Using container technology to make a more secure pipeline

In our last post we talked about using Multi-Category Security (MCS) instead of Multi-Level Security (MLS) to provide isolation on systems with different levels of sensitivity. In this post we'll cover creating a more secure pipeline via containers.

A common pattern in MLS environments is to have a series of processes to guarantee the flow of information between networks at different levels, but to guarantee that no information gets accidentally leaked. These pipelines are sometimes called dirty word filters.

Imagine an MLS environment, where you have two networks connected to a machine. One of the networks is at Top Secret and the other network is at Secret. Now you might have a process downloading content from the Top Secret Network, another process, the filter process,  examining the downloaded content and moving approved data from the Top Secret content to the Secret content. Finally you have a third process that is taking the Secret content and sending it out the Secret network.

We want to make sure that the data only flows in this direction, and guarantees that the Secret Process could not just listen to content on the TopSecret network, or go and examine the TopSecret content itself. These systems are usually controlled with SELinux and MLS labeling. 

The problem with SELinux and MLS in this environment is that the policy is difficult to write, and you can end up with lots of accidental Access Vector Cache (AVC) messages (SELinux messages) just because of normal process activity.  For example, every process on a standard SELinux system can see each other. The Secret Process executing a ps command, would generate SELinux errors indicating it tried to examine the Top Secret Process.  

Using Podman and Containers to improve the process.

If you combine Podman containers with SELinux you can make it a lot simpler to confine and control the information flow. You can also make it more secure by taking advantage of additional security features in containers.

Use Podman to put the Top Secret, Filter, and Secret processes each into separate containers. The processes within the container will no longer see the other processes on the system, as well as the processes in the other containers. 

Each container gets its own networks, meaning that Top Secret will only see the Top Secret Network, and Secret will only see the Secret network. In the Filter container, eliminate all networking. Control data flow by making the Top Secret data writable from the Top Secret Container, but read only from the Filter Container. The Filter Container can write to the Secret Content, and the Secret Container can only read the secret content. 

From an SELinux point of view we can actually have the processes inside of the container run with the same type, but then control the information flow just using the MLS or MCS Labels.

The third part of this series described using a tool like Podman to separate each of the processes in your pipeline, makes them more secure and easier to write, and maintains the trustworthiness of an SELinux/MLS Environment. In the last part of the container security series we will focus on network traffic control in Red Hat OpenShift.