Security
Using SELinux with container runtimes
Lukas Vrabec built a new standalone tool, udica, for generating SELinux policy profiles for containers based on automatic inspecting these containers. We will focus on why udica is needed in the container world and how it can make SELinux and containers work better together.
We will show real examples where SELinux separation for containers had to be turned off because the generic SELinux type container_t was too tight. With a tool like “udica”, users and developers can easily customize the policy with limited SELnux policy writing skills. Come to see how easy also you can create custom SELinux policy for your containers!
This talk will explain how SELinux works with containers. We will show how to enable/disable SElinux using multiple different container runtimes and define the default types. One issue with these types is that they are tough to customize. The two default types for running containers are containert which is a fully confined domain, which eliminates any use of the host files unless they are relabeled. Or spct, which is the type containers run with when SELinux is disabled for container separation, --privileged mode. As an example, If you had a container that you wanted to be able to gather the logs from /var/log on the host and send them to a centralized server, you have to disable SELinux separation.
Writing custom policy for each container that needed additional access would be very difficult and require a container policy writer.
Additional information
| Type | devroom |
|---|
More sessions
| 2/1/20 |
What threats do we need to take into account when building a system? A key method for answering this question is an approach called threat modelling, whereby security problems can be anticipated during the design phase. This talk discusses major threat-modelling approaches, and includes concrete examples of how to apply them to software-intensive systems.
|
| 2/1/20 |
Management of allowed cryptographical algorithms to disallow algorithms not allowed due to weaknesses or restrictions by certification standards is complicated task. The talk will introduce system-wide crypto-policies concept and implementation as an attempt to help system administrators with this task. This talk replaces "OSINT" talk which was schedulled initially, but David Busby could not attend on the short notice.
|
| 2/1/20 |
Security vulnerabilities are still very common in todays software. Formal methods could improve the situation, but program verification remains a complex and time-consuming task. Often, the verification of existing software is infeasible and a complete rewrite can be prohibitively expensive. Both, however, is not necessarily required to improve on the current state. By replacing critical parts of an existing software by verified code, security can be strengthened significantly with moderate ...
|
| 2/1/20 |
Spectre-type attacks are a real threat to secure systems because a successful attack can undermine even an application that would be traditionally considered safe. SpecFuzz is the first tool that enables fuzzing for such vulnerabilities.
|
| 2/1/20 |
Linux Syscalls can be used as an entrypoint to do security analysis on Linux. However reading and processing every system call in userspace creates a very unique set of challenges. In this talk we are going to see exactly what those challenges are and how we solved them in the Falco project.
|
| 2/1/20 |
In this presentation we take under consideration the increased use of Docker in corporate environments. It is a fact that Docker has found wide spread of use during the past years, mostly because of it being very easy to use , economic w.r.t resources used, fast and easy to deploy when compared with a full blown virtual machine. More and more servers are being operated as Docker hosts on which micro-services run in containers. From a security point of view, two aspects of it arise in the context ...
|
| 2/1/20 |
Protocols in symmetric cryptography are often built from block ciphers, with a fixed input and output size, while variable sizes are handled through their modes of use. Incrementality, namely, the ability to efficiently compute the output for increasing inputs, or to request longer outputs, is often a property of the implementation rather than an explicit feature of a mode. A doubly-extendable cryptographic keyed (or deck) function is a new kind of object that makes incrementality an integral ...
|
