Containers and Security
Address Space Isolation in the Linux Kernel
February 1, 2020
4:00 PM – 4:50 PM Add to calendar
4:00 PM – 4:50 PM Add to calendar
K.1.105 (La Fontaine)
Security is a big problem especially in the cloud of container workloads. This presentation investigates improving security in the Linux kernel itself. The first target is securing sensitive application data, for instance, private keys.
Address space isolation has been used to protect the kernel and userspace programs from each other since the invention of the virtual memory.
Assuming that kernel bugs and therefore exploits are inevitable it might be worth isolating parts of the kernel to minimize damage that these exploits can cause. Moreover, restricted mappings in the kernel mode may improve mitigation of hardware speculation vulnerabilities.
There are several ongoing efforts to use restricted address spaces in Linux kernel for various use cases:
* speculation vulnerabilities mitigation in KVM
* support for memory areas visible only in a single owning context
* hardening of the Linux containers
We are going to present the approach for the implementation of restricted mappings in the Linux kernel and how this implementation would be used with various use-cases.
We are also going to take a closer look at possibility to assign an address space to the Linux namespaces, so that tasks running in namespace A have different view of kernel memory mappings than the tasks running in namespace B. For instance, by keeping all the objects in a network namespace private, we can achieve levels of isolation equivalent to running a separated network stack.
Additional information
| Type | maintrack |
|---|
More sessions
| 2/1/20 |
Free and Open Source software has revolutionized the Software Industry and nearly all other areas of human endeavor, but until now its reach into actual governance at the municipal citizen level has not been very deep. Initiatives like Code for America have encountered challenges driving acceptance for FOSS alternatives to proprietary software for citizen governance. At the same time the gap between citizen need and cities’ capabilities as widened. But several new projects are aiming to change ...
|
| 2/1/20 |
From ten years of LibreOffice, how can you apply what we learned to your project ? What is going on in LibreOffice today, and where is it going ? and How can you re-use or contribute to the story.
|
| 2/1/20 |
It has become very popular in the last several years to think of free and open source as a community forward activity, indeed the modern approach is to try and form a community or foundation first and do code second. There is also much talk about maintainer burn out and community exploitation. However, the same people who talk about this still paraphrase the most famous quote from the Cathedral and the Bazaar "Scratching your own itch". They forget this is your own itch not everyone else's ...
|
| 2/1/20 |
Over the past twenty years, the automation landscape has changed dramatically. As our hunger for complex technical infrastructure increased, and our inability to keep up with these demands faltered, we've outsourced a lot of the work to third-parties and cloud providers. We'll step backwards and show where we came from, and where we're going. If we don't understand this future, and step up to the challenge, then we eventually won't control our own computers anymore. We'll discuss this timeline ...
|
| 2/1/20 |
Internet of Things (IoT) devices are part of the future we were promised. Armed with our mobile devices, we can control everything from our cars to our toasters to the doors of our homes. Along with convenience, IoT devices bring us ethical quandaries, as designers and users. We need to consider the ethical implicates of the technologies we are building and ask ourselves not just about the ways they are being used, for both good and evil, but the potential use cases we might encounter in the ...
|
| 2/1/20 |
The presentation is going to be audiovisual and entertaining; based on a number of short videos I want to tell the story of Blender. Starting in late 90s, how Blender became open source, going over the big milestones for Blender, end ending with the fast growth of our project and the interest of the film and game industry. Blender now is a more mature project now, which involves a different dynamics than it used to be. How are we going to tackle the challenges of the industry, while not losing ...
|
| 2/1/20 |
Despite the number of working groups, advisory committees, and coordination roundtables, there is little progress towards creating more ethical and safe AI systems. AI systems are deployed in increasingly fragile contexts. From law enforcement to humanitarian aid, several organizations use AI powered systems to make or inform critical decisions with increasingly outsized side effects. What is a rights-based approach for designing minimally safe and transparent guidelines for AI systems? In this ...
|
