Using SELinux with container runtimes Because privileged containers - - PowerPoint PPT Presentation

▶
using selinux with container runtimes
SMART_READER_LITE
LIVE PREVIEW

Using SELinux with container runtimes Because privileged containers - - PowerPoint PPT Presentation

Jan 29, 2024 254 likes •977 views

Using SELinux with container runtimes Because privileged containers are scary Lukas Vrabec Senior Software Engineer Security Technologies 1 Who am I ? Lukas Vrabec SELinux Evangelist Member of Security Technologies team at Red

slide-1
SLIDE 1

Because privileged containers are scary

Using SELinux with container runtimes

Lukas Vrabec Senior Software Engineer Security Technologies

1

slide-2
SLIDE 2
  • Lukas Vrabec
  • SELinux Evangelist
  • Member of Security Technologies team at Red Hat
  • RHEL & Fedora Contributor (selinux-policy, xguest, udica, netlabel_tools)
  • lukas.selinux@redhat.com
  • https://lukas-vrabec.com
  • https://github.com/wrabcak
  • https://twitter.com/mynamewrabcak

Who am I ?

slide-3
SLIDE 3

Why?

slide-4
SLIDE 4

New cluster:

  • SELinux enforcing by default
slide-5
SLIDE 5

New cluster:

  • SELinux enforcing by default
  • 189 pods
slide-6
SLIDE 6

New cluster:

  • SELinux enforcing by default
  • 189 pods

○ 618 containers

slide-7
SLIDE 7

New cluster:

  • SELinux enforcing by default
  • 189 pods

○ 618 containers ■ 134 privileged containers

slide-8
SLIDE 8

New cluster:

  • SELinux enforcing by default
  • 189 pods

○ 618 containers ■ 134 privileged containers

slide-9
SLIDE 9

Privileged containers are scary

slide-10
SLIDE 10

What are privileged containers anyway? Why is SELinux important at all?

slide-11
SLIDE 11

Quick SELinux introduction

slide-12
SLIDE 12

TECHNOLOGY FOR PROCESS ISOLATION TO MITIGATE ATTACKS VIA PRIVILEGE ESCALATION

slide-13
SLIDE 13

CONTAINER_T CONTAINER_FILE_T ARE LABELS

slide-14
SLIDE 14

ASSIGNED TO PROCESSES

slide-15
SLIDE 15

ASSIGNED TO PROCESSES ASSIGNED TO SYSTEM RESOURCES

slide-16
SLIDE 16

ASSIGNED TO PROCESSES ASSIGNED TO SYSTEM RESOURCES BY SELINUX SECURITY POLICY

slide-17
SLIDE 17

LABELS IN REALITY

slide-18
SLIDE 18

STORED IN EXTENDED ATTRIBUTES OF FILE SYSTEMS - EXT2,EXT3, EXT4 ...

slide-19
SLIDE 19

# getfattr -n security.selinux /etc/passwd getfattr: Removing leading '/' from absolute path names file: etc/passwd security.selinux="system_u:object_r:passwd_file_t:s0" # ls -Z /etc/passwd system_u:object_r:passwd_file_t:s0 /etc/passwd

slide-20
SLIDE 20

$ ps -eZ | grep container_t system_u:system_r:container_t:s0:c435,c872 17864 pts/0 00:00:00 bash system_u:system_r:container_t:s0:c236,c541 17865 pts/0 00:00:00 bash system_u:system_r:container_t:s0:c123,c456 17866 pts/0 00:00:00 bash

slide-21
SLIDE 21

SELINUX POLICY DESCRIBES AN INTERACTION BETWEEN PROCESSES AND SYSTEM RESOURCES

slide-22
SLIDE 22

allow container_t container_file_t:file {getattr open read};

slide-23
SLIDE 23

BY DEFAULT EVERYTHING IS DENIED AND YOU DEFINE POLICY RULES TO ALLOW CERTAIN REQUESTS.

slide-24
SLIDE 24

Generic container SELinux policy

slide-25
SLIDE 25

Protects the host system from container processes

slide-26
SLIDE 26

Protects the host system from container processes Container processes can only read/execute /usr files

slide-27
SLIDE 27

Protects the host system from container processes Container processes can only read/execute /usr files Container processes only write to container files.

slide-28
SLIDE 28

Protects the host system from container processes Container processes can only read/execute /usr files Container processes only write to container files. process type - container_t file type -container_file_t

slide-29
SLIDE 29

Every Container Runtime CVE container breakout was a file system breakout.

CVE-2019-5736 Execution of malicious containers allows for container escape and access to host filesystem

SELinux Blocked

CVE-2015-3627 Insecure opening of file-descriptor 1 leading to privilege escalation

SELinux Blocked

CVE-2015-3630 Read/write proc paths allow host modification & information disclosure

SELinux Blocked

CVE-2015-3631 Volume mounts allow LSM profile escalation

SELinux Blocked

CVE-2016-9962 RunC Exec Vulnerability

SELinux Blocked

slide-30
SLIDE 30

SELinux has contained them ALL.

slide-31
SLIDE 31

What about containers attacking each other?

slide-32
SLIDE 32

Multi Category Security Based on MLS (Multi Level Security)

slide-33
SLIDE 33

container_t:s0:c1,c2 container_file_t:s0:c1,c2 container_t:s0:c2,c3 container_file_t:s0 container_file_t:s0:c2,c3

slide-34
SLIDE 34

container_t:s0:c1,c2 container_file_t:s0:c1,c2 container_t:s0:c2,c3 container_file_t:s0 container_file_t:s0:c2,c3

slide-35
SLIDE 35
  • container_t:s0:c1,c2

○ container_file_t:s0:c1,c2 ○ container_file_t:s0

  • container_t:s0:c2,c3

○ container_file_t:s0:c2,c3 ○ container_file_t:s0

slide-36
SLIDE 36
  • container_t:s0:c1,c2

○ container_file_t:s0:c1,c2 ○ container_file_t:s0

  • container_t:s0:c2,c3

○ container_file_t:s0:c2,c3 ○ container_file_t:s0 Relabeling in container engines: # podman run -d -v /var/lib/mydb:/var/lib/mariadb:Z rhel7-mariadb

slide-37
SLIDE 37
  • container_t:s0:c1,c2

○ container_file_t:s0:c1,c2 ○ container_file_t:s0

  • container_t:s0:c2,c3

○ container_file_t:s0:c2,c3 ○ container_file_t:s0 Relabeling in container engines: # podman run -d -v /var/lib/mydb:/var/lib/mariadb:Z rhel7-mariadb # podman run -ti -v /home/lvrabec/shared:/home/lvrabec/shared:z fedora /bin/sh # podman run -ti -v /home/lvrabec/shared:/home/lvrabec/shared:z fedora /bin/sh

slide-38
SLIDE 38

Problems with SELinux Container Confinement

slide-39
SLIDE 39

Default Container Type (container_t) too strict for certain use cases, e.g:

slide-40
SLIDE 40

Default Container Type (container_t) too strict for certain use cases, e.g:

  • Fedora SilverBlue project needs containers to read/write home

directory

slide-41
SLIDE 41

Default Container Type (container_t) too strict for certain use cases, e.g:

  • Fedora SilverBlue project needs containers to read/write home

directory

  • Fluentd project needs containers to be able to read logs in /var/log

directory

slide-42
SLIDE 42

Default Container Type (container_t) too loose for certain use cases, e.g:

slide-43
SLIDE 43

Default Container Type (container_t) too loose for certain use cases, e.g:

  • No SELinux Network Controls

○ All container processes can bind to any network port

slide-44
SLIDE 44

Default Container Type (container_t) too loose for certain use cases, e.g:

  • No SELinux Network Controls

○ All container processes can bind to any network port

  • No SELinux control on Linux Capabilities

○ All container processes can use all linux capabilities

slide-45
SLIDE 45

Current Situation

slide-46
SLIDE 46

# podman run -d -v /var/log:/var/log:Z fluentd

  • BAD: Tells podman to set labels on /var/log directory to be container

specific.

  • Other confined tools will no longer be able to write their logs
slide-47
SLIDE 47

# podman run -d -v /var/log:/var/log:Z fluentd

  • BAD: Tells podman to set labels on /var/log directory to be container

specific.

  • Other confined tools will no longer be able to write their logs

# podman run -ti -v /home:/home --security-opt label:disabled fedora sh

  • Turn off SELinux container separation for these use cases
slide-48
SLIDE 48
slide-49
SLIDE 49
  • Solutions

○ Write completely new SELinux policy for custom container ■ Best solution ■ Too difficult for system administrators

  • SELinux expertise required
slide-50
SLIDE 50
  • Solutions

○ Write completely new SELinux policy for custom container ■ Best solution ■ Too difficult for system administrators

  • SELinux expertise required

○ Add additional rules for container_t type ■ Not ideal still difficult for system administrators ■ Rules apply to all containers, not just specific container.

slide-51
SLIDE 51

Solution: Udica Project

slide-52
SLIDE 52

Udica ~ Fishing rod

slide-53
SLIDE 53

Udica is a tool for generating SELinux security profiles for containers.

slide-54
SLIDE 54
  • Example container

○ Mounting /home as read/write ○ Mounting /var/spool as read only ○ Exposing port tcp/21

slide-55
SLIDE 55
  • Example container

○ Mounting /home as read/write ○ Mounting /var/spool as read only ○ Exposing port tcp/21

  • Generic SELinux domain for container

○ Cannot read/write /home ○ Cannot read /var/spool ○ Exposes all ports

slide-56
SLIDE 56

Let’s generate SELinux policy for example container! Live Demo!

https://github.com/containers/Demos/tree/master/security/SELinuxUdica

slide-57
SLIDE 57

Using udica to solve these issues

# podman run -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash # podman inspect -l | udica my_container # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_contain er.cil} # podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

slide-58
SLIDE 58

Using udica to solve these issues

# ps -efZ | grep my_container.process unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 8837 5865 0 14:29 pts/0 00:00:00 podman run

  • -security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

system_u:system_r:my_container.process:s0:c116,c171 root 8920 8909 0 14:29 pts/0 00:00:00 bash

slide-59
SLIDE 59

Udica under the hood

slide-60
SLIDE 60
  • Concept based on "block inheritance" SELinux CIL language
slide-61
SLIDE 61
  • Concept based on "block inheritance" SELinux CIL language
  • Udica creates policy combining rules from specified CIL

blocks(templates) ○ Inspecting container JSON file ■ Mounts ■ Ports ■ Capabilities

slide-62
SLIDE 62
  • Concept based on "block inheritance" SELinux CIL language
  • Udica creates policy combining rules from specified CIL

blocks(templates) ○ Inspecting container JSON file ■ Mounts ■ Ports ■ Capabilities ○ Combines with default container template file ■ /usr/share/udica/templates/base_container.cil

slide-63
SLIDE 63

base home net Allows read/exec /usr & read /etc Allows network access Allows access homedirs Required for every container + Allowing bind on ftp_port_t (21) + Add only read/write perms

slide-64
SLIDE 64

base home net my_container

slide-65
SLIDE 65

my_container

  • No block for /var/spool
  • Udica will detect all labels what could be inside

/var/spool and create allow rules in my_container policy. spool my_container

slide-66
SLIDE 66

Using the new type with container runtimes

slide-67
SLIDE 67

# podman run --security-opt label=type:my_container.process -v /home:/home:rw -v /var/spool:/var/spool:ro -p 21:21 -it fedora bash # docker run --security-opt label=type:my_container.process -v /home:/home:rw -v /var/spool:/var/spool:ro -p 21:21 -it fedora bash # buildah bud --security-opt label=type:my_container.process -f Dockerfile .

slide-68
SLIDE 68

apiVersion: v1 kind: Pod metadata: name: udica-demo spec: containers:

  • name: udica

image: gcr.io/google-samples/node-hello:1.0 securityContext: seLinuxOptions: type: "my_container.process"

slide-69
SLIDE 69

QUESTIONS?

Demo https://github.com/demos/SELinuxEscape Udica https://github.com/containers/udica Podman https://podman.io Generic SELinux policy https://github.com/containers/container-selinux Udica PoC https://github.com/fedora-selinux/container-selinux-customizatio n

slide-70
SLIDE 70

linkedin.com/company/red-hat youtube.com/user/RedHatVideos facebook.com/redhatinc twitter.com/RedHat Red Hat is the world’s leading provider of enterprise open source software solutions. Award-winning support, training, and consulting services make Red Hat a trusted adviser to the Fortune 500.

Thank you

70