Microsoft says that the need arises from the fact that the majority of corporate customers now use Linux servers.
Extensions For The Linux Kernel That Enable Additional Security Functions
The primary aim of the new security module is to solve integrity problems for Linux in the Azure Cloud. The technical details have now been published, the project is in the status. The module has been developed for personal use in cloud operation, according to the documentation. The new system is not intended for the broad base of Linux users, but for system administrators who are confronted with special use cases and for security reasons, must have full control over what is running on their systems.
As per the official notes, a system admin can also create a list of binaries with corresponding verification attributes. This helps IPE to run only the binaries having verified attributes and block the malicious or altered binary code.
The new security module offers a comprehensive security solution for Azure Cloud. The Azure Cloud collects, aggregates and analyzes raw security data from your operating and container system and issues usable security recommendations and warnings. With this version, the developers have added other security modules too. At the moment, Linux limits the ptrace interface, which allows a process to examine the memory and the current status of all processes. The Linux kernel already contains code integrity, which is called Integrity Measurement Architecture. The new security module apparently differs from Integrity Measurement Architecture that it has no dependency on file system metadata. According to Microsoft, users can test guidelines before they take effect. This should be of particular importance for embedded systems such as devices with a network firewall in a data center or for Linux servers. The previously mentioned connection to Azure should serve on the one hand for monitoring and the administration of corresponding devices and should also be used as a source for software updates.
