in Linux yet, I think that's something for the far future. Next step maybe is to have libraries in Rust or Go, for example, to make this to just improve usability for application developers and then maybe tooling will follow more questions. OK, thank you.