Overlayfs And Containers. Miklos Szeredi, Red Hat Vivek Goyal, Red Hat
|
|
|
- Trevor Blair
- 5 years ago
- Views:
Transcription
1 Overlayfs And Containers Miklos Szeredi, Red Hat Vivek Goyal, Red Hat
2 Introduction to overlayfs
3 Union or? Union: all layers made equal How do you take the union of two files? Or a file and a directory? NO! Layers can t be treated equal
4 ...overlay! Layer upon layer upon layer Only upper layer can be modified copy-up (exception: directory contents) Objects in one layer cover up objects with the same name in layer(s) below Exception: directories, which are merged Exception for the exception: opaque directories One more exception: whiteout covers up anything and makes it look like nothing
5 Design Userspace API (most important!) No new object types Whiteout -> char dev with 0/0 device number Opaque dir -> xattr Make it as simple as possible (and not a bit simpler) Most of the logic is in a separate filesystem module Some VFS impact but not much; some FS impact but not much Upstream early It doesn t have to do everything right; features can be added later...
6 Implementation Separate cache for the overlay directory tree Allows less impact on VFS/FS BUT bad for memory use Shared cache for the file contents Copy-up when opened for write (may be too early) Ugliness when copy-up happens while file is already open read-only BUT great for performance and memory use Limitations modifying lower layer -> don t care Not (yet) a POSIX filesystem (st_dev/ino quirks, directory rename, hard link copy-up, etc)
7 Features added later Multiple lower layers Renaming directories SELinux POSIX ACL File locking
8 Features (work in progress) RW-RO file consistency after copy-up Just need to fix this case up in VFS Fix st_dev, constant st_ino/d_ino Store inode number for copied up files Finding a common ino space for different underlying filesystems Hard link copy up Should be very rare Can use a global database for storing inode numbers of copied up hard links
9 overlayfs usage in docker
10 overlay graph driver Container 1 Confined Process merged dir (rootfs) hard links lower dir 1 lower dir 2 lower dir N upper dir Image Layer 1 Image Layer 2 Image Layer N Container writable dir docker daemon option --storage-driver=overlay Overlay supported single lower directory Hard links created between image layers Higher inode utilization
11 overlay2 graph driver Container 1 Confined Process merged dir (rootfs) lower dir 1 lower dir 2 lower dir N upper dir Image Layer 1 Image Layer 2 Image Layer N Container writable dir docker daemon option --storage-driver=overlay2 overlayfs should support multiple lower dirs No hardlinks and dir creation in every layer Better inode utilization
12 Container security and overlayfs
13 How do we handle access permissions? DAC(Ownership/Permissions) MAC (SELinux)
14 An example setup Container 1 Confined Process 1 merged Container 2 Confined Process 2 merged upper dir 1 lower dir Image Layer upper dir 2 Two containers sharing lower dir with separate upper dir
15 Escaped container process writes to image dir/files Container 1 Confined Process 1 merged Escaped Process 1 Container 2 Confined Process 2 merged upper dir 1 lower dir Image Layer upper dir 2 -rw-r--r--. root root /etc/passwd DAC allows writing to /etc/passwd
16 Security goal 1 Container 1 Confined Process 1 merged Escaped Process 1 Container 2 Confined Process 2 merged upper dir 1 lower dir Image Layer upper dir 2 -rw-r--r--. root root /etc/passwd Do not allow writing to image dir/files
17 Allow access through overlay mount point open(foo.txt, O_RDWR) Overlay mount lower/foo.txt upper/
18 Deny write access on underlying file open(foo.txt, O_RDWR) Overlay mount lower/foo.txt upper/
19 DAC allows access through both paths (When root inside container is root outside) open(foo.txt, O_RDWR) Overlay mount lower/foo.txt upper/ -rw-r--r--. root root
20 Read only label on lower files open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Overlay mount lower/foo.txt upper/ system_u:object_r:container_share_t:s0
21 Use context mount option for overlay open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Overlay mount (context=label) system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt upper/ system_u:object_r:container_share_t:s0 mount -t overlay -o context= system_u:object_r:container_file_t:s0:c16,c merged/
22 That did not work
23 Access permission checks in overlay inode_permission() MAC overlay inode context label DAC + MAC real inode (real label)
24 Read only label on lower file open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 merged/foo.txt system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root upper/ system_u:object_r:container_share_t:s0
25 Process Overlay inode check open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Process MAY_WRITE merged/foo.txt system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root upper/ system_u:object_r:container_share_t:s0
26 Process lower inode DAC check open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Process MAY_WRITE merged/foo.txt system_u:object_r:container_file_t:s0:c16,c585 Process MAY_WRITE lower/foo.txt -rw-r--r--. root root upper/ system_u:object_r:container_share_t:s0
27 Process lower inode MAC check open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Process MAY_WRITE merged/foo.txt system_u:object_r:container_file_t:s0:c16,c585 Process MAY_WRITE lower/foo.txt -rw-r--r--. root root upper/ system_u:object_r:container_share_t:s0
28 What if we don t do WRITE checks on lower inode
29 But that will break DAC DAC checks happen only at real inode open(foo.txt, O_RDWR) merged/ lower/foo.txt -r--r--r--. root root Copy Up upper/foo.txt -r--r--r--. root root
30 Why not do DAC checks on both inodes open(foo.txt, O_RDWR) merged/foo.txt -r--r--r--. root root lower/foo.txt -r--r--r--. root root Copy Up upper/
31 That kind of worked but...
32 Certain overlayfs operations failed MAC checks
33 Certain overlayfs operations fail MAC checks File creation over whiteout
34 Certain overlayfs operations fail MAC checks File creation over whiteout Use mounter s creds for privileged operations
35 Two Levels of Permission Checks Overlay inode is checked with creds of task Underlying inode is checked with creds of mounter Certain privileged operations are done with the creds of mounter DAC +MAC (Caller Creds) DAC + MAC Mounter Creds inode_permission() overlay inode context label real inode (real label)
36 Two levels of checks open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 merged/foo.txt -rw-r--r--. root root system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root system_u:object_r:container_share_t:s0 upper/
37 Process Overlay inode check open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Process MAY_WRITE merged/foo.txt -rw-r--r--. root root system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root system_u:object_r:container_share_t:s0 upper/
38 Mounter real lower inode check open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 Process MAY_WRITE merged/foo.txt -rw-r--r--. root root system_u:object_r:container_file_t:s0:c16,c585 Mounter MAY_READ lower/foo.txt -rw-r--r--. root root system_u:object_r:container_share_t:s0 upper/
39 First requirement met
40 Escaped process accesses other container s data Container 1 Confined Process 1 merged Container 2 Confined Process 2 merged Escaped Process 1 upper dir 1 lower dir Image Layer upper dir 2 -rw-r--r--. root root /etc/data.txt Container1 accesses container2 s data
41 Security goal 2 Container 1 Confined Process 1 merged Container 2 Confined Process 2 merged Escaped Process 1 upper dir 1 lower dir Image Layer upper dir 2 -rw-r--r--. root root /etc/data.txt One container should not be able to access other container s data
42 Label upper files for container access only open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 merged/ system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt upper/ -rw-r--r--. root root system_u:object_r:container_share_t:s0
43 Label upper files for container access only open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 merged/ system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root system_u:object_r:container_share_t:s0 upper/foo.txt -rw-r--r--. root root system_u:object_r:container_file_t:s0:c16,c585
44 One container can t access data of another container open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c16,c585 open(foo.txt, O_RDWR) system_u:system_r:container_t:s0:c548,c591 merged/ system_u:object_r:container_file_t:s0:c16,c585 lower/foo.txt -rw-r--r--. root root system_u:object_r:container_share_t:s0 upper/foo.txt -rw-r--r--. root root system_u:object_r:container_file_t:s0:c16,c585
45 New LSM Hooks inode_copy_up() Called during copy up. Returns new set of creds for file creation. For context mounts, file is created with label specified in context= option. inode_copy_up_xattr() Called during copy up of xattrs. SELinux blocks copying up of SELinux xattr. dentry_create_files_as() Called during creation of new file. Returns new set of creds for file creation. For context mounts, file is created with label specified in context= option.
46 Overlayfs vs. devicemapper In general, faster than devicemapper Page cache sharing Not fully POSIX compliant, yet So some workloads might experience issues Fedora 26 will have overlay2 as default graph driver Switch back to devicemapper if you face issues
47 DAC and container security DAC will solve these issues if containers run in user namespaces with different mappings Needing to do a chown on image continues to be a issue shiftfs or something else?
48 Thank You
SE Linux Implementation LINUX20
SE Linux Implementation LINUX20 Russell Coker IBM eserver pseries, Linux, Grid Computing and Storage Technical University 7/7/2004 Licensed under the GPL Topic Objectives In this topic students will learn
Access Control. CMPSC Spring 2012 Introduction Computer and Network Security Professor Jaeger.
Access Control CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ Access Control Describe the permissions available to computing processes
Fall 2014:: CSE 506:: Section 2 (PhD) Securing Linux. Hyungjoon Koo and Anke Li
Securing Linux Hyungjoon Koo and Anke Li Outline Overview Background: necessity & brief history Core concepts LSM (Linux Security Module) Requirements Design SELinux Key elements Security context: identity
Landlock LSM: toward unprivileged sandboxing
Landlock LSM: toward unprivileged sandboxing Mickaël Salaün ANSSI September 14, 2017 1 / 21 Secure user-space software How to harden an application? secure development follow the least privilege principle
1 / 23. CS 137: File Systems. General Filesystem Design
1 / 23 CS 137: File Systems General Filesystem Design 2 / 23 Promises Made by Disks (etc.) Promises 1. I am a linear array of fixed-size blocks 1 2. You can access any block fairly quickly, regardless
Virtual File System. Don Porter CSE 306
Virtual File System Don Porter CSE 306 History Early OSes provided a single file system In general, system was pretty tailored to target hardware In the early 80s, people became interested in supporting
The Case for Security Enhanced (SE) Android. Stephen Smalley Trusted Systems Research National Security Agency
The Case for Security Enhanced (SE) Android Stephen Smalley Trusted Systems Research National Security Agency Background / Motivation Increasing desire to use mobile devices throughout the US government.
Operating system security models
Operating system security models Unix security model Windows security model MEELIS ROOS 1 General Unix model Everything is a file under a virtual root diretory Files Directories Sockets Devices... Objects
RCU. ò Walk through two system calls in some detail. ò Open and read. ò Too much code to cover all FS system calls. ò 3 Cases for a dentry:
Logical Diagram VFS, Continued Don Porter CSE 506 Binary Formats RCU Memory Management File System Memory Allocators System Calls Device Drivers Networking Threads User Today s Lecture Kernel Sync CPU
VFS, Continued. Don Porter CSE 506
VFS, Continued Don Porter CSE 506 Logical Diagram Binary Formats Memory Allocators System Calls Threads User Today s Lecture Kernel RCU File System Networking Sync Memory Management Device Drivers CPU
File access-control per container with Landlock
File access-control per container with Landlock Mickaël Salaün ANSSI February 4, 2018 1 / 20 Secure user-space software How to harden an application? secure development follow the least privilege principle
1 / 22. CS 135: File Systems. General Filesystem Design
1 / 22 CS 135: File Systems General Filesystem Design Promises 2 / 22 Promises Made by Disks (etc.) 1. I am a linear array of blocks 2. You can access any block fairly quickly 3. You can read or write
Linux Kernel Evolution. OpenAFS. Marc Dionne Edinburgh
Linux Kernel Evolution vs OpenAFS Marc Dionne Edinburgh - 2012 The stage Linux is widely deployed as an OpenAFS client platform Many large OpenAFS sites rely heavily on Linux on both servers and clients
Idea of Metadata Writeback Cache for Lustre
Idea of Metadata Writeback Cache for Lustre Oleg Drokin Apr 23, 2018 * Some names and brands may be claimed as the property of others. Current Lustre caching Data: Fully cached on reads and writes in face
THE ROUTE TO ROOTLESS
THE ROUTE TO ROOTLESS THE ROUTE TO ROOTLESS BILL AND TED'S ROOTLESS ADVENTURE THE ROUTE TO ROOTLESS WHAT SECURITY PROBLEM IS GARDEN SOLVING IN CLOUD FOUNDRY? THE PROBLEM IN CLOUD FOUNDRY Public Multi-Tenant
SELinux Introduction. Jason Zaman FOSSASIA 2017 March 17th - 19th blog.perfinion.com
SELinux Introduction Jason Zaman FOSSASIA 2017 March 17th - 19th blog.perfinion.com Overview 1. Who am I? 2. What is SELinux? 3. DAC vs MAC 4. Type Enforcement 5. Labels 6. Sometimes SELinux denies badness
Virtual File System. Don Porter CSE 506
Virtual File System Don Porter CSE 506 History ò Early OSes provided a single file system ò In general, system was pretty tailored to target hardware ò In the early 80s, people became interested in supporting
ViryaOS RFC: Secure Containers for Embedded and IoT. A proposal for a new Xen Project sub-project
ViryaOS RFC: Secure Containers for Embedded and IoT A proposal for a new Xen Project sub-project Stefano Stabellini @stabellinist The problem Package applications for the target Contain all dependencies
Filename encoding. and case-insensitive filesystems. Gabriel Krisman Bertazi
Filename encoding and case-insensitive filesystems Gabriel Krisman Bertazi Why an encoding-aware FS? Traditional UNIX-like approach: Opaque byte sequences. Because the other kids
Advanced UNIX File Systems. Berkley Fast File System, Logging File System, Virtual File Systems
Advanced UNIX File Systems Berkley Fast File System, Logging File System, Virtual File Systems Classical Unix File System Traditional UNIX file system keeps I-node information separately from the data
Introduction to Containers
Introduction to Containers Shawfeng Dong Principal Cyberinfrastructure Engineer University of California, Santa Cruz What are Containers? Containerization, aka operating-system-level virtualization, refers
Container mechanics in Linux and rkt FOSDEM 2016
Container mechanics in Linux and rkt FOSDEM 2016 Alban Crequy github.com/alban Jonathan Boulle github.com/jonboulle @baronboulle a modern, secure, composable container runtime an implementation of appc
Hardware. Ahmet Burak Can Hacettepe University. Operating system. Applications programs. Users
Operating System Security Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr Computer System Components Hardware Provides basic computing resources (CPU, memory, I/O devices). Operating system Controls
Module: Operating System Security. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security So, you have built an operating system that enables user-space processes to
Linux Kernel Security Overview
Linux Kernel Security Overview Linux Security Summit Europe 2018 Edinburgh, UK James Morris jmorris@namei.org $ whoami Linux kernel security subsystem maintainer Linux kernel engineer at Microsoft Previously
Operating System Security
Operating System Security Ahmet Burak Can Hacettepe University abc@hacettepe.edu.tr 1 Computer System Components Hardware Provides basic computing resources (CPU, memory, I/O devices). Operating system
3/26/2014. Contents. Concepts (1) Disk: Device that stores information (files) Many files x many users: OS management
2013-2014 Contents 1. Concepts about the file system 2. The The disk user structure view 3. 2. Files The disk in disk structure The ext2 FS 4. 3. The Files Virtual in disk File The System ext2 FS 4. The
Keeping Up With The Linux Kernel. Marc Dionne AFS and Kerberos Workshop Pittsburgh
Keeping Up With The Linux Kernel Marc Dionne AFS and Kerberos Workshop Pittsburgh - 2015 The stage Linux is widely deployed as an AFS client platform OpenAFS client available in popular distributions Ubuntu,
Fall 2017 :: CSE 306. File Systems Basics. Nima Honarmand
File Systems Basics Nima Honarmand File and inode File: user-level abstraction of storage (and other) devices Sequence of bytes inode: internal OS data structure representing a file inode stands for index
Confinement. Steven M. Bellovin November 1,
Confinement Steven M. Bellovin November 1, 2016 1 Security Architecture We ve been looking at how particular applications are secured We need to secure not just a few particular applications, but many
CONTAINER AND MICROSERVICE SECURITY ADRIAN MOUAT
CONTAINER AND MICROSERVICE SECURITY ADRIAN MOUAT Chief Scientist @ Container Solutions Wrote "Using Docker" for O'Reilly 40% Discount with AUTHD code Free Docker Security minibook http://www.oreilly.com/webops-perf/free/dockersecurity.csp
Linux Security Summit Europe 2018
Linux Security Summit Europe 2018 Kernel Hardening: Protecting the Protection Mechanisms Igor Stoppa - igor.stoppa@huawei.com Cyber Security & Privacy Protection Labs - Huawei introduction memory classification
Operating Systems Security Access Control
Authorization and access control Operating Systems Security Access Control Ozalp Babaoglu From authentication to authorization Once subjects have been authenticated, the next problem to confront is authorization
System Administration for Beginners
System Administration for Beginners Week 5 Notes March 16, 2009 1 Introduction In the previous weeks, we have covered much of the basic groundwork needed in a UNIX environment. In the upcoming weeks, we
An efficient method to avoid path lookup in file access auditing in IO path to improve file system IO performance
Technical Disclosure Commons Defensive Publications Series March 21, 2017 An efficient method to avoid path lookup in file access auditing in IO path to improve file system IO performance Arun Vishnu P
Emulating Windows file serving on POSIX. Jeremy Allison Samba Team
Emulating Windows file serving on POSIX Jeremy Allison Samba Team jra@samba.org But isn't it easy? Just take a kernel, add your own file system and.. Not if you don't own your own kernel or file system.
Case Studies in Access Control
Joint software development Mail 1 / 38 Situations Roles Permissions Why Enforce Access Controls? Unix Setup Windows ACL Setup Reviewer/Tester Access Medium-Size Group Basic Structure Version Control Systems
Cloud Filesystem. Jeff Darcy for BBLISA, October 2011
Cloud Filesystem Jeff Darcy for BBLISA, October 2011 What is a Filesystem? The thing every OS and language knows Directories, files, file descriptors Directories within directories Operate on single record
Capability and System Hardening
P a g e 1 Date Assigned: mm/dd/yyyy Date Due: mm/dd/yyyy by hh:mm Educational Objectives Capability and System Hardening This lab is designed to help you gain a better understanding of system hardening
SELinux. Don Porter CSE 506
SELinux Don Porter CSE 506 MAC vs. DAC By default, Unix/Linux provides Discretionary Access Control The user (subject) has discretion to set security policies (or not) Example: I may chmod o+a the file
Introduction to Container Technology. Patrick Ladd Technical Account Manager April 13, 2016
Introduction to Container Technology Patrick Ladd Technical Account Manager April 13, 2016 Container Technology Containers 3 "Linux Containers" is a Linux kernel feature to contain a group of processes
Unix Filesystem. January 26 th, 2004 Class Meeting 2
Unix Filesystem January 26 th, 2004 Class Meeting 2 * Notes adapted by Christian Allgood from previous work by other members of the CS faculty at Virginia Tech Unix Filesystem! The filesystem is your interface
Docker A FRAMEWORK FOR DATA INTENSIVE COMPUTING
Docker A FRAMEWORK FOR DATA INTENSIVE COMPUTING Agenda Intro / Prep Environments Day 1: Docker Deep Dive Day 2: Kubernetes Deep Dive Day 3: Advanced Kubernetes: Concepts, Management, Middleware Day 4:
Figure 1. A union consists of several underlying branches, which can be of any filesystem type.
1 of 6 6/18/2006 7:16 PM Kernel Korner Unionfs: Bringing Filesystems Together Charles P. Wright Erez Zadok Abstract Unionfs merges several directories into a single unified view. We describe applications
The State of Rootless Containers
The State of Rootless Containers Aleksa Sarai / SUSE Akihiro Suda / NTT @lordcyphar @_AkihiroSuda_ Who are we? Aleksa Sarai Senior Software Engineer at SUSE. Maintainer of runc and several other Open Container
How To Write a Linux Security Module That Makes Sense For You. Casey Schaufler February 2016
How To Write a Linux Security Module That Makes Sense For You Casey Schaufler February 2016 Casey Schaufler Unix 32 bit port - 1979 Smack Linux security module Security module stacking Why Would You Write
OS Security III: Sandbox and SFI
1 OS Security III: Sandbox and SFI Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 VMs on lab machine Extension? 3 Users and processes FACT: although ACLs use users as subject, the OS
Logical disks. Bach 2.2.1
Logical disks Bach 2.2.1 Physical disk is divided into partitions or logical disks Logical disk linear sequence of fixed size, randomly accessible, blocks disk device driver maps underlying physical storage
CS 380S. TOCTTOU Attacks. Don Porter. Some slides courtesy Vitaly Shmatikov and Emmett Witchel. slide 1
CS 380S TOCTTOU Attacks Don Porter Some slides courtesy Vitaly Shmatikov and Emmett Witchel slide 1 Definitions TOCTTOU Time of Check To Time of Use Check Establish some precondition (invariant), e.g.,
Fuse Extension. version Erick Gallesio Université de Nice - Sophia Antipolis 930 route des Colles, BP 145 F Sophia Antipolis, Cedex France
Fuse Extension version 0.90 Erick Gallesio Université de Nice - Sophia Antipolis 930 route des Colles, BP 145 F-06903 Sophia Antipolis, Cedex France This document was produced using the Skribe Programming
Security Architecture
Security Architecture We ve been looking at how particular applications are secured We need to secure not just a few particular applications, but many applications, running on separate machines We need
OCFS2 Mark Fasheh Oracle
OCFS2 Mark Fasheh Oracle What is OCFS2? General purpose cluster file system Shared disk model Symmetric architecture Almost POSIX compliant fcntl(2) locking Shared writeable mmap Cluster stack Small, suitable
Using GConf as an Example of How to Create an Userspace Object Manager
Using GConf as an Example of How to Create an Userspace Object Manager James Carter National Security Agency Abstract GConf is a configuration system for GNOME. It does not provide adequate security controls
Abstract. 1 Introduction
Versatility and Unix Semantics in a Fan-Out Unification File System Puja Gupta, Harikesavan Krishnan, Charles P. Wright, Mohammad Nayyer Zubair, Jay Dave, and Erez Zadok Stony Brook University Abstract
[537] Fast File System. Tyler Harter
![[537] Fast File System. Tyler Harter](/thumbs/72/67839359.jpg "[537] Fast File System. Tyler Harter")
[537] Fast File System Tyler Harter File-System Case Studies Local - FFS: Fast File System - LFS: Log-Structured File System Network - NFS: Network File System - AFS: Andrew File System File-System Case
Developments in GFS2. Andy Price Software Engineer, GFS2 OSSEU 2018
Developments in GFS2 Andy Price Software Engineer, GFS2 OSSEU 2018 1 GFS2 recap Shared storage cluster filesystem High availability clusters Uses glocks ( gee-locks ) based on DLM
Hacking and Hardening Kubernetes
SESSION ID: HT-W02 Hacking and Hardening Kubernetes Jay Beale CTO InGuardians, Inc @jaybeale and @inguardians Adam Crompton Senior Security Analyst InGuardians, Inc. @3nc0d3r and @inguardians Table of
SELinux. Daniel J Walsh SELinux Lead Engineer
SELinux Daniel J Walsh SELinux Lead Engineer 0 Day Exploits Patch Cycle Someone discovers a vulnerability in software Package Maintainer and OS Vendor Notified Fix generated/distributed Fix installed by
Directory. File. Chunk. Disk
SIFS Phase 1 Due: October 14, 2007 at midnight Phase 2 Due: December 5, 2007 at midnight 1. Overview This semester you will implement a single-instance file system (SIFS) that stores only one copy of data,
Case Study: Access Control. Steven M. Bellovin October 4,
Case Study: Access Control Steven M. Bellovin October 4, 2015 1 Case Studies in Access Control Joint software development Mail Steven M. Bellovin October 4, 2015 2 Situations Small team on a single machine
PFStat. Global notes
PFStat Global notes Counts expand_stack returns in case of error, so the stack_low count needed to be inside transparent huge page, 2 cases : There is no PMD, we should create a transparent one (There
Outline. Operating System Security CS 239 Computer Security February 23, Introduction. Server Machines Vs. General Purpose Machines
Outline Operating System Security CS 239 Computer Security February 23, 2004 Introduction Memory protection Interprocess communications protection File protection Page 1 Page 2 Introduction Why Is OS Security
Protection Kevin Webb Swarthmore College April 19, 2018
Protection Kevin Webb Swarthmore College April 19, 2018 xkcd #1200 Before you say anything, no, I know not to leave my computer sitting out logged in to all my accounts. I have it set up so after a few
416 Distributed Systems. Distributed File Systems 1: NFS Sep 18, 2018
416 Distributed Systems Distributed File Systems 1: NFS Sep 18, 2018 1 Outline Why Distributed File Systems? Basic mechanisms for building DFSs Using NFS and AFS as examples NFS: network file system AFS:
Files and the Filesystems. Linux Files
Files and the Filesystems Linux Files The file is the most basic and fundamental abstraction in Linux. Linux follows the everything-is-a-file philosophy. Consequently, much interaction occurs via reading
NFS Version 4 Open Source Project. William A.(Andy) Adamson Center for Information Technology Integration University of Michigan
NFS Version 4 Open Source Project William A.(Andy) Adamson Center for Information Technology Integration University of Michigan NFS Version 4 Open Source Project Sponsored by Sun Microsystems Part of CITI
Secure and Simple Sandboxing in SELinux
Secure and Simple Sandboxing in SELinux James Morris jmorris@namei.org FOSS.my 2009 Kuala Lumpur, Malaysia Overview Sandboxing SELinux Sandbox design and implementation Use examples Status and future directions
Unix, History
Operating systems Examples from Unix, VMS, Windows NT on user authentication, memory protection and file and object protection. Trusted Operating Systems, example from PitBull Unix, History Unix, History
STING: Finding Name Resolution Vulnerabilities in Programs
STING: Finding Name Resolution ulnerabilities in Programs Hayawardh ijayakumar, Joshua Schiffman, Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department
Systems Programming. 09. Filesystem in USErspace (FUSE) Alexander Holupirek
Systems Programming 09. Filesystem in USErspace (FUSE) Alexander Holupirek Database and Information Systems Group Department of Computer & Information Science University of Konstanz Summer Term 2008 Schedule
Program Structure. Steven M. Bellovin April 3,
Program Structure We ve seen that program bugs are a major contributor to security problems We can t build bug-free software Can we build bug-resistant software? Let s look at a few examples, good and
The UNIX File System
The UNIX File System Magnus Johansson May 9, 2007 1 UNIX file system A file system is created with mkfs. It defines a number of parameters for the system, such as: bootblock - contains a primary boot program
Program Structure I. Steven M. Bellovin November 14,
Program Structure I Steven M. Bellovin November 14, 2010 1 Program Structure We ve seen that program bugs are a major contributor to security problems We can t build bug-free software Can we build bug-resistant
Security features for UBIFS. Richard Weinberger sigma star gmbh
Richard Weinberger sigma star gmbh /me Richard Weinberger Co-founder of sigma star gmbh Linux kernel developer and maintainer Strong focus on Linux kernel, lowlevel components, virtualization, security
Storage Industry Resource Domain Model
Storage Industry Resource Domain Model A Technical Proposal from the SNIA Technical Council Topics Abstract Data Storage Interfaces Storage Resource Domain Data Resource Domain Information Resource Domain
RCU. ò Dozens of supported file systems. ò Independent layer from backing storage. ò And, of course, networked file system support
Logical Diagram Virtual File System Don Porter CSE 506 Binary Formats RCU Memory Management File System Memory Allocators System Calls Device Drivers Networking Threads User Today s Lecture Kernel Sync
412 Notes: Filesystem
412 Notes: Filesystem A. Udaya Shankar shankar@cs.umd.edu December 5, 2012 Contents 1 Filesystem interface 2 2 Filesystem implementation 3 3 FAT (mostly from Wikepedia) 5 4 UFS (mostly from Wikepedia)
rpaths Documentation Release 0.13 Remi Rampin
rpaths Documentation Release 0.13 Remi Rampin Aug 02, 2018 Contents 1 Introduction 1 2 Classes 3 2.1 Abstract classes............................................. 3 2.2 Concrete class Path............................................
File System Implementation
Introduction to Operating Systems File System Implementation John Franco Electrical Engineering and Computing Systems University of Cincinnati Layered File System Application Programs Logical File System
How we added software updates to AGL
How we added software updates to AGL Phil Wise 2017 ATS Advanced Telematic Systems GmbH ATS Advanced Telematic Systems. Open source and open standard for connected mobility. Page 2 AGL Automotive Grade
How Linux Capability Works in
Laboratory for Computer Security Education 1 1 Overview How Linux Capability Works in 2.6.25 by Jinkai Gao (Syracuse University) One aspect of security is user privileges. UNIX-style user privileges come
What is a file system
COSC 6397 Big Data Analytics Distributed File Systems Edgar Gabriel Spring 2017 What is a file system A clearly defined method that the OS uses to store, catalog and retrieve files Manage the bits that
Network File System (NFS)
Network File System (NFS) Brad Karp UCL Computer Science CS GZ03 / M030 19 th October, 2009 NFS Is Relevant Original paper from 1985 Very successful, still widely used today Early result; much subsequent
Network File System (NFS)
Network File System (NFS) Brad Karp UCL Computer Science CS GZ03 / M030 14 th October 2015 NFS Is Relevant Original paper from 1985 Very successful, still widely used today Early result; much subsequent
Processes are subjects.
Identification and Authentication Access Control Other security related things: Devices, mounting filesystems Search path Race conditions NOTE: filenames may differ between OS/distributions Principals
CSE 333 Lecture 9 - storage
CSE 333 Lecture 9 - storage Steve Gribble Department of Computer Science & Engineering University of Washington Administrivia Colin s away this week - Aryan will be covering his office hours (check the
CephFS A Filesystem for the Future
CephFS A Filesystem for the Future David Disseldorp Software Engineer ddiss@suse.com Jan Fajerski Software Engineer jfajerski@suse.com Introduction to Ceph Distributed storage system based on RADOS Scalable
Unix File System. Class Meeting 2. * Notes adapted by Joy Mukherjee from previous work by other members of the CS faculty at Virginia Tech
Unix File System Class Meeting 2 * Notes adapted by Joy Mukherjee from previous work by other members of the CS faculty at Virginia Tech Unix File System The file system is your interface to: physical
Access Control. Steven M. Bellovin September 13,
Access Control Steven M. Bellovin September 13, 2016 1 Security Begins on the Host Even without a network, hosts must enforce the CIA trilogy Something on the host the operating system aided by the hardware
ò Server can crash or be disconnected ò Client can crash or be disconnected ò How to coordinate multiple clients accessing same file?
Big picture (from Sandberg et al.) NFS Don Porter CSE 506 Intuition Challenges Instead of translating VFS requests into hard drive accesses, translate them into remote procedure calls to a server Simple,
10/23/12. Fundamentals of Linux Platform Security. Linux Platform Security. Roadmap. Security Training Course. Module 4 Introduction to SELinux
Fundamentals of Linux Platform Security Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Linux Platform Security Module 4 Introduction to SELinux Roadmap Why SELinux? Overview
Access Control. Steven M. Bellovin September 2,
Access Control Steven M. Bellovin September 2, 2014 1 Security Begins on the Host Even without a network, hosts must enforce the CIA trilogy Something on the host the operating system aided by the hardware
NFS. Don Porter CSE 506
NFS Don Porter CSE 506 Big picture (from Sandberg et al.) Intuition ò Instead of translating VFS requests into hard drive accesses, translate them into remote procedure calls to a server ò Simple, right?
CS 140 Project 4 File Systems Review Session
CS 140 Project 4 File Systems Review Session Prachetaa Due Friday March, 14 Administrivia Course withdrawal deadline today (Feb 28 th ) 5 pm Project 3 due today (Feb 28 th ) Review section for Finals on
Programming Project # 2. cs155 Due 5/5/05, 11:59 pm Elizabeth Stinson (Some material from Priyank Patel)
Programming Project # 2 cs155 Due 5/5/05, 11:59 pm Elizabeth Stinson (Some material from Priyank Patel) Background context Unix permissions model Prof Mitchell will cover during OS security (next week
CS370 Operating Systems
CS370 Operating Systems Colorado State University Yashwant K Malaiya Fall 2016 Lecture 5 Slides based on Text by Silberschatz, Galvin, Gagne Various sources 1 1 User Operating System Interface - CLI CLI
Demystifying SELinux:
Demystifying SELinux: What is it trying to tell me? David Quigley dpquigl@davequigley.com 1 What is Access Control? A system for restricting who or what is allowed to access specific resources and how
Azure Sphere: Fitting Linux Security in 4 MiB of RAM. Ryan Fairfax Principal Software Engineering Lead Microsoft
Azure Sphere: Fitting Linux Security in 4 MiB of RAM Ryan Fairfax Principal Software Engineering Lead Microsoft Agenda o o o o Intro to Azure Sphere Kernel Customizations User mode services / App Model
Files and Directories Filesystems from a user s perspective
Files and Directories Filesystems from a user s perspective Unix Filesystems Seminar Alexander Holupirek Database and Information Systems Group Department of Computer & Information Science University of
ò Very reliable, best-of-breed traditional file system design ò Much like the JOS file system you are building now
Ext2 review Very reliable, best-of-breed traditional file system design Ext3/4 file systems Don Porter CSE 506 Much like the JOS file system you are building now Fixed location super blocks A few direct