eaedbd454c
Update everything including the current linuxkit/containerd:b1766e4c4c09f63ac4925a6e4612852a93f7e73b to the new linuxkit/containerd:deaf5bf838bf7f131c2287ecff3ed9835b0497e2. Signed-off-by: Ian Campbell <ian.campbell@docker.com>
IMA
IMA stands for Integrity Management Architecture. The basic idea is to prevent
userspace from even opening files that have been mutated, by tracking file
content via a hash in the security.ima extended attribute. IMA supports
keeping track of these hashes and signing the result via the TPM, and a host of
other features.
Today, this is not namespace aware, so there is no way to differentiate in IMA's appraisal output between files in one mount namespace vs another, which makes this not particularly useful for container engines. The goal of this patchset is to make IMA namespace aware.
IMA namespace patches
These are draft patches for an implementation of IMA namespacing. They are currently a rebased version of the v1 set posted here 1.
Usage
Let's suppose you have some sensitive files owned by a particular user that you want to keep secure:
sensitive=/tmp/foo
user=71452
mkdir -p $(dirname $sensitive) && echo "hello" > $sensitive
chown $user $sensitive
To use IMA in the per-namespace mode, you need ima_appraise=enforce_ns on the kernel CLI (this is done in the yaml file). Then, the userspace interface looks something like this:
# create a new mount namespace
unshare -m
# enable per-ns policy for this new namespace
nsid=$(readlink /proc/self/ns/mnt | cut -c '6-15')
echo ${nsid} > /sys/kernel/security/ima/namespaces
# set the policy (we use tmpfs magic here since that's all that linuxkit
# has available to write to for this example)
TMPFS_MAGIC=0x01021994
printf "appraise fsmagic=$TMPFS_MAGIC fowner=$user\nappraise func=MODULE_CHECK" > /sys/kernel/security/ima/$nsid/policy
hash=$(echo -e "\x4$(openssl dgst -sha256 -binary $sensitive)")
setfattr -n security.ima -v "${hash}" $sensitive
And now you should be able to see things failing:
moby:/# echo foo > /tmp/foo
moby:/# cat /tmp/foo
[ 3233.681544] audit: type=1800 audit(1495131746.610:29): pid=384 uid=0 auid=4294967295 ses=4294967295 op="appraise_data" cause="invalid-hash" comm="cat" name="/tmp/foo" mnt_ns=4026532208 dev="tmpfs" ino=13105 res=0
cat: can't open '/tmp/foo': Permission denied