"Containers do not contain"
•Download as ODP, PDF•
5 likes•14,809 views
This document discusses Linux security and SELinux. It provides an overview of SELinux and how it works to provide mandatory access control on Linux systems. It discusses how SELinux labels processes and files to confine programs and prevent unauthorized access. It also discusses using SELinux with Docker containers to provide security isolation between containers.
Report
Share
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to "Containers do not contain"
Similar to "Containers do not contain" (20)
More from Maciej Lasyk
More from Maciej Lasyk (16)
Recently uploaded
Recently uploaded (20)
"Containers do not contain"
- 1. Maciej Lasyk Devopsdays Warsaw 2015-11-25 “Containers do not contain” (orig. by Dan Walsh)
- 4. How does security look like? Such security..Such security.. Very fortress!!1Very fortress!!1 WOW :)WOW :)
- 5. And seriously... Do you know this guy?
- 6. And seriously... Do you know this guy? So he has something to tell you... http://www.youtube.com/watch?v=o5snlP8Y5GY
- 7. Linux OS security DAC (Discretionary access control) basic ACLs chmod
- 8. Linux OS security – extended ACLs DAC (Discretionary access control) setfacl / getfacl
- 9. Linux OS security – Linux Security Modules MAC (Mandatory Access Control) (LSMs)
- 10. SELinux – how it works? syscalls work like interfaces for accessing some resources
- 11. SELinux – how it works?
- 12. SELinux – how it works? DAC MAC upstream kernel has been fixed to report check for mmap_zero for MAC AFTER DAC (2014-03-05, http://danwalsh.livejournal.com/69035.html)
- 13. SELinux – how it works?
- 14. - http://www.nsa.gov/research/_files/selinux/papers/freenix01/node18.shtml#sec:perf:macro SELinux – performance Just test it yourself: git://git.selinuxproject.org/~serge/selinux-testsuite
- 15. - http://www.nsa.gov/research/_files/selinux/papers/freenix01/node18.shtml#sec:perf:macro SELinux – performance Just test it yourself: git://git.selinuxproject.org/~serge/selinux-testsuite avcstat uptime: 10h hit ratio: 99.94%! (57mln of lookups)
- 16. SELinux – learning curve
- 17. SELinux and...
- 18. SELinux and Android - from 4.3 – permissive - from 4.4 enforcing - Will help us with BYOD :) - No setuid/setgid programs (4.3) http://selinuxproject.org/page/SEAndroid http://source.android.com/devices/tech/security/se-linux.html
- 19. SELinux primer stopdisablingselinux.com or http://opensource.com/business/13/11/selinux-policy-guide
- 20. SELinux primer Everyone gets a label!
- 21. SELinux primer allow cat cat_chow:food eat; allow dog dog_chow:food eat;
- 22. SELinux primer AVC (Access Vector Cache)
- 23. SELinux primer AVC (Access Vector Cache)
- 24. SELinux primer In real world... process: httpd_t files under Apache: httpd_sys_content_t database data: mysqld_data_t hacked Apache process can not access mysqld files!
- 25. SELinux primer Can same type of process be confined differently?
- 26. SELinux primer Yes! With MCS enforcement!
- 27. SELinux primer In real world... 2 processes: httpd_t files under httpd: httpd_sys_content_t So how to deny files from differ instances of httpd_t? With MCS labels like s0:c1,c2 ; s0:c3,c4 etc s0, s1, s2 – sensitivity levels c1,c2,c3... - categories (up to 255)
- 28. So remember.. Every time you run setenforce 0, you make Dan Walsh weep Dan is a nice guy and he certainly doesn't deserve that.
- 29. So what about other LSMs? http://www.cyberciti.biz/tips/selinux-vs-apparmor-vs-grsecurity.html
- 30. So what about other LSMs? - AppArmor identifies file system objects by path name instead of inode - There is no notion of multi-level security with AppArmor - AppArmor user rather flat files based configuration - SELinux supports the concept of a "remote policy server" - There is no apparmor or grsec in android :)
- 31. Docker + SELinux f20 policy: https://git.fedorahosted.org/cgit/selinux-policy.git/tree/docker.te?h=f20-contrib What's there? seinfo -t -x | grep docker sesearch -A -s docker_t (and the rest) or just unpack docker.pp with semodule_unpackage
- 32. Docker + SELinux f20 policy: https://git.fedorahosted.org/cgit/selinux-policy.git/tree/docker.te?h=f20-contrib What's there? seinfo -t -x | grep docker sesearch -A -s docker_t (and the rest) or just unpack docker.pp with semodule_unpackage How to use it? man docker_selinux :)
- 33. Docker + SELinux f20 policy: https://git.fedorahosted.org/cgit/selinux-policy.git/tree/docker.te?h=f20-contrib What's there? seinfo -t -x | grep docker sesearch -A -s docker_t (and the rest) or just unpack docker.pp with semodule_unpackage How to use it? man docker_selinux :) Permissive domains! semanage permissive -a docker_t It's only in targeted policy (not for MCS)
- 37. http://maciek.lasyk.info/sysop maciek@lasyk.info @docent-net Thank you :) “Containers do not contain” (orig. by Dan Walsh)
Editor's Notes
- test
- Osadzenie aplikacji w chmurze może wyglądać w ten sposób właśnie – trzeba uważać na złudność, bo nie wszystko musi być przemyślane Jednak pamiętajmy o wektorach ataku nie przemyślanych w tym zestawieniu Nadal trzeba przemyśleć sec na każdej wartswie
- Aplikacja działa w wydzielonym bloku pamięci virtualnej Aplikacja może się komunikować z inną np. Za pomocą pamięci współdzielonej Jednak jedyny sposób na dostanie się do kernel-space'a i zapytanie o zasoby zewnętrzne -> syscall Syscall nie jest funkcją per-se; to raczej procedura, która wykonuje po drodze wiele sprawdzeń
- Stop reading tests – just test it yourself, because every env, every policy works different AVC means cache! It's really fast though it has some restrictions Access Vector Cache
- Stop reading tests – just test it yourself, because every env, every policy works different AVC means cache! It's really fast though it has some restrictions
- Just sit and learn. Profit for many years
- Android!
- Czym jest permissive a czym enforcing?
- MCS – Multi Category System Sensitivity Levels Categories
- Yes, SELinux could work with grSec/PaX – like in Gentoo Hardened