Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie sVirt: Hardening Linux Virtualization with Mandatory Access Control
Ähnlich wie sVirt: Hardening Linux Virtualization with Mandatory Access Control (20)
Mehr von James Morris
Mehr von James Morris (17)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
sVirt: Hardening Linux Virtualization with Mandatory Access Control
- 1. sVirt: Hardening Linux Virtualization with Mandatory Access Control James Morris Red Hat Security Engineering Linux.conf.au 2009 Hobart, Australia
- 2. Goal: Improve security for Linux virtualization
- 3. Linux Virtualization: Where the “hypervisor” is a normal Linux process
- 5. Host Userspace Guest Guest Guest Userspace Userspace Userspace Guest Guest Guest Kernel Kernel Kernel Host Kernel Host Hardware
- 6. Utilize existing process-based security mechanisms
- 7. DAC is not enough: Subjects can modify own security policy
- 8. Mandatory Access Control (MAC): Subjects cannot bypass security policy
- 9. Virtualization Threat Model (work in progress)
- 10. Virtualization introduces new security risks
- 11. Flawed hypervisor: Malicious guest breaks out, attacks other guests or host
- 12. Before virtualization: Systems were physically separated, damage limited to network attacks
- 13. Host Userspace Host Userspace Web Server DNS Server Host Kernel Host Kernel Host Hardware Host Hardware Attack Local Network
- 14. After virtualization: Guest systems running on same server, possibly as same UID
- 15. Host Userspace Guest Userspace Guest Userspace Guest Web Server Guest DNS Server Userspace Userspace Guest Guest local Guest Guest Kernel Kernel exploits Kernel Kernel Host Kernel Host Hardware memory, storage, etc.
- 16. Malicious or compromised guests can now attack other guests via local mechanisms
- 17. Hypervisor vulnerabilities: Not theoretical Evolving field Potentially huge payoffs
- 18. sVirt in a nutshell: Isolate guests using MAC security policy Contain hypervisor breaches
- 19. libvirt: Virtualization API by Daniel Veillard Abstraction layer for managing different virt schemes Xen, KVM, LXC, OpenVZ
- 20. Simplified libvirt architecture drivers host node hypervisors storage hypervisor Xen iSCSI KVM NFS guest OpenVZ logical guest LXC fs guest UML disk API storage virsh virt-manager
- 21. sVirt design: Pluggable security framework for libvirt Supports MAC security schemes (SELinux, SMACK)
- 22. sVirt design: Security “driver” manages MAC labeling of guests and resources MAC policy enforced by host kernel
- 23. Simplified libvirt architecture w/ SVirt drivers host node hypervisors storage security hypervisor Xen iSCSI SELinux * KVM NFS etc. guest OpenVZ logical guest LXC fs guest UML disk * API * security labels * * storage virsh virt-manager
- 24. sVirt design: Reuse of proven code and security models Coherent and complete system policy Reduced complexity and cost
- 25. sVirt design: Must be usable and useful with demonstrable value
- 26. sVirt v1.0: Provide simple isolation of guests Zero configuration Debuggable
- 27. SELinux Policy: Guests and resources uniquely labeled virtd_isolated_t:<UUID>
- 28. SELinux Policy: Coarse rules for all isolated guests applied to virtd_isolated_t
- 29. SELinux Policy: For simple isolation: all accesses between different UUIDs are denied
- 30. Host Userspace virtd_isolated_t:1 virtd_isolated_t:2 Guest Web Server Guest DNS Server Userspace Userspace Guest Guest Guest Guest Kernel Kernel Kernel Kernel Host Kernel SELinux Host Hardware virt_image_t:1 virt_image_t:2
- 31. Future enhancements: Different types of isolated guests virtd_isolated_webserver_t
- 32. Future enhancements: Virtual network security Controlled flow between guests Distributed guest security Multilevel security
- 33. Related work: Labeled NFS Labeled Networking XACE
- 34. Similar work: XSM (port of Flask to Xen) Several proprietary schemes
- 35. Current status: Low-level libvirt integration done Can launch labeled guest Basic label support in virsh
- 37. Questions...