Implementing security in process-based virtualization
In one embodiment, a mechanism to implement security in process-based virtualization is disclosed. In one embodiment, a method includes maintaining a security policy for a process-based virtualization system, initializing a virtual machine (VM) in the process-based virtualization system, assigning a security label to the VM, and enforcing the security policy on the VM based on the security label of the VM in order to isolate the VM from other VM's in the process-based virtualization system.
1. A method, comprising:
maintaining, by a processing device of a computing device, a security policy for a process-based virtualization system executed by the processing device on the computing device;
initializing, by the processing device, a virtual machine (VM) in the process-based virtualization system;
allocating, by the processing device to the VM, a category from a plurality of categories of a multi-category system (MCS) label of a SELINUX operating system (OS) to the VM, wherein the allocated category for the VM is distinctive to the VM and differentiates the VM from other VMs initialized in the process-based virtualization system, wherein the security policy comprises an access control method in the SELINUX OS that uses the plurality of categories to isolate the VM from the other VMs, and wherein the plurality of categories of the MCS label is repurposed for each category of the plurality of categories to be different from one another in order to isolate the VM from the other VMs;
assigning, by the processing device, the allocated category of the MCS label to an MCS field of an SELINUX OS multi-level security (MLS) label of the SELINUX OS associated with the VM;
mapping, by the processing device, a unique identifier (UUID) of the VM to the MCS label of the VM; and
enforcing, by the processing device, the security policy on the VM based on the MCS field of the MLS label of the VM in order to isolate the VM from the other VMs initialized in the process-based virtualization system.
2. The method of claim 1 , wherein the MLS label comprises the UUID of the VM as part of the MLS label.
3. The method of claim 1 , wherein the security policy is utilized by a host kernel of the process-based virtualization system to mediate access between the VM and the other VMs in the process-based virtualization system.
4. The method of claim 1 , wherein the process-based virtualization system is a kernel-based virtualization model (KVM) system.
5. The method of claim 1 , wherein the security policy for the VM is stored in a virtualization library in an operating system (OS) of the computing device.
6. The method of claim 1 , wherein multiple parts of the MLS label are utilized to provide different levels of security to the VM.
7. A system, comprising:
a memory;
a processing device communicably coupled to the memory;
a virtual library communicably coupled to the memory and the processing device, the virtual library to store and maintain a security policy for a process-based virtualization scheme implemented by the system; and
a virtualization driver executable from the memory by the processing device and communicably coupled to the virtual library, the virtualization driver to:
initialize the VM using the process-based virtualization scheme;
allocate, to the VM, a category from a plurality of categories of a multi-category system (MCS) label of a SELINUX operating system (OS) to the VM, wherein the allocated category for the VM is distinctive to the VM and differentiates the VM from other VMs initialized in the process-based virtualization system, wherein the security policy comprises an access control method in the SELINUX OS that uses the plurality of categories to isolate the VM from the other VMs, and wherein the plurality of categories of the MCS label is repurposed for each category of the plurality of categories to be different from one another in order to isolate the VM from the other VMs;
assign the allocated category of the MCS label to an MCS field of an SELINUX OS multi-level security (MLS) label of the SELINUX OS associated with the VM; and
map a unique identifier (UUID) of the VM to the MCS label of the VM; and
enforce the security policy on the VM based on the MCS field of the MLS label of the VM in order to isolate the VM from the other VMs initialized in the process-based virtualization system.
8. The system of claim 7 , wherein the MLS label comprises the UUID of the VM as part of MLS label.
9. The system of claim 7 , wherein the process-based virtualization scheme is a kernel-based virtualization model (KVM) system.
10. The system of claim 7 , wherein the virtualization driver is further operable to mediate access between the VM and the other VMs in the system.
11. The system of claim 7 , wherein one or more MLS labels are applied to individual resources on the VM.
12. A non-transitory machine-readable storage medium including data that, when accessed by a processing device, cause the processing device to:
maintain, by the processing device of a computing device, a security policy for a process-based virtualization system executed by the processing device on the computing device;
initialize, by the processing device, a virtual machine (VM) in the process-based virtualization system;
allocate, by the processing device to the VM, a category from a plurality of categories of a multi-category system (MCS) label of a SELINUX operating system (OS) to the VM, wherein the allocated category for the VM is distinctive to the VM and differentiates the VM from other VMs initialized in the process-based virtualization system, wherein the security policy comprises an access control method in the SELINUX OS that uses the plurality of categories to isolate the VM from the other VMs, and wherein the plurality of categories of the MCS label is repurposed for each category of the plurality of categories to be different from one another in order to isolate the VM from the other VMs;
assign, by the processing device, the allocated category of the MCS label to an MCS field of an SELINUX OS multi-level security (MLS) label of the SELINUX OS associated with the VM;
map, by the processing device, a unique identifier (UUID) of the VM to the MCS label of the VM; and
enforce, by the processing device, the security policy on the VM based on the MCS field of the MLS label of the VM in order to isolate the VM from the other VMs initialized in the process-based virtualization system.
13. The non-transitory machine-readable storage medium of claim 12 , wherein the MLS label uses the UUID of the VM as part of the MLS label.
14. The non-transitory machine-readable storage medium of claim 12 , wherein the security policy is utilized by a host kernel of the process-based virtualization system to mediate access between the VM and the other VMs in the process-based virtualization system.
15. The non-transitory machine-readable storage medium of claim 12 , wherein the process-based virtualization system is a kernel-based virtualization model (KVM) system.
16. The system of claim 7 , wherein multiple parts of the MLS label are utilized to provide different levels of security to the VM.
17. The non-transitory machine-readable storage medium of claim 12 , wherein the security policy for the VM is stored in a virtualization library in an operating system (OS) of the computing device.
18. The non-transitory machine-readable storage medium of claim 12 , wherein multiple parts of the MLS label are utilized to provide different levels of security to the VM.