IPERoadmap
Directions under consideration. Nothing here is a commitment or schedule.
Shipped
| Version | Feature |
|---|---|
| 6.12 | Core policy engine, securityfs interface, audit records |
| 6.12 | boot_verified, dmverity_roothash, dmverity_signature, fsverity_digest, fsverity_signature |
| 6.17 | AT_EXECVE_CHECK — interpreted script enforcement |
composefs / ostree support planned
Automatic support for ostree-based deployments using composefs, enabling IPE to work with image-based Linux distributions that use fs-verity for content verification.
Namespace support planned
IPE is currently system-wide: one active policy governs every process on the host. For mixed-workload hosts, it would be useful to scope policies to a namespace, with the constraint that a nested policy can only be more restrictive than the one containing it.
This depends on broader LSM and audit namespacing work that is still under discussion upstream. See the namespace talk for early design work.
Certificate policy planned
IPE currently treats a signature as valid if it chains to a trusted key. Certificate policy would let rules match on properties of the signing certificate — subject, issuer, or key identifier — so that different keys can be authorised for different operations. For example, a key trusted for OS images would not automatically be trusted for kernel modules.
Discussion
Discuss roadmap items on GitHub Discussions.