[kata-dev] Improving isolation in Kata

Boeuf, Sebastien sebastien.boeuf at intel.com
Tue Jul 24 14:25:14 UTC 2018


Thanks for your answers Daniel and Stefan,

This helps :)

Sebastien
________________________________________
From: Daniel P. Berrangé [berrange at redhat.com]
Sent: Tuesday, July 24, 2018 3:42 AM
To: Stefan Hajnoczi
Cc: Boeuf, Sebastien; kata-dev at lists.katacontainers.io
Subject: Re: [kata-dev] Improving isolation in Kata

On Tue, Jul 24, 2018 at 11:40:14AM +0100, Stefan Hajnoczi wrote:
> On Tue, Jul 24, 2018 at 09:19:47AM +0100, Daniel P. Berrangé wrote:
> > On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
> > > Also, the fies created will be owned by the non-root user being chosen, which modifies the
> > > security associated with those files. When Qemu runs root, only root can access/modify
> > > them on the host, but by running Qemu as non-root, they will be more accessible since they
> > > won't be owned by root.
> >
> > File ownership doesn't influence how accessible files are - file permissions
> > bits do that. If the file permissions are rwx-------- then only the file
> > owner can access it, regardless of whether the file owner is root or a non-root
> > account.
>
> On top of this libvirt uses SELinux to further restrict access to the
> files.  My understanding is each QEMU process runs with its own SELinux
> context so that 2 VMs cannot access each other's disk images, even if
> the QEMU processes have the same qemu:qemu uid/gid pair.
>
> In other words, the access is even more tightly controlled than just the
> UNIX file permissions, it's done on a per-VM basis.

Yes, out of the box, each VM will get a distinct SELinux context (using
random MCS tag), while sharing the same qemu:qemu user/group. The app
can opt-in to using a separate uid:gid per VM too, if they have a range
of uid:gids reserved for use by VMs.

Regards,
Daniel
--
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|



More information about the kata-dev mailing list