Layered Security Hardening in Rocky Linux: Protection Before the Patch
- Speaker: Brady Dibble
- Room: CC 203
- Time: Sun 2:00 pm – 2:30 pm
- Format: Lecture (30 Min + Q&A)
- Difficulty: Some experience required
- Track: Security / Privacy
- Additional Tags: OSS Distributions
- Presenter Location: In-person
- Experience: several-th time speaking
- At: anywhere / at lfnw
Description:
Package‑level security hardening can eliminate entire classes of vulnerabilities before CVEs are published — or mitigate them before patches exist. The Rocky Linux Security SIG demonstrates this proactive approach by modifying core packages and integrating tools such as LKRG, drawing on decades of Openwall hardening work.
A key example: the hardened glibc in Rocky Linux prevented exploitation of CVE‑2023‑4911 (Looney Tunables), reducing impact before upstream Enterprise Linux shipped a fix.
This talk explains:
- Which packages are hardened and why
- What attack surfaces these modifications eliminate
- How the control