Using a Different LSM from the Host in a Container
summary
Shows how to run AppArmor inside a container when the host uses SELinux or Smack by combining LSM stacking, a display LSM virtual view and AppArmor’s own policy namespaces composed with host confinement. Describes concrete fixes: virtualize aa_enabled and proc/securityfs entries, change AppArmor to call capabilities directly, compress/store policy for CRIU, and special handling for seccomp/no_new_privs and userns→policyns mapping. Demonstrates LXD support with a working Fedora→Ubuntu container after those changes; notes remaining kernel hook work for full generality.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:53Containers
- 1:07LSM
- 1:30Namespacing
- 2:14Multiple LSMs
- 2:52Interfaces
- 3:58Display LSM
- 4:41Multiple LSM
- 5:58Why
- 7:36A Primer
- 10:47Simple Container
- 13:00Premier Policy
- 13:52Security FS
- 14:51Kernel Virtualization
- 15:55More Issues
- 16:05Container Security FS
- 17:15No New Proves
- 18:36Stacking Internal bounding
- 20:02Nesting of containers
- 20:55User namespaces
- 21:27What we can do
- 23:01LXDE
- 23:23LXDE Demo
- 24:22Dynamic LSM stacking
- 26:01No new probes
related talks
01h 14mLSM Updates: IMA, SELinux, AppArmor, SMACK &...
15mSubsystem Update: LSM Stacking - What You Can Do Now and What's Next
38mOn the Way to Safe Containers
33mSecurity Module Stacks That Don't Fall Over
30mFinding Imposter Among Us: Container Edition
30mSecurity Module Stacks that Don't Fall Over
50mImproving Container Security with System Call Interception
45mSELinux All the Way Down: Namespaces for SELinux