Walsh: Secure Virtualization Using SELinux (sVirt) [LWN.net]

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 0:14 UTC (Tue) by dlang (guest, #313)
In reply to: Walsh: Secure Virtualization Using SELinux (sVirt) by jspaleta
Parent article: Walsh: Secure Virtualization Using SELinux (sVirt)

app armor suffers from not being in the upstream kernel.

now that path based LSM hooks are available upstream, I would love to see AA updated to use them and resubmitted for inclusion.

personally I think that in practical terms AA is more useful (it's easier for an admin to understand, and therefor configure properly for their system)

I don't consider _any_ generic, out-of-the-box distro config to be reasonable (for AA or for SELinux). the specifics of what a particular service needs to do can change so drasticly from one application to another that there is no chance that a generic config can both protect the system and be broad enough to allow everything to work.

to post comments

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 0:31 UTC (Tue) by jspaleta (subscriber, #50639) [Link] (2 responses)

Is anyone...anywhere...working on AA policy that will provide the same protections as SVirt for any virtual host workload configuration which would help mitigate an attack vector from one virtual client to another like SVirt does with its security labels approach? And more specifically one that works with the Eucalyptus managed cloud architecture.

It's nice to say AA is easier to configure for site specific policy..great..yippie. Is anyone actually doing that with AA and configuring site specific policy for any virtualization workload that SVirt provides coverage for. If Canonical's UEC is the next big thing...there's been a distinct lack of discussion about security measures to protect attacks from other clients. I'm not seeing any discussion anywhere about how to use AA to mitigate the sort of things the SVirt developers are working on. Hell, Eucalyptus requires you to put Selinux into permissive mode last I checked so using the Selinux support in Ubuntu is probably not an option at all..even if they did support SVirt functionality in the SELinux implementation they offer.

If you can point me to any discussion concerning how to build AA policy to address the issues that SVirt addressess...please...point me to it.

-jef

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 2:23 UTC (Tue) by dlang (guest, #313) [Link] (1 responses)

while I admit to taking things on a tangent away from the original article, I will say that I wasn't the one who first introduced AA.

no, I would not expect to see someone trying to use AA to create generic seperation between virtual machines.

I could very easily see someone configuring AA to lock down a specific virtual machine to keep it from accessing things that another virtual machine is allowed to access. it would be based on the knowledge of what that particular virtual machine is supposed to access.

but since it's possible to run the virtual machines as seperate users, it would also be very easy to use the standard unix permissions to isolate them from each other, with probably 90% of the security for <<10% of the effort of using something like SELinux (and probably <50% of the effort of using AA)

with AA, if you have well defined applications (which I freely admit many/most people don't) it's relatively easy to create an AA profile for it. each AA profile is pretty much independent from other AA profiles, so if you just check them for overlapping you can combine them easily.

SELinux doesn't have tools (at least not well publicized tools) that let you do this. instead you have to understand the entire system (all local uses as well as all remotely accessible applications) and then make one big policy that defines all files correctly for all the applications (and you still have the problem of creating the appropriate tags for new files that are created), it's not something that your normal sysadmin can do. it's very hard for even extremely experienced security people to do (and it doesn't help that the common response to problems is "you don't know enough to be tinkering there, just use what your distro provides you with")

SELinux is more powerful than AA, no question, but it's complexity (and interactions in it's config) make it hard enough to use that most people don't bother (and if you think that the distro default configs are appropriate, I disagree with you, they are far too open because the sitros can't possibly know what's appropriate for a particular installation)

AA is far less powerful, but (if it was available in the default kernel) far more likely to be used.

I am not an AA user, because (having been burned a few times), I make it a policy to not use features that aren't in the kernel.org kernel unless I _absolutely_ have to, and so far my need for additional local security have not been that high yet.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 2:28 UTC (Tue) by dlang (guest, #313) [Link]

by the way, I don't choose to use SELinux due to the complexity, but I do use commercial firewalls that use similar security systems, and my opinion of them is poor, due to the demand of users the real security of the system has been scaled back to the point that there is really almost nothing that can be done without being the equivalent of 'root', so the first command anyone ever types is makes them this root equivalent. this just about destroys the value of having separate users, let alone the MAC tagging and controls. the firewall vendor used to have several different roles, each with different permissions, but users of these expensive commercial firewalls were unhappy with that so the vendor scaled back the evvective security.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 9:31 UTC (Tue) by danpb (subscriber, #4831) [Link] (4 responses)

> I don't consider _any_ generic, out-of-the-box distro config to be
> reasonable (for AA or for SELinux). the specifics of what a particular
> service needs to do can change so drasticly from one application to
> another that there is no chance that a generic config can both protect the
> system and be broad enough to allow everything to work.

This may have been accurate in previous version of Fedora <= 10), but this is a problem we explicitly tried to address in the sVirt project for Fedora >= 11.

For example, in old way of doing things in Fedora 10, the policy required that all QEMU/KVM disk images lived under /var/lib/libvirt/images. To deviate from this, the admin would need to manually change the policy or relabel files.

In Fedora 11 with the introduction of sVirt, libvirtd itself takes care of all disk labelling. So no matter where you, as an admin, decide to place files for virtual disks, libvirtd will set the correct labelling. It will also set correct labelling if you give a guest a physical disk/partition from the host. So the admin does not have to do any manual labelling of disks, nor are they restricted in where they can store them.

In Fedora 12, the automatic labelling is being taken further, so that libvirt will set correct labelling for any host USB or PCI devices that are assigned to the guest OS, removing another configuration from the admin.

This is the benefit of integrating SELinux support directly into applications, instead of having it applied as a separate layer - you are no longer restricted to a static policy.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 19:24 UTC (Tue) by SEJeff (guest, #51588) [Link] (3 responses)

And what if you store your images on NFSv3 using something like a NetAPP filer? WAFL doesn't support anything fancy like SELinux xattrs last I checked. What would you suggest be done in this situation?

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 20:02 UTC (Tue) by mmcgrath (guest, #44906) [Link]

> And what if you store your images on NFSv3 using something like a NetAPP filer?

Most netapps fully support iscsi. That's how we run images in Fedora's Infrastructure, iscsi + lvm on netapps.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 22:18 UTC (Tue) by jamesmrh (guest, #31622) [Link]

We're working on getting labeling support into NFS -- it's not easy.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 22:55 UTC (Tue) by danpb (subscriber, #4831) [Link]

NFS really sucks in this respect and there's no real satisfactory answer, since SELinux requires xattr labelling support on FS. So you won't get the sVirt per-guest disk image isolation on NFS at this time, only block device, local filesystems, or more advanced network FS' like GFS which can do xattr.