SELinux All the Way Down: Namespaces for SELinux
Talkat Linux Security Summit North America 2025 · on Friday, 2025-06-27· at 11:05· Bluebird Ballroom (BBB) 3GH·
summary
Proposal enables per-container policies by giving each SELinux namespace its own policy, AVC, enforcing mode and selinuxfs instance while requiring ancestor policies to confine children. Implementation uses a selinuxfs unshare node, per-credential namespace pointers, and global SIDs with wrappers to map into per-policy structures. systemd-nspawn proof-of-concept boots Fedora/Rocky containers on Fedora/Ubuntu hosts; kernel test suite mostly passes and benchmarks show minimal performance overhead. Remaining blockers are final kernel API choices and a few networking/namespacing gaps.
AI-written summary · about
chapters (23)
- 0:00SELinux namespaces intro
- 2:09SELinux in containers limits
- 4:17SELinux namespaces use cases
- 6:27SELinux namespaces history
- 9:18How SELinux namespaces work
- 13:13SELinux ID handling
- 15:02Permission checks in namespaces
- 17:51Resource limits for namespaces
- 19:37Unsharing SELinux namespaces
- 21:25Kernel state encapsulation
- 23:11Network namespace interactions
- 24:34Process labeling in namespaces
- 27:05Optimizing permission checks
- 27:27User space interfaces
- 29:12Security guardrails
- 31:19Testing with systemd
- 34:30Manual namespace setup
- 36:56SELinux containers with namespaces
- 38:01Testing namespace functionality
- 39:27Performance overhead
- 41:59Open issues before upstream
- 43:24Known limitations and future
- 44:26Q&A
related talks
31mOverview and Recent Developments: SELinux
15mSELinux
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers
44mUsing SELinux with container runtimes
19mSELinux Update
36mPaving the Way for Uninterrupted Car Operations
57mNamespaces for Security
38mCustom SELinux container policies in OpenShift