OSSN-0001: Selecting LXC as Nova Virtualization Driver can lead to data compromise

Summary

LXC does not provide the same level of separation as hypervisors when chosen as the Nova ‘virtualization driver’. Attempting to use LXC as a drop in replacement for a hypervisor can result in data exposure between tenants.

Affected Services / Software

Nova, LXC, Libvirt, Virtualization Driver

Discussion

The Libvirt LXC functionality exposed by OpenStack is built on the kernel namespace & cgroup technologies. Until Linux 3.8, there has been no support for separate user namespaces in the kernel. As such, there has been no way to securely isolate containers from each other or the host environment using DAC (discretionary access control). For example, they can escape their resource constraints by modifying cgroups settings, or attack the host via various files in the proc and sysfs filesystems. The use of MAC (mandatory access control) technologies like SELinux or AppArmour can mitigate these problems, but it is not practical to write MAC policies that would allow running full OS installs in LXC under OpenStack.

Although initial user namespace support was merged in Linux 3.8, it is not yet complete, or mature enough to be considered secure. Work is ongoing to finish the kernel namespace support and enhance libvirt LXC to take advantage of it.

Contacts / References

Author: Robert Clark, HP