Security in Zephyr and Fuchsia - Comparing Emerging Open Source Operating Systems

Explore the security architectures and mechanisms of Zephyr and Fuchsia operating systems in this informative conference talk by Stephen Smalley and James Carter from the National Security Agency. Delve into the unique approaches these emerging open-source systems take compared to Linux, with Zephyr targeting resource-constrained IoT devices and Fuchsia employing a capability-based microkernel for more capable devices. Learn about ongoing efforts to enhance their security features, and gain insights into how they compare to Linux and Android. Discover Zephyr's evolution from its beginnings to its current implementation of OS protections, userspace support, and memory model, as well as areas for future development. Examine Fuchsia's security mechanisms, including handles, job policies, namespaces, and sandboxing, while considering the potential for mandatory access control (MAC) implementation. Compare these systems to Linux OS security and engage with the speakers' expertise through a Q&A session.

Intro
Zephyr and Fuchsia
What is Zephyr?
Zephyr: In the beginning
Zephyr: Motivation for OS protections
Zephyr: Hardware Limitations . Most microcontrollers back a MMU
Zephyr: Protection Design Constraints
Zephyr: Basic Memory Protections
Zephyr: Userspace Support
Zephyr: Userspace Memory Model
Zephyr: Userspace Kernel Interface
Zephyr: Application Memory
Zephyr: App Shared Memory Example
Zephyr: Areas for Future Work
Fuchsia Security Mechanisms
Fuchsia: (Regular) Handles
Fuchsia: Resource Handles
Fuchsia: Job Policy
Fuchsia: Namespaces and Sandboxing
Fuchsia: Bootstrap / Process Creation
Fuchsia: A Case for MAC
Fuchsia & MAC: Design Options
Full Kernel Support for MAC
Current Work - Examples
Fuchsia vs Linux OS security
Questions?