문의하기

In our last post we talked about using Multi-Category Security (MCS) instead of Multi-Level Security (MLS) to provide isolation on systems with different levels of sensitivity. In this post we'll cover creating a more secure pipeline via containers.

A common pattern in MLS environments is to have a series of processes to guarantee the flow of information between networks at different levels, but to guarantee that no information gets accidentally leaked. These pipelines are sometimes called dirty word filters.

Imagine an MLS environment, where you have two networks connected to a machine. One of the networks is at Top Secret and the other network is at Secret. Now you might have a process downloading content from the Top Secret Network, another process, the filter process,  examining the downloaded content and moving approved data from the Top Secret content to the Secret content. Finally you have a third process that is taking the Secret content and sending it out the Secret network.

We want to make sure that the data only flows in this direction, and guarantees that the Secret Process could not just listen to content on the TopSecret network, or go and examine the TopSecret content itself. These systems are usually controlled with SELinux and MLS labeling. 

The problem with SELinux and MLS in this environment is that the policy is difficult to write, and you can end up with lots of accidental Access Vector Cache (AVC) messages (SELinux messages) just because of normal process activity.  For example, every process on a standard SELinux system can see each other. The Secret Process executing a ps command, would generate SELinux errors indicating it tried to examine the Top Secret Process.  

Using Podman and Containers to improve the process.

If you combine Podman containers with SELinux you can make it a lot simpler to confine and control the information flow. You can also make it more secure by taking advantage of additional security features in containers.

Use Podman to put the Top Secret, Filter, and Secret processes each into separate containers. The processes within the container will no longer see the other processes on the system, as well as the processes in the other containers. 

Each container gets its own networks, meaning that Top Secret will only see the Top Secret Network, and Secret will only see the Secret network. In the Filter container, eliminate all networking. Control data flow by making the Top Secret data writable from the Top Secret Container, but read only from the Filter Container. The Filter Container can write to the Secret Content, and the Secret Container can only read the secret content. 

From an SELinux point of view we can actually have the processes inside of the container run with the same type, but then control the information flow just using the MLS or MCS Labels.

The third part of this series described using a tool like Podman to separate each of the processes in your pipeline, makes them more secure and easier to write, and maintains the trustworthiness of an SELinux/MLS Environment. In the last part of the container security series we will focus on network traffic control in Red Hat OpenShift.


About the authors

Daniel Walsh has worked in the computer security field for over 30 years. Dan is a Senior Distinguished Engineer at Red Hat. He joined Red Hat in August 2001. Dan leads the Red Hat Container Engineering team since August 2013, but has been working on container technology for several years. 

Read full bio

Lukas Vrabec is a Senior Software engineer & SELinux technology evangelist at Red Hat. He is part of Security Controls team working on SELinux projects focusing especially on security policies. Lukas is author of udica, the tool for generating custom SELinux profiles for containers and currently maintains the selinux-policy packages for Fedora and Red Hat Enterprise Linux distributions. 

Read full bio

Simon Sekidde is a Solution Architect for the North America Red Hat Public Sector team specializing in the application of open source enterprise technologies for the Federal Department of Defense (DoD) customers.

Read full bio

Ben Bennett is a Senior Principal Software Engineer and is the group lead for the SDN, Routing, DNS, and Storage components of Red Hat OpenShift.  He has more than 25 years of experience working with networking, distributed systems, and Linux.

Read full bio
Red Hat logoLinkedInYouTubeFacebookTwitter

제품

체험, 구매 & 영업

커뮤니케이션

Red Hat 소개

Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.

Red Hat Shares 뉴스레터를 구독하세요

지금 신청하기

언어 선택