Custom SELinux container policies in OpenShift

on YouTube ↗38m

" summary

OpenShift cluster analysis finds 189 pods, 618 containers and 134 privileged containers, so this work shows a practical path to tighten container confinement by generating tailored SELinux modules from container runtime metadata. It uses udica templates and SELinux policy block inheritance to produce a minimal module for mounts, ports and capabilities, then an operator installs and namespaces the module with RBAC and a validating webhook. Demo generates and applies a policy for a /var/log host mount and mostly works, with installation status, capability handling and UX improvements still pending. udica SELinux policy operator

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 0:29Who are we
3. 1:12Who are you
4. 2:24Why
5. 3:52Labels
6. 4:19Policy
7. 6:04Container policy
8. 7:37Multilevel security
9. 10:11Current situation
10. 15:28under the hood
11. 17:47about the project
12. 20:24live demo
13. 33:55next steps

" related talks

• 44mUsing SELinux with container runtimesDaniel Walsh, Lukas Vrabec · DevConf.CZ 2019
• 45mSELinux All the Way Down: Namespaces for SELinuxStephen Smalley · Linux Security Summit North America 2025
• 32mContainer and Kubernetes security policy designReza Ramezanpour · Conf42 Cloud Native 2023
• 42mImproving Containers Isolation in KubernetesCosmin Cojocar · ContainerCon @ Open Source Summit North America 2023
• 31mOverview and Recent Developments: SELinuxPaul Moore · Linux Security Summit Europe 2018
• 19mSELinux UpdatePaul Moore · Linux Security Summit Europe 2025
• 43mContainer Security: So Many Options, Use Them All!Sally OMalley, Matthew Heon · DevConf.CZ 2019
• 30mFinding Imposter Among Us: Container EditionBarun Acharya · KCD Mumbai 2023