Security Namespace: Making Linux Security Frameworks Available to Containers
summary
Introduces a kernel abstraction called security namespaces that lets each container hold its own IMA and AppArmor state and policy while preserving global safety by routing requests to every namespace that might be affected. Implementation adds two clone flags and ~20 lines to container tooling, plus IMA and AppArmor namespace code; measurements show <0.7% extra syscall latency and nearly identical web-server throughput. Key components are operation router and policy engine for conflict detection.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:38Container vs. Virtual Machines
- 1:15Is Kernel Sharing All Good?
- 3:08Integrity Attestation for Container (Cont.)
- 4:30Mandatory Access Control for Container
- 5:26Goal: Security Namespace
- 7:33Background: Namespaces and Container
- 8:59A Strawman Design
- 12:10Attack in Strawman Design (Cont.)
- 13:48Challenges
- 14:52Insights
- 15:56Solution Overview
- 17:21Operation Router
- 20:10An Object's Perspective
- 22:24Policy Engine
- 23:08Implementation
- 24:39Evaluation: AppArmor Namespace (Cont.)
- 25:25Sharing, Sharing, Conflicts, Conflicts
- 26:59Evaluation: Performance
- 28:31Summary
- 30:48SELinux Namespace
related talks
47mNamespacing the Linux Integrity Measurement Architecture
57mNamespaces for Security
45mSELinux All the Way Down: Namespaces for SELinux
30mRestricted Address Spaces for Container Security
45mMaking Containers Safer
48mState of Linux Kernel Container Features
47mContainer Security
32mLinux user namespaces: a blessing and a curse