Securing Embedded Linux Systems with Yocto

Threats and regulatory framework

• Overview of cyber threats to connected products
• Secure-by-design and secure-by-default principles: defense in depth, least privilege
• Cyber Resilience Act: scope, objectives, product categories
• Split of responsibilities between manufacturer, importer and distributor
• Enforcement timeline and penalties
• Threat modeling, STRIDE

Exercise: bootstrapping a Yocto project

Applied cryptography

• Cryptographic services and their limits
• Integrity: hashing and message authentication codes
• Confidentiality: symmetric and asymmetric encryption
• Authenticity: digital signature and public-key infrastructure (PKI)
• Secret robustness and randomness generation
• Operational secret management in production

Chain of trust: from hardware to the rootfs

• Hardware attacks and physical threat model
• Hardware roots of trust: OTP, TPM, secure enclaves (TEE, TrustZone)
• Secure boot, chain of trust from the first executed code
• Trusted execution environment (TEE) and software trust module (fTPM)
• Root filesystem integrity and confidentiality

Exercise: building a verified boot sequence, with root filesystem integrity and confidentiality

Hardening the toolchain and the code

• Compilation chain components, stripping debug symbols
• Classic memory vulnerabilities (buffer overflow, use-after-free)
• Compiler hardening options
• Dynamic detection with instrumentation tools (sanitizers)
• Static analysis and fuzzing
• Secure coding best practices

Exercise: finding and fixing vulnerabilities

Secure distribution and CRA requirements

• Minimizing the image and its features
• Choosing a long-term support (LTS) distribution and maintenance cycle
• Software bill of materials (SBOM) generation and formats
• Vulnerability tracking and prioritization (CVE, CVSS, EPSS)
• CRA notification obligations
• Securing updates (firmware over-the-air, OTA)

Exercise: generating an SBoM and applying a patch

Hardening the Linux kernel and the bootloader

• Bootloader hardening
• Kernel and command-line signature verification
• Security-oriented kernel configuration options
• Runtime system parameters (sysctl)
• Kernel module signing
• Automated hardening verification

Exercise: secure kernel configuration (CONFIG_*, sysctl, cmdline) and functional testing

Hardening the userspace

• Unix permissions, setuid/setgid bits, file capabilities
• Partitioning and mount options
• Accounts, passwords and pluggable authentication (PAM)
• Securing remote access
• Linux Security Modules
• Namespaces and control groups (cgroups) as complementary isolation

Exercise: manipulating file access rights, checking the consistency of the resulting filesystem

Hardening services, logging and audit

• Reducing a service's starting privilege
• Sandboxing directives of the service manager
• System call filtering (seccomp)
• Assessing the hardening level
• Logging and log integrity
• Kernel audit (auditd)

Exercise: assessing then reducing the rights granted to a service, setting up a monitoring rule

Network security

• Principles and network exposure surface
• Network isolation and segmentation
• Firewalling and traffic filtering
• Secure communication protocols (TLS, mTLS)
• Network authentication frameworks
• Network penetration testing (pentest)

Exercise: checking then strengthening the security of a network-exposed service