Summary
sVirt integrates SELinux with the Fedora virtualization stack to allow Mandatory Access Control (MAC) security be applied to guest virtual machines. Amongst other things, this prevents a security bug in the hypervisor from allowing guests to attack the host or one another.
Owner
- Name: Dan Walsh
Current status
- Targeted release: Fedora 11
- Last updated: 2009-01-30
- Percentage of completion: 30%
TODO
- See sVirt TODO list
- Merge the patch into upstream libvirt, release and package in Fedora
- Policy
- Label assignment in virt-manager?
Completed
- Initial announcement and subsequent discussion (August 2008)
- See latest (v0.30) libvirt patch, readme and changelog
Detailed Description
Before virtualization, machines were physically separated. Any security exploit is reasonably well contained to the affected machine, with the obvious exception of network attacks.
With virtualization, a security flaw in the hypervisor may be exploited by a guest and allow the guest to attack the host, or even other guests running on that host. Hypervisors are complex pieces of code, so hypervisor vulnerabilities are far from a theoretical concern.
sVirt is an effort started by James Morris which aims to isolate guests using MAC security policy (i.e. SELinux). It introduces a pluggable security framework to libvirt and a SELinux implementation.
The sVirt framework allows guests and their resources to be uniquely labelled. Once labelled, rules can be applied which reject accesses between different guests.
Benefit to Fedora
The strong security policy enforcement provided by SELinux means that Fedora systems are well protected from malicious attempts to exploit security flaws.
sVirt brings that same benefit to Fedora's virtualization support. Integration of MAC will help increase the overall robustness and security assurance of Fedora host systems.
sVirt is a foray into an emerging field of security research. By adopting this work, Fedora will continue to lead the way in providing fully integrated security solutions and virtualization support.
Scope
The work primarily involves modifications to libvirt, but also virt-manager, SELinux policy and, perhaps, QEMU.
How To Test
Make sure the virtual machines are running with a categorized context.
If you had a virtual machine named F11 For example
system_u:system_r:qemu_t:s0:c344,c902
ps -eZ | grep qemu
If it is running as system_u:system_r:qemu_t:s0 or some other context then svirt is not working.
The image file for the qemu should be labeled similarly
ls -lZ /var/lib/libvirt/images/F11.img
Should show a context like the following.
system_u:object_r:virt_image_t:s0:c344,c902
To make sure SELinux is blocking illegal access you can change the context on the image
chcon -l s0:c1 /var/lib/libvirt/images/F11.img
Now start the image again, it should blow up and with a permission denied and generate an avc indicating system_u:system_r:qemu_t:s0:c344,c902 tried to write to system_u:object_r:virt_image_t:s0:c1
User Experience
Theoretically the user should not experience anything. This should just happen automatically and the virtual machines should just work.
The user will be able to configure whether or not he wants isolated virtual machines.
Dependencies
svirt depends on updates to libvirt, selinux-policy, libselinux and python-virtinst.
Potentially some changes to virt-manager
Contingency Plan
Documentation
- Project home page
- initial requirements analysis
- LCA presentation (January 2009)
- Discussion on libvir-list about issues relating to locking down qemu.
Release Notes
Fedora 11 integrates SELinux's Mandatory Access Control with Virtualization. Virtual machines can now be much more effectively isolated from the host and one another, giving the increased assurance that security flaws cannot be exploited by malicious guests.