Container Security
                Daniel J Walsh
		Consulting Engineer
		Twitter: @rhatdan
		Blog: danwalsh.livejournal.com
		Email: dwalsh@redhat.com

                Container Security
                <h1 style="color:#ff0000" class="fragment roll-in">As explained by the three pigs

                Container Security
                <p class="fragment roll-in">Chapter 1:When should I  use containers versus virtual machines?
                <p class="fragment roll-in">Chapter 2:What platform should host my containers?
                <p class="fragment roll-in">Chapter 3:How do I ensure container separation?
                <p class="fragment roll-in">Chapter 4: How do I secure content inside container?

                <img width="60%" src="images/cover_front.png"/>
                <h5 style="position:absolute; top:5%; left:33%;color:#000000;" width="50%"><b>Glossary</b><b>Pig == Application</b>
                Chapter 1Where should the pigs live?
                <img height="500" src="images/apartment-middle-ground.svg"/>
                <p class="fragment roll-in">When should I use containers versus virtual machines?
                Standalone Homes(Separate Physical Machines)
                <img height="500" src="images/houses.svg"/>
                Duplex Home(Virtual Machines)
                <img height="500" src="images/duplex.svg"/>
                Apartment Building(Containers)
                <img height="500" src="images/apartment-front-desk.svg"/>
                Hostel(Services Same Machine)
                <img height="500" src="images/hostel-sleepers.svg"/>
                Park(setenforce 0)
                <img height="500" src="images/park-bench-pigg.svg"/>
                http://stopdisablingselinux.com/
                <img src="images/sdsel.png" />
                Pigs in Apartment Buildings
                <img height="500" src="images/apartment-middle-ground.svg"/>
                <h4 class="fragment roll-in">Best combination resource sharingease of maintenance & Security.

                Chapter 2 - What kind ofapartment building?
                <img height="500" src="images/apt-building-bricks.svg"/>
                <h4 class="fragment roll-in">What platform should host your containers?
		
                Straw?
                <img height="500" src="images/apt-building-straw.svg"/>
                <h4 class="fragment roll-in">Running containers on do it yourself platform.
		
                Sticks?
                <img height="500" src="images/apt-building-sticks.svg"/>
                <h4 class="fragment roll-in">Running containers on community platform.
		
                Brick?
                <img height="500" src="images/apt-building-bricks.svg"/>
                <h4 class="fragment roll-in">Running containers on RHEL.
		
                RHEL Maintenance
                <img height="500" src="images/maintenance-pig.svg"/>
                <h4 class="fragment roll-in">Security Response Team.
		
                Chapter 3How do I separate/secure pig apartments?
                <img height="500" src="images/break-in-brick-apt.svg"/>
                <h4 class="fragment roll-in">How do you ensure container separation?
		
                <img height="650" src="images/leaky.png"/>
                <h3 style="position:absolute; top:15%; left:7%; color:#000000;">Containers do not Contain
		<pre>http://www.maritimenz.govt.nz/images/Incident-area/Rena7.jpg</pre>
                Do you care?
                Should you care?
                Treat Container Services just likeregular services
                <p class="fragment roll-in">Drop privileges as quickly as possible
                <p class="fragment roll-in">Run your services as non Root whenever possible
                <p class="fragment roll-in">Treat root within a container the same as root outside of the container
                <p class="fragment roll-in"><b>"Docker is about running random crap from the internet as root on your host"</b>
                <p class="fragment roll-in">Only run containers from trusted parties
                Why don't containers contain?
                <p class="fragment roll-in">Everything in Linux is not namespaced
                <p class="fragment roll-in">Containers are not comprehensive like virtual machines (kvm)
                <p class="fragment roll-in">Kernel file systems: /sys, /sys/fs, /proc/sys
                <p class="fragment roll-in">Cgroups, SELinux, /dev/mem, kernel modules
                Overview of Security within Docker containers
                Read Only Mount Points
                <p class="fragment roll-in">/sys, /proc/sys, /proc/sysrq-trigger,/proc/irq, /proc/bus
                Capabilities
                <pre class="fragment roll-in">
man capabilities

DESCRIPTION
     For  the  purpose  of  performing  permission  checks, traditional UNIX
     implementations distinguish two  categories  of  processes:  privileged
     processes  (whose  effective  user ID is 0, referred to as superuser or
     root), and unprivileged processes (whose  effective  UID  is  nonzero).
     <b>Privileged processes bypass all kernel permission checks</b>, while 
     unprivileged processes are subject to full permission checking based on
     the process's credentials (usually: effective UID, effective GID, and 
     supplementary group list).

     Starting with kernel 2.2, <b>Linux divides  the  privileges  traditionally
     associated  with  superuser into distinct units, known as capabilities,
     which can be independently enabled and disabled.</b>   Capabilities  are  a
     per-thread attribute.
</pre>
                Capabilities Removed
		<table><tr><td>CAP_SETPCAP</td><td>Modify process capabilities</tr>
		<tr><td>CAP_SYS_MODULE</td><td>Insert/Remove kernel modules</td></tr>
		<tr><td>CAP_SYS_RAWIO</td><td>Modify Kernel Memory</td></tr>
		<tr><td>CAP_SYS_PACCT</td><td>Configure process accounting</td></tr>
		<tr><td>CAP_SYS_NICE</td><td>Modify Priotity of processes</td></tr>
		<tr><td>CAP_SYS_RESOURCE</td><td>Override Resource Limits</td></tr>
		<tr><td>CAP_SYS_TIME</td><td>Modify the system clock</td></tr>
		<tr><td>CAP_SYS_TTY_CONFIG</td><td>Configure tty devices</td></tr>
		<tr><td>CAP_AUDIT_WRITE</td><td>Write the audit log</td></tr>
		<tr><td>CAP_AUDIT_CONTROL</td><td>Configure Audit Subsystem</td></tr>
		<tr><td>CAP_MAC_OVERRIDE</td><td>Ignore Kernel MAC Policy</td></tr>
		<tr><td>CAP_MAC_ADMIN</td><td>Configure MAC Configuration</td></tr>
		<tr><td>CAP_SYSLOG</td><td>Modify Kernel printk behavior</td></tr>
</table>
                Capabilities Removed
<table>
		<tr><td>CAP_NET_ADMIN</td><td>Configure the network</td></tr>
		<tr class="fragment roll-in"><td>CAP_SYS_ADMIN</td><td>Catch all</td></tr>
</table>
                SYS_ADMIN
                <pre class="fragment roll-in">
less /usr/include/linux/capability.h 
...
/* Allow configuration of the secure attention key */
/* Allow administration of the random device */
/* Allow examination and configuration of disk quotas */
/* Allow setting the domainname */
/* Allow setting the hostname */
/* Allow calling bdflush() */
/* Allow mount() and umount(), setting up new smb connection */
/* Allow some autofs root ioctls */
/* Allow nfsservctl */
/* Allow VM86_REQUEST_IRQ */
/* Allow to read/write pci config on alpha */
/* Allow irix_prctl on mips (setstacksize) */
/* Allow flushing all cache on m68k (sys_cacheflush) */
/* Allow removing semaphores */
/* Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores
   and shared memory */
/* Allow locking/unlocking of shared memory segment */
/* Allow turning swap on/off */
/* Allow forged pids on socket credentials passing */
/* Allow setting readahead and flushing buffers on block devices */
</pre>
                SYS_ADMIN
                <pre>
/* Allow setting geometry in floppy driver */
/* Allow turning DMA on/off in xd driver */
/* Allow administration of md devices (mostly the above, but some
   extra ioctls) */
/* Allow tuning the ide driver */
/* Allow access to the nvram device */
/* Allow administration of apm_bios, serial and bttv (TV) device */
/* Allow manufacturer commands in isdn CAPI support driver */
/* Allow reading non-standardized portions of pci configuration space */
/* Allow DDI debug ioctl on sbpcd driver */
/* Allow setting up serial ports */
/* Allow sending raw qic-117 commands */
/* Allow enabling/disabling tagged queuing on SCSI controllers and sending
   arbitrary SCSI commands */
/* Allow setting encryption key on loopback filesystem */
/* Allow setting zone reclaim policy */
</pre>
                Namespaces
		<p class="fragment roll-in">PID Name Space
		<p class="fragment roll-in">Network Name Space
                Cgroups
		Device Cgroup
		Should have been a namespace
		Controls which device nodes can be created within namespace
		<p class="fragment roll-in">Device nodes allow processes to configure kernel
		<table class="fragment roll-in"><tr><td>/dev/console</td><td>/dev/zero</td><td>/dev/null</td><td>/dev/fuse</td></tr><tr><td>/dev/full</td><td>/dev/tty*</td><td>/dev/urandom</td><td>/dev/random</td></tr><tr></tr></table>
		<p class="fragment roll-in"><b>images mounted with nodev</b>
                SELinux
		<h4 class="fragment roll-in">Everyone Please Stand Up and Repeat after me
		<p class="fragment roll-in">SELinux is a LABELING system
		<p class="fragment roll-in">Every Process has a LABEL
		<p class="fragment roll-in">Every File, Directory, System object has a LABEL
		<p class="fragment roll-in">Policy rules control access between labeled processes and labeled objects
		<p class="fragment roll-in">The Kernel enforces the rules

                <h2 style="color:#ff0000;">Grab yourSELinuxText Book

                Type Enforcement
                <img  width="600" src="images/type-enforcement_01_catdog.png" />
                Type Enforcement
                <img  width="600" src="images/type-enforcement_03_foods.png" />
                Type Enforcement
                <img  width="800" src="images/type-enforcement_04_policy.png" />
                Type Enforcement
                <img  width="600" src="images/type-enforcement_02_eat.png" />
                Type Enforcement
                <img  width="600" src="images/type-enforcement_05_tux-feed-cat.png" />
                Type Enforcement
                <img  width="600" src="images/type-enforcement_06_tux-dog-leash.png">
                Type Enforcement
                <p class="fragment roll-in">Protects the host system from container processes
                <p class="fragment roll-in">Container processes can only read/execute /usr files
                <p class="fragment roll-in">Container processes only write to container files.
                <table width="700" class="fragment roll-in"><tr><td>process type</td><td><b>svirt_lxc_net_t</b></td></tr><tr><td>file type</td><td><b>svirt_sandbox_file_t</b></td><td></tr></table>
                MCS Enforcement
                <p class="fragment roll-in">Multi Category Security
                <p class="fragment roll-in">Based on Multi Level Security (MLS)
                MCS Enforcement
                <img  width="600" src="images/mcs-enforcement_01_fido-spot.png">
                MCS Enforcement
                <img  width="600" src="images/mcs-enforcement_03_foods.png">
                MCS Enforcement
                <img  width="600" src="images/mcs-enforcement_05_fido-eat-fido-food.png">
                MCS Enforcement
                <img  width="600" src="images/mcs-enforcement_06_fido-no-spot-food.png">
                MCS Enforcement
                <p class="fragment roll-in">Protects containers from each other.
                <p class="fragment roll-in">Container Processes can only read/write their own files.
                <p class="fragment roll-in">Docker Daemon picks out unique random MCS Label.<b>s0:c1,c2</b>
                <p class="fragment roll-in">Assigns MCS Label to all content
                <p class="fragment roll-in">Launches the container processes with same label
                Docker Without SELinux
                <h2 class="fragment roll-in">
                Is like Tupperware without the burp
                <img width="700" src="images/Tupperware_Ultraplus.JPG" />
		Future
		<h4  class="fragment roll-in">seccomp
		<p class="fragment roll-in">Shrink the attack surface on the kernel
		<p class="fragment roll-in"><b>Eliminate syscalls</b>
		kexec_load, open_by_handle_at, init_module, finit_module, delete_module, iopl, ioperm, swapon, swapoff, sysfs, sysctl, adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init, kcmp
		<p class="fragment roll-in"><b>block 32 bit syscalls</b>
		<p class="fragment roll-in"><b>block old weird networks</b>
		Future
		<h4 class="fragment roll-in">User Name Space
		<p class="fragment roll-in">Map non root user to root within container
		<p class="fragment roll-in">Can we use it to protect the host?
		<p class="fragment roll-in">Can we protect one container from another?
		<p class="fragment roll-in">No file system support
                Chapter 4How do you furnish the pigs apartment?
                <img height="500" src="images/furniture-curbside.svg"/>
                <h4 class="fragment roll-in">How do I secure content inside container?
                LINUX 1999
                <p class="fragment roll-in">Where did you go to get software?
                <p class="fragment roll-in">Go to yahoo.com or AltaVista.com
and google it?
                <p class="fragment roll-in">I found it on rpmfind.net, download and install.
                <p class="fragment roll-in">Hey I hear there is a big Security vulnerability in Zlib.
                <p class="fragment roll-in">How many copies of the Zlib vulnerability to you have?
                <p class="fragment roll-in"><b>I have no clue!!!</b>
                Red Hat to the rescue
		<p class="fragment roll-in">Red Hat Enterprise Linux solved this problem
		<p class="fragment roll-in">Certified software and hardware platforms
                <img height="500" src="images/furniture-curbside.svg"/>
                <h4 class="fragment roll-in">People have no idea of quality of software in docker images
                <img height="500" src="images/furniture-diy.svg"/>
                <h4 class="fragment roll-in">Or they are building them themselves?
                Lets Talk About DEV/OPS
		<p class="fragment roll-in">Containers move the responsibility for security updates from the Operator to the Developer.
		    
		<p class="fragment roll-in">Do you trust developers to fix security issues in their images?
<video height="700" controls>
  <source src="images/trustbutverify.ogv" type="video/ogg">
  Fallback content: Your browser does not support the video tag.
</video>
                What happens when the next Shell Shock hits
                <img src="images/docker30.png" />
                <img height="500" src="images/furniture-white-glove.svg"/>
                <h4 class="fragment roll-in">RHEL Certified Images
                <img height="500" src="images/security-expert-piggy.svg"/>
                Red Hat Support and Security teams partnering with you to secure your software 
                Don't let this be you.
		<img width="500" src="images/piggy-platter.svg"/>
                <h2 class="fragment roll-in">Questions?