[Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[David Howells]

I'm not sure this is the right venue for this, but keyrings will need to be
namespaced/containerised at some point.

The problem is that it's an icky problem given that different key types really
want to live in different namespaces, and upcalls may want to done in
different containers, depending on the key type.

For example, DNS resolver keys - should they be in the network, the filesystem
namespace or neither?  Should the upcall be in the current container or the
root container?

Authentication keys, such as used by kafs and AF_RXRPC - should they be in the
filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC is a net
protocol) or the user namespace?

Should crypto keys, such as the asymmetric key type, be in the user namespace?
What about use by module signing?  Should key operations in the current
container have access to a blacklist in the root container?  Should key
verification in the current container have access to system keyrings?  The
TPM?

This might actually be right for a hallway track.

David

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Rik van Riel]

[-- Attachment #1: Type: text/plain, Size: 1608 bytes --]

On Fri, 2016-07-22 at 12:01 +0100, David Howells wrote:
> I'm not sure this is the right venue for this, but keyrings will need
> to be
> namespaced/containerised at some point.
> 
> The problem is that it's an icky problem given that different key
> types really
> want to live in different namespaces, and upcalls may want to done in
> different containers, depending on the key type.
> 
> For example, DNS resolver keys - should they be in the network, the
> filesystem
> namespace or neither?  Should the upcall be in the current container
> or the
> root container?
> 
> Authentication keys, such as used by kafs and AF_RXRPC - should they
> be in the
> filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC
> is a net
> protocol) or the user namespace?
> 
> Should crypto keys, such as the asymmetric key type, be in the user
> namespace?
> What about use by module signing?  Should key operations in the
> current
> container have access to a blacklist in the root container?  Should
> key
> verification in the current container have access to system
> keyrings?  The
> TPM?
> 
> This might actually be right for a hallway track.
> 
While figuring out the answers might be right for a hallway
track, it seems that enough maintainers might run into this
stuff later on that sharing the understanding could be good
for a general session.

There is no need to keep this knowledge obscure, especially
given that the more maintainers understand it, the less likely
it is that future mistakes will get merged.

-- 

All Rights Reversed.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[James Bottomley]

On Fri, 2016-07-22 at 12:01 +0100, David Howells wrote:
> I'm not sure this is the right venue for this, but keyrings will need 
> to be namespaced/containerised at some point.

There are various unvirtualised subsystems within Linux.  There has
been discussion on the containers mailing list about how:

http://thread.gmane.org/gmane.linux.kernel.containers/30371

So far Eric has advocated for making things like this properties of the
user namespace; I'm more inclined to a separate namespace for
delegates, but nothing's been decided.

Proposing on the containers list should be your first step (I've added
the list to the cc).

> The problem is that it's an icky problem given that different key 
> types really want to live in different namespaces, and upcalls may 
> want to done in different containers, depending on the key type.

Surely if you virtualize, you'll have a namespace label per key (or
keyring) so they'll be in one and only one namespace.

The upcall problem sounds like it might be similar to the nfsd one,
which is nasty.  Describing it on the list would help people
understand.

> For example, DNS resolver keys - should they be in the network, the 
> filesystem namespace or neither?  Should the upcall be in the current 
> container or the root container?

Depends what the upcall does.

> Authentication keys, such as used by kafs and AF_RXRPC - should they 
> be in the filesystem namespace (kafs is an fs), the network namespace 
> (AF_RXRPC is a net protocol) or the user namespace?

I'm sort of starting to see Eric's point now, since every namespace has
an owning user namespace, if they were in that the question is
naturally answered.

> Should crypto keys, such as the asymmetric key type, be in the user 
> namespace? What about use by module signing?  Should key operations 
> in the current container have access to a blacklist in the root 
> container?  Should key verification in the current container have 
> access to system keyrings?   The TPM?
> 
> This might actually be right for a hallway track.

Actually, I really think this isn't a KS issue, it should be proposed
for the Plumbers Containers MC:

http://www.linuxplumbersconf.org/2016/ocw/events/LPC2016/tracks/519

You have all the correct people in that session.  At KS you'll have 50%
bored, 48% hostile because they hate cgroups and 2% interested.

James

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Serge E. Hallyn]

Quoting James Bottomley (James.Bottomley@HansenPartnership.com):
> On Fri, 2016-07-22 at 12:01 +0100, David Howells wrote:
> > I'm not sure this is the right venue for this, but keyrings will need 
> > to be namespaced/containerised at some point.
> 
> There are various unvirtualised subsystems within Linux.  There has
> been discussion on the containers mailing list about how:
> 
> http://thread.gmane.org/gmane.linux.kernel.containers/30371
> 
> So far Eric has advocated for making things like this properties of the
> user namespace; I'm more inclined to a separate namespace for
> delegates, but nothing's been decided.
> 
> Proposing on the containers list should be your first step (I've added
> the list to the cc).
> 
> > The problem is that it's an icky problem given that different key 
> > types really want to live in different namespaces, and upcalls may 
> > want to done in different containers, depending on the key type.
> 
> Surely if you virtualize, you'll have a namespace label per key (or
> keyring) so they'll be in one and only one namespace.
> 
> The upcall problem sounds like it might be similar to the nfsd one,
> which is nasty.  Describing it on the list would help people
> understand.
> 
> > For example, DNS resolver keys - should they be in the network, the 
> > filesystem namespace or neither?  Should the upcall be in the current 
> > container or the root container?
> 
> Depends what the upcall does.
> 
> > Authentication keys, such as used by kafs and AF_RXRPC - should they 
> > be in the filesystem namespace (kafs is an fs), the network namespace 
> > (AF_RXRPC is a net protocol) or the user namespace?
> 
> I'm sort of starting to see Eric's point now, since every namespace has
> an owning user namespace, if they were in that the question is
> naturally answered.
> 
> > Should crypto keys, such as the asymmetric key type, be in the user 
> > namespace? What about use by module signing?  Should key operations 
> > in the current container have access to a blacklist in the root 
> > container?  Should key verification in the current container have 
> > access to system keyrings?   The TPM?
> > 
> > This might actually be right for a hallway track.

Hi,

Just chiming in to say that if there were to be namespace discussion at
ksummit I'd like to be involved.  Mostly staying quiet as I don't expect
it since m-l typically works fine.

> 
> Actually, I really think this isn't a KS issue, it should be proposed
> for the Plumbers Containers MC:
> 
> http://www.linuxplumbersconf.org/2016/ocw/events/LPC2016/tracks/519
> 
> You have all the correct people in that session.  At KS you'll have 50%
> bored, 48% hostile because they hate cgroups and 2% interested.

Eh, hostile is useful - forged in the crucible and all that.

> James

-serge

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Laurent Pinchart]

Hi James,

On Friday 22 Jul 2016 07:51:05 James Bottomley wrote:
> On Fri, 2016-07-22 at 12:01 +0100, David Howells wrote:
> > I'm not sure this is the right venue for this, but keyrings will need
> > to be namespaced/containerised at some point.
> 
> There are various unvirtualised subsystems within Linux.  There has
> been discussion on the containers mailing list about how:
> 
> http://thread.gmane.org/gmane.linux.kernel.containers/30371
> 
> So far Eric has advocated for making things like this properties of the
> user namespace; I'm more inclined to a separate namespace for
> delegates, but nothing's been decided.
> 
> Proposing on the containers list should be your first step (I've added
> the list to the cc).
> 
> > The problem is that it's an icky problem given that different key
> > types really want to live in different namespaces, and upcalls may
> > want to done in different containers, depending on the key type.
> 
> Surely if you virtualize, you'll have a namespace label per key (or
> keyring) so they'll be in one and only one namespace.
> 
> The upcall problem sounds like it might be similar to the nfsd one,
> which is nasty.  Describing it on the list would help people
> understand.
> 
> > For example, DNS resolver keys - should they be in the network, the
> > filesystem namespace or neither?  Should the upcall be in the current
> > container or the root container?
> 
> Depends what the upcall does.
> 
> > Authentication keys, such as used by kafs and AF_RXRPC - should they
> > be in the filesystem namespace (kafs is an fs), the network namespace
> > (AF_RXRPC is a net protocol) or the user namespace?
> 
> I'm sort of starting to see Eric's point now, since every namespace has
> an owning user namespace, if they were in that the question is
> naturally answered.
> 
> > Should crypto keys, such as the asymmetric key type, be in the user
> > namespace? What about use by module signing?  Should key operations
> > in the current container have access to a blacklist in the root
> > container?  Should key verification in the current container have
> > access to system keyrings?   The TPM?
> > 
> > This might actually be right for a hallway track.
> 
> Actually, I really think this isn't a KS issue, it should be proposed
> for the Plumbers Containers MC:
> 
> http://www.linuxplumbersconf.org/2016/ocw/events/LPC2016/tracks/519
> 
> You have all the correct people in that session.  At KS you'll have 50%
> bored, 48% hostile because they hate cgroups and 2% interested.

Virtualization is increasingly affecting more and more subsystems. While I 
don't disagree with you, I also see value in teaching maintainers about 
containers, namespaces and the way they affect subsystems. We should ensure 
that best practices can be followed going forward, and avoiding subsystems 
being developed in a way that will make it difficult for them to be 
virtualized later (although one might argue that we've already made a mess in 
several subsystems anyway). KS would be a good place to spread the message as 
widely as possible among maintainers, with Plumbers a good venue for more 
technical discussions.

-- 
Regards,

Laurent Pinchart

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[James Bottomley]

On Tue, 2016-07-26 at 16:38 +0300, Laurent Pinchart wrote:
> > Actually, I really think this isn't a KS issue, it should be 
> > proposed for the Plumbers Containers MC:
> > 
> > http://www.linuxplumbersconf.org/2016/ocw/events/LPC2016/tracks/519
> > 
> > You have all the correct people in that session.  At KS you'll have 
> > 50% bored, 48% hostile because they hate cgroups and 2% interested.
> 
> Virtualization is increasingly affecting more and more subsystems. 
> While I don't disagree with you, I also see value in teaching 
> maintainers about containers, namespaces and the way they affect
> subsystems.

I'm certainly not averse to that.  However, the proposal was to discuss
a really esoteric feature, namely keyring namespaces.  I'm just
pointing out that KS isn't the right audience to have that discussion.

>  We should ensure that best practices can be followed going forward, 
> and avoiding subsystems being developed in a way that will make it 
> difficult for them to be virtualized later (although one might argue 
> that we've already made a mess in several subsystems anyway). KS 
> would be a good place to spread the message as widely as possible 
> among maintainers, with Plumbers a good venue for more technical
> discussions.

Hey, give us brownie points for already avoiding the KVM/Xen mess.  We
do only have one API set that every container orchestration system (be
it docker, formerly known as rocket, lxc or openvz) uses.  However,
you're right, we should discuss some of the proliferation problems of
the APIs, however I'm still not convinced that KS would have the right
audience for that ...

James

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Mimi Zohar]

On Fr, 2016-07-22 at 12:01 +0100, David Howells wrote:
> I'm not sure this is the right venue for this, but keyrings will need to be
> namespaced/containerised at some point.
> 
> The problem is that it's an icky problem given that different key types really
> want to live in different namespaces, and upcalls may want to done in
> different containers, depending on the key type.
> 
> For example, DNS resolver keys - should they be in the network, the filesystem
> namespace or neither?  Should the upcall be in the current container or the
> root container?
> 
> Authentication keys, such as used by kafs and AF_RXRPC - should they be in the
> filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC is a net
> protocol) or the user namespace?
> 
> Should crypto keys, such as the asymmetric key type, be in the user namespace?
> What about use by module signing?  Should key operations in the current
> container have access to a blacklist in the root container?  Should key
> verification in the current container have access to system keyrings?  The
> TPM?
> 
> This might actually be right for a hallway track.

Mat Martineau' patch set might address some of these issues for the
asymmetric key type.  As part of the container/namespace initialization,
these self trusted keyrings could be created.

Mimi

Re: [Ksummit-discuss] [TECH TOPIC] Containerisation, namespaces and keyrings

[Eric W. Biederman]

David Howells <dhowells@redhat.com> writes:

> I'm not sure this is the right venue for this, but keyrings will need to be
> namespaced/containerised at some point.
>
> The problem is that it's an icky problem given that different key types really
> want to live in different namespaces, and upcalls may want to done in
> different containers, depending on the key type.

I definitely think there are some techinical details going over with a
fine tooth comb.  Ordinary keys and keyrings that are used for purposes
such as authorization to use files on nfs I long ago put in the user
namespace.   Because they largely serve the same purpose as uids,
and the user namespace is where we have identifiers for security things
stashed away.

My analysis at the time suggested that there were not identifiers that
needed to be preserved over checkpoint/restart (and I was lazy) so the
user namespace only filters these identifiers.

Upcalls and the caching of the results of upcalls are definitely a
problem.  Several years when I was looking at things I found the upcall
code unusable because I could not invalidate cached results.  And of
course we have the long running question of how do we make upcalls
work from a container.

> For example, DNS resolver keys - should they be in the network, the filesystem
> namespace or neither?  Should the upcall be in the current container or the
> root container?
>
> Authentication keys, such as used by kafs and AF_RXRPC - should they be in the
> filesystem namespace (kafs is an fs), the network namespace (AF_RXRPC is a net
> protocol) or the user namespace?
>
> Should crypto keys, such as the asymmetric key type, be in the user namespace?
> What about use by module signing?  Should key operations in the current
> container have access to a blacklist in the root container?  Should key
> verification in the current container have access to system keyrings?  The
> TPM?
>
> This might actually be right for a hallway track.

Hallway track/hackathon.  The solutions to the practical problems will
only come of the right people sitting down with the code and looking at
the issues.  Most of the problems I am aware of are not so much
placement in a namespace but rather technical plumbing issues necessary
to make the things people should work actually work.

Eric