TEN LAYERS OF CONTAINER SECURITY

Transcription

1 TEN LAYERS OF CONTAINER SECURITY A Deeper Dive

2 2 WHAT ARE CONTAINERS? It depends on who you ask... INFRASTRUCTURE APPLICATIONS Sandboxed application processes on a shared Linux OS kernel Simpler, lighter, and denser than virtual machines Portable across different environments Package my application and all of its dependencies Deploy to any environment in seconds and enable CI/CD Easily access and share containerized components

3 3 SECURING CONTAINERS: LAYERS & LIFECYCLE 1. Container Host & Multi-tenancy 2. Container Content 3. Container Registries 4. Building Containers 5. Deploying Containers 6. Container Platform 7. Network Isolation 8. Storage 9. API Management 10. Federated Clusters

4 4 1 CONTAINER HOST & MULTI-TENANCY THE OS MATTERS RED HAT ENTERPRISE LINUX RED HAT ENTERPRISE LINUX ATOMIC HOST THE FOUNDATION FOR SECURE, SCALABLE CONTAINERS A stable, reliable host environment with built-in security features that allow you to isolate containers from other containers and from the kernel. Minimized host environment tuned for running Linux containers while maintaining the built-in security features of Red Hat Enterprise Linux.. SELinux Kernel namespaces Cgroups Seccomp R/O Mounts

5 5 1 Namespaces - Process Isolation Namespaces Mount UTC IPC PID Network

6 6 1 SELINUX - MAC - MCS SElinux is a LABELING system Every Process has a Label Every file, Directory, System object has a Label Policy rules control access between labeled processes and labeled objects The Kernel enforces the rules

7 7 1 SELINUX - MAC - MCS - Process system_u:system_r:container_runtime_t:s0 [root@osemaster ~]# ps -efz grep docker-containerd-shim-current system_u:system_r:container_runtime_t:s0 root Feb15? 00:00:01 /usr/bin/docker-containerd-shim-current 4d254785cbc6ee7aae8facc e2385f65d89553b319b6324b1501e4b16 /var/run/docker/libcontainerd/4d254785cbc6ee7aae8facc e2385f65d89553b319b6324b1501e4b16 /usr/libexec/docker/docker-runc-current The OOTB SElinux policy container.te defines what you can execute and access with the label container_runtime_t SElinux Policy module for the container

8 8 1 SELINUX - MAC - MCS - Files container_var_lib_t / svirt_sandbox_file_t [root@osemaster ~]# ls -lz /var/lib/docker/containers/97de4217a04b6532e312cfb3e aeb7dfa281a2cc067e092fcee82e6737 / -rw-r root root system_u:object_r:container_var_lib_t:s0 97de4217a04b6532e312cfb3e aeb7dfa281a2cc067e092fcee82e6737-json.log -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 config.v2.json -rw-rw-rw-. root root system_u:object_r:container_var_lib_t:s0 hostconfig.json -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 hostname -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 hosts -rw-r--r--. root root system_u:object_r:svirt_sandbox_file_t:s0 resolv.conf -rw-r--r--. root root system_u:object_r:container_var_lib_t:s0 resolv.conf.hash drwxr-xr-x. root root system_u:object_r:svirt_sandbox_file_t:s0:c0,c1 secrets drwx root root system_u:object_r:container_var_lib_t:s0 shm SElinux Policy module for the container

9 9 1 SELINUX TO THE RESCUE On-entry container attack - CVE On Red Hat systems with SELinux enabled, the dangers of even privileged containers are mitigated. SELinux prevents container processes from accessing host content even if those container processes manage to gain access to the actual file descriptors.

10 10 1 SECCOMP - DROPPING PRIVILEGES FROM CONTAINERS CAP_SETPCAP CAP_SYS_MODULE CAP_SYS_RAWIO CAP_SYS_PACCT CAP_SYS_NICE CAP_SYS_RESOURCE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_AUDIT_WRITE CAP_AUDIT_CONTROL CAP_MAC_OVERRIDE CAP_MAC_ADMIN CAP_SYSLOG CAP_NET_ADMIN CAP_SYS_ADMIN Modify process capabilities Insert/Remove kernel modules Modify Kernel Memory Configure process accounting Modify Priority of processes Override Resource Limits Modify the system clock Configure tty devices Write the audit log Configure Audit Subsystem Ignore Kernel MAC Policy Configure MAC Configuration Modify Kernel printk behaviour Configure the network: - Setting the hostname/domainname - mount(),unmount() - nfsservctl -.

11 11 1 SECCOMP - REMOVE PRIVILEGES FROM CONTAINERS A root user inside a container running in OpenShift has none of the previous capabilities available!

12 12 1 READ ONLY MOUNTS /sys /proc/sys /proc/sysrg-trigger /proc/irq /proc/bus

13 13 1 Cgroups - Resource Isolation Container 1 slice CPU Memory Network Storage / IO Container 2 slice

14 14 2 CONTENT: USE TRUSTED SOURCES Are there known vulnerabilities in the application layer? Are the runtime and OS layers up to date? How frequently will the container be updated and how will I know when it s updated? Red Hat rebuilds container images when security fixes are released

15 15 2 CONTENT: SCAN YOUR IMAGES (ATOMIC SCAN)

16 16 2 VULNERABLE? CLOUDFORMS TAKES ACTION!

17 17 2 VULNERABLE? CLOUDFORMS TAKES ACTION!

18 18 2 VULNERABLE? CLOUDFORMS TAKES ACTION!

19 19 2 PREVENT IMAGE FROM RUNNING CloudForms sets the following annotations to prevent the image from running. image.openshift.io/deny-execution: true openshift.io/image.managed: true security.manageiq.org/failed-policy: openscap policy

20 20 2 PREVENT IMAGE FROM RUNNING

21 21 3 REGISTRIES: WHERE DO YOUR CONTAINERS COME FROM? Public and private registries What security meta-data is available for your images? Are the images in the registry updated regularly? Are there access controls on the registry? How strong are they? CONTAINER APP RUNTIME OS HOST OS Red Hat Container Registry Policies to control who can deploy which containers Certification Catalog Trusted content with security updates CONTAINER APP RUNTIME OS HOST OS

22 22 3 Is your registry secure and available?

23 23 3 RED HAT CONTAINER REGISTRY - LOCAL AND SECURE WITH RBAC

24 24 3 RESTRICT WHERE YOUR CONTAINERS COME FROM? - name: allow-images-from-internal-registry onresources: - resource: pods - resource: builds matchintegratedregistry: false - name: allow-images-from-dockerhub onresources: - resource: pods - resource: builds matchregistries: - docker.io

25 25 4 MANAGING CONTAINER BUILDS Security & continuous integration Layered packaging model supports separation of concerns Integrate security testing into your build / CI process Use automated policies to flag builds with issues Trigger automated rebuilds Operations Architects Application developers

26 26 4 MANAGING CONTAINER BUILDS

27 27 5 OPENSHIFT GET UPDATED IMAGE

28 28 5 CONTAINER DEPLOYMENT PERMISSIONS (SCC)

29 29 6 CONTAINER ORCHESTRATION AUTHENTICATION & AUTHORIZATION Use a container orchestration platform with integrated security features including Role-based Access Controls with LDAP and OAuth2 integration Integrated Registry Integrated CI/CD with configurable policies Integrated host OS with embedded security features Network management Storage plug-ins API management

30 30 6 CONTAINER ORCHESTRATION AUTHENTICATION & AUTHORIZATION (Master) X Quota etcd etcd

31 31 6 OAuth API Authentication OpenShift includes an OAuth server, which does three things: Identifies the person requesting a token, using a configured identity provider Determines a mapping from that identity to an OpenShift user Allows multiple identities to map to the same OpenShift user Allows deconflicting between identity provider roles Issues an OAuth access token which authenticates that user to the API

32 32 6 API Authorization - Role Based Role-based Matches request attributes (verb,object,etc) If no roles match, request is denied ( deny by default ) Operator- and user-level roles are defined by default Custom roles are supported

33 33 6 End to End Two Way SSL Encryption

34 6 Isolate Hosts By Region $ oadm new-project myproject \ --node-selector='type=user-node,region=east' Node 1 east pod pod Node 2 east 34 Master / Scheduler Node 1 west Node 2 west

35 35 7 NETWORK DEFENSE Use network namespaces to Isolate applications from other applications within a cluster Isolate environments (Dev / Test / Prod) from other environments within a cluster

36 36 7 OVS Bridge jboss-pod :8080 hrm-pod :8443 Node 1 lbr brx lbr VNID 0 VNID 0 vxlan OVS Bridge brx lbr Route: Jboss.app.redhat.com:80 -> Endpoints: : :8080 VNID 0 VNID 0 Route: hrm.app.redhat.com:443 -> Endpoints: : :8443 Master 1 OpenShift Routing Layer OVS - SUBNET / Reverse Proxy

37 37 Project 1 Project 2 7 OVS Bridge jboss-pod :8080 lbr Node 1 VNID 50 brx OVS - MULTITENANT hrm-pod :8443 lbr VNID 60 vxlan OVS Bridge brx lbr Route: Jboss.app.redhat.com:80 -> Endpoints: : :8080 VNID 50 VNID 60 Route: hrm.app.redhat.com:443 -> Endpoints: : :8443 Master 1 OpenShift Routing Layer

38 38 7 NETWORK DEFENSE Define the traffic flow (TP OCP 3.5) Front end backend pods Allow backend pods to receive traffic from frontend pods

39 39 7 NETWORK DEFENSE - IPSEC Secure pod communications with IPsec Securing Master and Nodes Traffic encryption L3 Uses OpenShift CA Master P /16 P2 Nodes

40 40 8 ATTACHED STORAGE Secure storage by using SELinux access controls Secure mounts Supplemental group IDs for shared storage

41 8 STORAGE ISOLATION Admin provisions storage User requests storage Claim usage 41

42 8 STORAGE ISOLATION Create app with storage SCC access Layer supplementalgroups fsgroup selinuxoption runasuser Check for UID/GIDfor access to shared storage? Is the pod s "file system group" ID correct for the block storage? Is the selinuxcontext user, role,type set and is this user allowed to mount it? What is the RunAsUser or MustRunAsRange? 42

43 43 9 API MANAGEMENT Container platform & application APIs Authentication and authorization LDAP integration End-point access controls Rate limiting

44 10 FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Securing federated clusters across data centers or environments Authentication and authorization API endpoints Secrets Namespaces 44 Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016

45 45 10 FEDERATED CLUSTERS (Roadmap) ROLES & ACCESS MANAGEMENT Ubernetes API Repl Ctrl state Kubernetes Cluster Kubernetes Cluster API API Repl Ctrl state Repl Ctrl Source: Building Globally Distributed Services using Kubernetes Cluster Federation. October 14, 2016 state

46 BRINGING IT ALL TOGETHER Self-Service Service Catalog (Language Runtimes, Middleware, Databases) Build Automation Deployment Automation Web & Mobile Contaner OpenShift Application Lifecycle Management (CI/CD) Data & Storage Container Orchestration & Cluster Management (kubernetes) Networking Storage Registry Logs & Metrics Infrastructure Automation & Cockpit Security Container Integration Container Enterprise Container Host Container Runtime & Packaging (Docker) Business Automation Container Atomic 46 Host Red Hat Enterprise Linux Physical Virtual Private cloud Public cloud

47 THANK YOU 47