Enforce a Global Security Policy for User Access to Clustered Container Systems via User Namespace Sharing

Abstract

With the advancement of containerization technologies and the isolation mechanisms provided by the Linux kernel through features like namespaces and cgroups, a question arises whether total isolation in containers (virtual enclave) can provide an increased level of security in all use cases. In the current paper we aim to explore the idea of unifying the container's user namespace with the host system's user namespace, to validate if this approach may increase the overall security in some areas of use. Such an approach can facilitate the implementation of complex access policies with high granularity and reduce the weak points that can lead to privilege-escalation attacks. We will explore how different containerization engines can be configured to support the user namespace unification and we will see why the Singularity containerization engine is a perfect fit for our purposes. In addition, we will propose a concept architecture for an academic cluster that can natively support the enforcement of a unified user access policy among both: underlying nodes and containers running above.