Linux Container Security

Oct. 23rd, 2014 08:44 am
[personal profile] mjg59
First, read these slides. Done? Good.

Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].

Does this mean containers provide reduced security? That's an arguable point. In the event of a new kernel vulnerability, container-based deployments merely need to upgrade the kernel on the host and restart all the containers. Full VMs need to upgrade the kernel in each individual image, which takes longer and may be delayed due to the additional disruption. In the event of a flaw in some remotely accessible code running in your image, an attacker's ability to cause further damage may be restricted by the existing seccomp and capabilities configuration in a container. They may be able to escalate to a more privileged user in a full VM.

I'm not really compelled by either of these arguments. Both argue that the security of your container is improved, but in almost all cases exploiting these vulnerabilities would require that an attacker already be able to run arbitrary code in your container. Many container deployments are task-specific rather than running a full system, and in that case your attacker is already able to compromise pretty much everything within the container. The argument's stronger in the Virtual Private Server case, but there you're trading that off against losing some other security features - sure, you're deploying seccomp, but you can't use selinux inside your container, because the policy isn't per-namespace[2].

So that seems like kind of a wash - there's maybe marginal increases in practical security for certain kinds of deployment, and perhaps marginal decreases for others. We end up coming back to the attack surface, and it seems inevitable that that's always going to be larger in container environments. The question is, does it matter? If the larger attack surface still only results in one more vulnerability per thousand years, you probably don't care. The aim isn't to get containers to the same level of security as hypervisors, it's to get them close enough that the difference doesn't matter.

I don't think we're there yet. Searching the kernel for bugs triggered by Trinity shows plenty of cases where the kernel screws up from unprivileged input[3]. A sufficiently strong seccomp policy plus tight restrictions on the ability of a container to touch /proc, /sys and /dev helps a lot here, but it's not full coverage. The presentation I linked to at the top of this post suggests using the grsec patches - these will tend to mitigate several (but not all) kernel vulnerabilities, but there's tradeoffs in (a) ease of management (having to build your own kernels) and (b) performance (several of the grsec options reduce performance).

But this isn't intended as a complaint. Or, rather, it is, just not about security. I suspect containers can be made sufficiently secure that the attack surface size doesn't matter. But who's going to do that work? As mentioned, modern container deployment tools make use of a number of kernel security features. But there's been something of a dearth of contributions from the companies who sell container-based services. Meaningful work here would include things like:

  • Strong auditing and aggressive fuzzing of containers under realistic configurations
  • Support for meaningful nesting of Linux Security Modules in namespaces
  • Introspection of container state and (more difficult) the host OS itself in order to identify compromises

These aren't easy jobs, but they're important, and I'm hoping that the lack of obvious development in areas like this is merely a symptom of the youth of the technology rather than a lack of meaningful desire to make things better. But until things improve, it's going to be far too easy to write containers off as a "convenient, cheap, secure: choose two" tradeoff. That's not a winning strategy.

[1] Companies using hypervisors! Audit your qemu setup to ensure that you're not providing more emulated hardware than necessary to your guests. If you're using KVM, ensure that you're using sVirt (either selinux or apparmor backed) in order to restrict qemu's privileges.
[2] There's apparently some support for loading per-namespace Apparmor policies, but that means that the process is no longer confined by the sVirt policy
[3] To be fair, last time I ran Trinity under Docker under a VM, it ended up killing my host. Glass houses, etc.

[picspam] mooooooore Kew

Oct. 22nd, 2014 08:09 pm
kaberett: Overlaid Mars & Venus symbols, with Swiss Army knife tools at other positions around the central circle. (Default)
[personal profile] kaberett
The shot I was most pleased with from last trip in early October: three lilypads in a row, in different colours.


Another seven photos. )

And my absolute favourite shot, from the oak walk (where I was very excitable and very pleased by ALL THE OAKS), is light through oak leaves:
kaberett: Photo of a pile of old leather-bound books. (books)
[personal profile] kaberett
... to be titled "This didn't annoy me.", with possible subcategories of "this book only annoyed me a bit" and "this annoyed the shit out of me but to my bafflement I still appear to extremely impatient for the sequel to come out".

Brought to you by once again finding myself describing Max Gladstone as "not annoying", when it might be more informative to say "he's writing about trans stuff and recovery from serious injury stuff and he just keeps getting it right to the extent that I had to reread to be sure I'd correctly understood the entire lack of awful, and then I burst into tears on the celeriac".
kaberett: a watercolour painting of an oak leaf floating on calm water (leaf-on-water)
[personal profile] kaberett
As a species, we are dedicated
to post hoc rationalisation:
the tidying away of inconvenient emotion
the reduction of the self
to an ordered
             sequence
                     of steps.
If this, then that. Well, no:
everything happens for a reason.
The reason, though, does not come carved deep into stone
(every conceivable dictator
being characterised by sublime indifference):
but is rather what you make of it.
This is what it means to tell the story of your life:
to take your whys and somehow give them form.
This is the solid ground of poetry:
two roads diverged; think, two things, both at once:
and every meaning you create is true
or true enough for now. Is this about...?

Yes. Yes, it is.

If only for this moment, we
are mirrored mirror twins.
I only wish I'd any clue
along which lines I'd break.

Vid: Mai/Zuko - As I Am

Oct. 21st, 2014 11:09 am
attackfish: Yshre girl wearing a kippah, text "Attackfish" (Default)
[personal profile] attackfish posting in [community profile] white_lotus
Title: Mai/Zuko: As I Am
By: [personal profile] attackfish
Rating: All clips are from a TV Y-7 show
Characters/Ships: Mai and Zuko, Mai/Zuko.
Spoilers: For all of Avatar: the Last Airbender.
Content Notes: No, by some miracle.
Summary: Zuko asks Mai to see him as he is and love him anyway. She does. Set to Heather Dale's "As I Am".

Creator commentary and video embed on my dreamwidth account at the link below:

Mai/Zuko: As I Am

... the Internet is magic.

Oct. 21st, 2014 12:12 am
kaberett: A pomegranate, with eyes and mouth drawn onto masking tape and applied (pomegranate)
[personal profile] kaberett
OKAY, so, back in 2007 I went on a school trip to Rome for a long weekend. On our one free early-afternoon I ended up getting to spend much less time at San Clemente than I'd intended, because Italian lunch hours, which in turn lead to me and the others I was with eating one of the best restaurant meals I had ever had for astonishingly little money, and it was only as we were leaving that we noticed the discreet stickers on the door about the place having been voted best-restaurant-in-Rome the preceding two years running.

My mother will be in Rome next weekend.

My mother, who remembers me rhapsodising about this place, asked me if I could recall the name.

... as it happened, I could remember (1) that the name started with an N and (2) the approximate walking route to get to it from San Clemente. Ergo five minutes with online maps later I had identified La Naumachia as the most plausible candidate, despite a rebrand having apparently done away with the very memorable logo of a ship. I look forward to hearing her report on it.

(Having explained how I found it, she responded: HAH!!!! That's the sort of thing I do. Indeed it's how the rat I ever found the same hotel I stayed in back then.... you come out of the back gate of the Inquisition past the best water fountain in Rome, go under a bridge past a dubious bus stop and up the hill most of the way to the next metro station....)

Dear Yuletide Author

Oct. 20th, 2014 01:52 pm
kaberett: Toph making a rock angel (toph-rockangel)
[personal profile] kaberett
Thank you so much for writing for me! I am delighted and grateful. :-)

In general I'm a massive queermo and very much in favour of Queers Being Awesome and Trans Folk Being Awesome and Ladies Being Awesome etc etc. I also have a lot of feelings about families lost and found and chosen. I'm not terribly interested in sex (er, in general, though also reading about it); I don't object but please do not feel obliged! By mid-winter I tend to be feeling a bit miserable so happy endings are much appreciated, but getting there the hard way isn't a problem.

I am sure I will love whatever it is you write! I am only too pleased for you to follow your own muse and will adore the result. (Tell me if I'm being too effusive?) However, slightly more specific notes on requests follow if you want something to bounce off.

Read more... )

Thank youuuuuuuu <333

todo/tada

Oct. 18th, 2014 05:28 pm
kaberett: Overlaid Mars & Venus symbols, with Swiss Army knife tools at other positions around the central circle. (Default)
[personal profile] kaberett
Brain still all over the place. Sleeping lots, then finding it hard to remember what all I've actually achieved, and therefore getting sad and edgy about not ~doing anything~, so let's make a list.

tada )

todo )

Someone tell me

Oct. 18th, 2014 02:55 pm
kaberett: Overlaid Mars & Venus symbols, with Swiss Army knife tools at other positions around the central circle. (Default)
[personal profile] kaberett
not to write the selkie novel this November? (Yep, that snippet is about selkies - when listening to Still Catch The Tide on repeat, I found myself wondering what it would take for a selkie to choose to destroy her sealskin, and then things kind of... spiralled. I have only a very broad-brush outline and part of the point of trying to NaNo it would be to find out what the hell's going on! BUT it is still not necessarily a good idea for me to try to the thing.)

{no one is lost}

Oct. 17th, 2014 01:39 pm
kaberett: a watercolour painting of an oak leaf floating on calm water (leaf-on-water)
[personal profile] kaberett
I keep noticing that I am underestimating my relative competence at coding. I think this is probably because I hang out with a lot of highly skilled programmers, so I am very aware of all the things I can't do and much too ready to dismiss the things I can. Yo, self, you teach this shit and you write 4am scripts to do the thing you want because nothing else will and you would actually be employable in this field. You're good at this.

Twice this week more senior PhD students have asked me about chemistry (in at least one instance resulting in me going "... this really doesn't smell like hexanol" alone in a lift). I know I was good at organic chemistry; this is... a useful reminder of my skill sets.

And I'm writing poetry that is, however much it surprises me that this is the case, the equal of a lot of stuff that's been professionally published. This, too, I can acknowledge and be proud of.
gerald_duck: (nightmare)
[personal profile] gerald_duck
  1. Trim fingernails
  2. Go to airport
  3. Put penknife in checked-in baggage
  4. Go airside
  5. Buy packet of popcorn
  6. Eat popcorn
  7. Get grist stuck between teeth
  8. Realise fingernails are absent and toothpick is somewhere in the bowels of the airport.
Now I'm wondering if there's any cheap and easy way to lay my hands on a toothpick or toothpick-substitute airside, or if I have to wait until baggage reclaim. At least it's a short flight…

People don't know their classics

Oct. 16th, 2014 01:52 pm
simont: (Default)
[personal profile] simont

At work the other day a fellow developer and I were discussing incomplete array types in C, and at one point in the conversation he referred to them using a phrase which gave me a perfect opportunity to reply ‘Arrays of Unspecified Size? I don't think they exist.’ Sadly, I got a blank look.

And today at lunchtime there was a silly conversation about a car park that had collapsed due to subsidence, on a site with a large rabbit population. It was suggested that the rabbits might have undermined the car park, and someone else said ‘no, don't blame the rabbits’. Of course this is a feed line which physically cannot have any other reply than ‘Bunnies, bunnies, it must be bunnies’ – which elicited no evidence of recognition from any of about six people.

Bah. People don't know their classics!

[poem] Only This

Oct. 16th, 2014 01:00 am
kaberett: a watercolour painting of an oak leaf floating on calm water (leaf-on-water)
[personal profile] kaberett
And if the Earth should be too great a gift
(too inconvenient, too delicate, too messy)
then I will give my self to you instead
(for all the same might well be said of me).
I conceive myself in motion. I believe
myself most wholly in these momentary
scraps of grace; perhaps what scares me most
is to be still. The closest, I suspect, that I will come
is falling into orbit around your indifferent sun.

Okay so like

Oct. 15th, 2014 07:58 pm
kaberett: Photo of a pile of old leather-bound books. (books)
[personal profile] kaberett
an excellent way to make me SHAKE MY FIST AT THE SKIES and refuse to ever read anything you've written ever again, okay

is to use the metaphor

"dull as rock"

JUST SAYING.

(In fact I'd be less disproportionately irritated by it if it weren't for all the other things in this book that're pissing me off -- Babel-17, Samuel R Delaney, WHY IS IT SO FULL OF REALLY LAZY SIZEISM, WHY, HE CAN CLEARLY WRITE BETTER THAN THAT, and that is not all said the Cat in the hat -- but hey! This is, I think, going to be good shorthand for my frustrations with him. Though, er, anyone feel like telling me whether the sizeism is as rampant and infuriating in his other stuff? Because if it is I'll just continue pretending that Dhalgren is a queer utopia - haven't read it - and read Octavia Butler instead, wah-wah.)
gerald_duck: (necro)
[personal profile] gerald_duck
(Don't touch that dial — I'm using the word "Devil", but this posting isn't about religion.)


Once in a while, there's an XKCD cartoon which, though characteristically thought-provoking, feels likely to lead to misunderstandings.

One such was Correlation. I liked it enough to buy the t-shirt, which has provided several people with a good laugh, but it does seem a lot of people misunderstand the use of the word "imply".

Correlation doesn't entail correlation, but it does suggest it. In that formal sense, "imply" is used to mean "entail" rather than "suggest".

More recently, there's been The Sake of Argument. This time, it feels like the important word is "play". "Playing Devil's Advocate" isn't the same thing as "being Devil's Advocate". As Wikipedia explains, it is often useful to test a proposition thoroughly even if all present are broadly in favour, simply to lessen the risk of groupthink. One plays Devil's Advocate not to have an argument for it's own sake, but for the sake of having an argument that is recognisably beneficial to have.

Alternatively, one can play Devil's Advocate even when thoroughly convinced, simply in order to hone arguments against the day when one encounters a person prepared to be the Devil's Advocate.


So…


Ebola kills proportion F of people who catch it. If we treat someone who has Ebola in hospital, on average C medical staff will catch Ebola off them. And in turn need treating in hospital, so that C medical staff catch Ebola off each of them. And so on.

Doing the maths, this means that each time we find an Ebola sufferer "in the wild" an average of F/(1-C) people will die. (The formula is only valid for C<1. If C is 1 or more, we have bigger problems.)

There is an alternative strategy: whenever we find someone with Ebola, kill them at once and incinerate their remains. That process is not risk-free. If an average of E "exterminators" catch Ebola from each person they kill, that strategy results in 1/(1-E) people dying for each sufferer in the wild.

Currently, it looks like F is about 70%. If, say, E=10% then killing people with Ebola rather than treating them results in fewer deaths unless we can get C below 37%.

But the situation is worse than that, because when someone presents with symptoms indicative of Ebola, the question arises whether to treat them until the tests come back, or just kill them straight away. If the probability they have Ebola is P then treating them causes PF/(1-C) deaths and killing them causes 1 + PE/(1-E) deaths.

Suppose fatality F=70%, risk to exterminators E=10% and the best we can do on communicability to health workers is C=40%, it then follows that we can reduce overall deaths by killing everyone who is 95% likely to have Ebola.

Right now, our sample size in countries with modern healthcare systems is pretty small, but even C=0.5 may be optimistic unless people buck their ideas up.


All this takes the strictly utilitarian position that human lives are fungible. That two dead people is strictly worse than one dead person. That 1.01 dead people is strictly worse than 1.0 dead people. That there is no merit in letting people die of bleeding uncontrollably out of orifices they didn't even know they had rather than being hunted down by death squads with hazmat suits and Tazers.

If we don't think that killing anyone who's likely to have Ebola for the greater good is a rational response to the crisis, we need to come up with a good reason why not. Preferably before people take the law into their own hands. History, particularly the history of plagues and witch hunts, has a lot to teach us.

Oh fuck the new Stars album

Oct. 15th, 2014 11:17 am
kaberett: a patch of sunlight on the carpet, shaped like a slightly wonky heart (light hearted)
[personal profile] kaberett
When you've counted the cost, repeat after us
No one is lost
No one is lost
No one is lost

(thank you thank you thank you [personal profile] littlebutfierce; if you're that way inclined you can stream it at Spotify or buy direct from the band.)
kaberett: Grinning emoticon. (:D)
[personal profile] kaberett
Sainsbury's Basics Italian Hard Cheese is vegetarian again!