IMA Namespaces for Containers
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 15:55· Room 0B (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Adds a new IMA namespace so each container gets vpcr virtual PCRs that extend into a per-container cpcr and then into physical TPM PCR 12, with kernel patches plus changes to runc/containerd/CRI/kubelet and a Kubernetes Integrity controller plus tester daemonset and verifier pod. Prototype records container file hashes, links them to the TPM for remote attestation and reports mismatches to Kubernetes. Works end-to-end in tests but has open problems: pod deletion breaks PCR chains, NFS lacks extended attributes, stateful and multi-container pods remain unsolved; no performance numbers yet.
AI-written summary · about
chapters (7)
- 0:00Introduction and background
- 1:40Linux IMA and TPM basics
- 4:41IMA namespaces in containers
- 8:28Technical implementation
- 14:25Kubernetes integration
- 19:30Integrity verification
- 23:04Roadblocks and conclusion
related talks
47mNamespacing the Linux Integrity Measurement Architecture
08mIn Containers We Trust? Building Trust in Containerized Environments
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers
28mIMA Update: Lessons Learned from Re-implementing IMA-measurement in User Space
30mRestricted Address Spaces for Container Security
20mExtending Non-Repudiable Logs with eBPF
41mA Canonical Event Log Structure for IMA
35mIntegrity Measurements and the Cruel World