sig-security: add meeting notes for 2017-06-21
@@ -5,6 +5,8 @@ Meeting location: https://docker.zoom.us/j/779801882
Announcement: [Moby project forum post](https://forums.mobyproject.org/t/2017-06-21-linuxkit-security-sig-meeting/74)
+Video recording: coming soon!
+
Previous meeting notes: [2017-06-07](2017-06-07.md)
## Agenda
@@ -23,3 +25,57 @@ Previous meeting notes: [2017-06-07](2017-06-07.md)
- we can propose additional deep dives and discussion topics!
## Meeting Notes
+Scribe: @mgoelzer
+
+- Next meeting July 5
+
+- Recap of Moby Summit
+ - slides for [linuxkit update](https://docs.google.com/presentation/d/1Y4ZI2r-O8NNp3geq0Q_Ud07YnhTX6G7Q2T_iaeWnAME/edit#slide=id.g1e55e362fb_0_0) and [linuxkit security](https://docs.google.com/presentation/d/1ld5nUgPKMEwaiR7EgGPJeJU29YZkww8e_9Aa1ONSXvs/edit), videos coming soon
+ - Lots of bare metal linuxkit interest
+ - auditd requested
+ - Another Summit at Open Source Summit in LA
+
+- Package Signing
+ - Based on Notary (based on The Update Framework) - implemented in Docker Content Trust in Docker CLI
+ - all `linuxkit/` images on Docker Hub are signed by maintainers
+ - Guarantees:
+ - authenticity
+ - integrity
+ - freshness
+ - survivability after key compromise
+ - Linuxkit yaml files container `trust:` block - tells moby builder that you want to verify all images in a given organization or per image control
+ - Moby builder will first check the signatures for all images and validate expiration dates before pulling images
+ - Future directions:
+ - key pinning for signed packages
+ - enforce multi-sig thresholds
+ actively remove sigs for old packages (or let them expire)
+ - private notary servers
+
+- Landlock LSM (presentation by @l0kod)
+ - [Presentation slides here](https://landlock-lsm.github.io/talks/2017-06-21_landlock-linuxkit-sig.pdf)
+ - Threat: compromised processes (like browsers) -> privilege escalations -> access data on the system
+ - Today we have:
+ - access control through SELinux (fine grained)
+ - seccomp-bpf (not an AC mechanism)
+ - namespaces
+ - Landlock is trying to do three things:
+ - fine grained control
+ - unprivileged
+ - embedded in applications
+ - Landlock = programmatic access control
+ - Landlock rules:
+ - written in C
+ - compiled down to eBPF bytecode
+ - embedded in application
+ - application executes
+ - Landlock rule loaded into running kernel
+ - Example: rule that says application cannot write to files but can write to FIFOs
+- Key data structure: `struct landlock_context`
+- Overview of eBPF (extended Berkeley Packet Filtering)
+ - In-kernel bytecode
+ - For network filtering, tracing
+- Landlock Roadmap:
+ - MVP
+ - cgroups
+ - new eBPF maps for fs checks
+ - unprivileged mode
