Walsh: Secure Virtualization Using SELinux (sVirt) [LWN.net]

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 0:31 UTC (Tue) by jspaleta (subscriber, #50639)
In reply to: Walsh: Secure Virtualization Using SELinux (sVirt) by dlang
Parent article: Walsh: Secure Virtualization Using SELinux (sVirt)

Is anyone...anywhere...working on AA policy that will provide the same protections as SVirt for any virtual host workload configuration which would help mitigate an attack vector from one virtual client to another like SVirt does with its security labels approach? And more specifically one that works with the Eucalyptus managed cloud architecture.

It's nice to say AA is easier to configure for site specific policy..great..yippie. Is anyone actually doing that with AA and configuring site specific policy for any virtualization workload that SVirt provides coverage for. If Canonical's UEC is the next big thing...there's been a distinct lack of discussion about security measures to protect attacks from other clients. I'm not seeing any discussion anywhere about how to use AA to mitigate the sort of things the SVirt developers are working on. Hell, Eucalyptus requires you to put Selinux into permissive mode last I checked so using the Selinux support in Ubuntu is probably not an option at all..even if they did support SVirt functionality in the SELinux implementation they offer.

If you can point me to any discussion concerning how to build AA policy to address the issues that SVirt addressess...please...point me to it.

-jef

to post comments

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 2:23 UTC (Tue) by dlang (guest, #313) [Link] (1 responses)

while I admit to taking things on a tangent away from the original article, I will say that I wasn't the one who first introduced AA.

no, I would not expect to see someone trying to use AA to create generic seperation between virtual machines.

I could very easily see someone configuring AA to lock down a specific virtual machine to keep it from accessing things that another virtual machine is allowed to access. it would be based on the knowledge of what that particular virtual machine is supposed to access.

but since it's possible to run the virtual machines as seperate users, it would also be very easy to use the standard unix permissions to isolate them from each other, with probably 90% of the security for <<10% of the effort of using something like SELinux (and probably <50% of the effort of using AA)

with AA, if you have well defined applications (which I freely admit many/most people don't) it's relatively easy to create an AA profile for it. each AA profile is pretty much independent from other AA profiles, so if you just check them for overlapping you can combine them easily.

SELinux doesn't have tools (at least not well publicized tools) that let you do this. instead you have to understand the entire system (all local uses as well as all remotely accessible applications) and then make one big policy that defines all files correctly for all the applications (and you still have the problem of creating the appropriate tags for new files that are created), it's not something that your normal sysadmin can do. it's very hard for even extremely experienced security people to do (and it doesn't help that the common response to problems is "you don't know enough to be tinkering there, just use what your distro provides you with")

SELinux is more powerful than AA, no question, but it's complexity (and interactions in it's config) make it hard enough to use that most people don't bother (and if you think that the distro default configs are appropriate, I disagree with you, they are far too open because the sitros can't possibly know what's appropriate for a particular installation)

AA is far less powerful, but (if it was available in the default kernel) far more likely to be used.

I am not an AA user, because (having been burned a few times), I make it a policy to not use features that aren't in the kernel.org kernel unless I _absolutely_ have to, and so far my need for additional local security have not been that high yet.

Walsh: Secure Virtualization Using SELinux (sVirt)

Posted Aug 25, 2009 2:28 UTC (Tue) by dlang (guest, #313) [Link]

by the way, I don't choose to use SELinux due to the complexity, but I do use commercial firewalls that use similar security systems, and my opinion of them is poor, due to the demand of users the real security of the system has been scaled back to the point that there is really almost nothing that can be done without being the equivalent of 'root', so the first command anyone ever types is makes them this root equivalent. this just about destroys the value of having separate users, let alone the MAC tagging and controls. the firewall vendor used to have several different roles, each with different permissions, but users of these expensive commercial firewalls were unhappy with that so the vendor scaled back the evvective security.