OSS + ELC EU 2026

Linux offers an impressive collection of security mechanisms, and recent years have added even more to the stack. Yet when reviewing embedded Linux products, I repeatedly run into a different problem: security features that are available, mature, and practical are simply not enabled.

Many embedded projects still start from vendor examples, reference BSPs, or existing products. As a result, design decisions made years ago often become the default for the next generation of devices. This talk focuses on a set of practical security mechanisms that embedded developers can deploy from the beginning of a project with relatively little effort.

Using examples from Yocto Project-based systems, we will examine features and tools such as:
- overlayfs with its advanced features
- filesystem permission hardening
- seccomp-based system call filtering
- fs-verity for file integrity protection
- fscrypt for protecting data belonging to different users and use cases.

We will discuss why they should be part of a base configuration and and show practical examples on how to do it.