CRIU and SELinux

on YouTube ↗20m

" summary

Explains how CRIU (Checkpoint/Restore in Userspace) must manage SELinux labels to implement live migration for container runtimes that use SELinux, describing the steps required to fully restore processes with their SELinux context. Discusses why preserving SELinux state is challenging during live migration, notes that CRIU can now migrate processes/containers without losing SELinux information, and requests feedback on any missing implementation parts.

AI-written summary · about

" chapters (11)

1. 0:00CRIU and SELinux
2. 1:04around 2011
3. 2:20BuildRequires: libselinux-devel
4. 3:20Read /proc/PID/attr/current
5. 5:27Build CRIU from source
6. 6:49Injected into the process
7. 7:07Daemon waiting for commands
8. 7:20Removed after usage
9. 7:57setsockcreatecon (3)
10. 8:38Write /proc/PID/attr/current
11. 14:16proc/sys/kernel/ns_last_pid

" related talks

• 39mContainer Live MigrationAdrian Reber · DevConf.CZ 2021
• 26mFast and Service-preserving Recovery from Malware Infections Using CRIUAshton Webster · USENIX Security '18
• 44mUsing SELinux with container runtimesDaniel Walsh, Lukas Vrabec · DevConf.CZ 2019
• 33mFreeze,Investigate,Recover: Unlocking Forensic Container Checkpoint...Neel Shah, Suman Chakraborty · KubeCon + CloudNativeCon India 2025
• 15mSELinuxPaul Moore · Linux Security Summit 2016
• 24mUnprivileged CRIUYounes Manton · Linux Plumbers Conference 2022
• 37mCRI-O: Under the HoodSascha Grunert, Mrunal Patel · KubeCon + CloudNativeCon North America 2019
• 21mCRI-O: Secure, Performant, and Boring...Sascha Grunert, Mrunal Patel, Peter Hunt, Urvashi Mohnani · KubeCon + CloudNativeCon Europe 2022