Overlay Filesystem Mounter Credential Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In overlay filesystems, the mounter process can compromise access control security policies by adding security context labels that provide unauthorized access to files, as the MAC security check only checks labels on the virtual overlay layer, ignoring those on the lower layer, allowing the mounter to access files it shouldn't and blocking access for applications that should have it.
Innovation Solution
A processing unit is installed in the kernel to check the mounter's credentials and ensure they have access to the underlying files before granting access, performing an additional check beyond just the security context label of the application process, thereby preventing unauthorized access and maintaining access control policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the MAC security check only checks security context labels on the virtual overlay layer, then the overlay filesystem can provide merged directory tree access, but the mounter process can compromise access control security policies by adding security context labels that provide unauthorized access to files on the lower layer
Solution Approach 1:
The patent segments the security check into two distinct parts: checking the security context label on the virtual overlay layer, and separately checking the mounter's credentials against the underlying lower layer files. This segmentation allows each check to focus on its specific security concern without interfering with the other, preventing the mounter from bypassing access controls through the overlay interface
Solution Approach 2:
The patent performs the mounter credential check as a preliminary action before granting access to files through the overlay filesystem. By checking whether the mounter has proper access credentials to the underlying files before allowing the overlay mount to provide access, the system prevents unauthorized access from being established in the first place, rather than attempting to revoke it later
Data Source
AI summary
An implementation of this disclosure provides a system comprising memory to store a plurality of layers and a processing device coupled to that memory to set up the layers and to mount them into an overlay. The layers comprise an upper and one or more lower layers. The overlay provides access to a plurality files stored in the overlay filesystem. A request from an application to access a file in the mounted overlay is received. An access policy for the mounter that mounted the layers is identified in view of the mounter's credentials. The processing device checks, in view of the access policy, whether a security context label for the file provides access to the application and to the mounter of the overlay in at least one lower layer comprising the file. An instruction to provide the application with access to the file is issued in view of the check.