Linux Security and Isolation APIs Fundamentals

Topics

1. Introduction
2. Classical privileged programs
   1. Process credentials
   2. Set-user-ID and set-group-ID programs
   3. Changing process credentials
3. Capabilities
   1. Process and file capabilities
   2. Setting and viewing file capabilities
   3. Text form capabilities
   4. Capabilities and execve()
   5. Root, UID transitions, and capabilities (*)
   6. Programming with capabilities (*)
4. Namespaces
   1. Namespace types
   2. UTS namespaces
   3. Namespace APIs and commands
   4. Mount namespaces and shared subtrees
   5. PID namespaces
5. Namespaces APIs
   1. Creating a child process in a new namespace: clone()
   2. /proc/PID/ns
   3. Entering a namespace: setns()
   4. Creating a namespace: unshare()
   5. PID namespaces idiosyncrasies (*)
6. User Namespaces
   1. Overview of user namespaces
   2. Creating and joining a user namespace
   3. User namespaces: UID and GID mappings
   4. User namespaces, execve(), and user ID 0
   5. Combining user namespaces with other namespaces
   6. User namespaces and capabilities
   7. What does it mean to be superuser in a namespace?
7. Cgroups (Control Groups) Version 2
   1. What are cgroups?
   2. Example: the pids controller
   3. Cgroups v2 controllers
   4. Enabling and disabling controllers
   5. Organizing cgroups and processes
8. Seccomp (*)
   1. The BPF virtual machine and BPF instructions
   2. BPF filter return values
   3. Checking the architecture
   4. Productivity aids (libseccomp)

Audience
The primary audience comprises designers and programmers building privileged applications, container applications, and sandboxing applications. Systems administrators and DevOps engineers who are managing such applications are also likely to find the workshop of benefit.

Format
The workshop consists of a mixture of presentations coupled with practical exercises that allow participants to apply the knowledge learned in the presentations.

Prerequisites
Participants should be familiar with fundamental system programming topics such as file I/O using system calls, signals, and the system calls that define the lifecycle of a process (fork(), execve(), wait() , exit()). For a refresher on these topics, you can download the course materials available at https://man7.org/training/spess/. In addition, participants should have a reading knowledge of the C programming language. (Note, however, that the practical sessions do not require writing C programs.)

Computer Setup
You'll need a laptop with Linux installed - either as a native install or inside a virtual machine (VM). You should ensure that you have a fairly recent Linux distribution.