GlusterFS is an open source, software defined scale out distributed filesystem which resides in user-space and typical runs on any commodity hardware. It has a stackable architecture so that it is very easy to introduce a new feature. When storage (in any sort) comes into picture, security and privacy are two important features which are of concern to everyone. SELinux is one among the trending facilities which provides both. From the server-side view GlusterFS works well in SELinux environments, but this does not address SELinux support for the contents stored on Gluster volumes. This presentation will cover one step further; how an end user can use SELinux context over Gluster volumes. In the world of Storage As a Service this is a feature that everyone will love to have.
This talk will cover two open source technologies SELinux and GlusterFS. GlusterFS is software defined storage. SELinux otherwise known as Security Enhanced Linux is security module available in linux kernel through which security policies can be defined. Although it is widely used in linux world , no one has tried it with a distributed file system.So why it is important for software defined storage or in distribute storage ? The user specific security options available for end user is always limited(one of them is acl). First of all it is an additional security flavor for the end user. From a point of storage as a service, it is one of the key security feature which an end user can directly use. There are different clients which tries to provide this facility. In case of NFS, Labeled NFS is effort put on nfsv4 protocol which avails the same.
The entire talk covers how SELinux feature can be implemented in a distributed file system, taking GlusterFS as an example. GlusterFS has a stackable architecture so that we can easily plug this feature. Each layer in this stack is known as translator. In case of SELinux a new translator will introduced at server side. The SELinux context are stored at backend as extended attributes named as "security.selinux". So this translator will handle all the getxattr/setxattr calls from the clien. Another important point to be noted is there will SELinux context for gluster process in Linux environments. So this contexts should be mess up with files stored in gluster volumes.
This project is planned for gluster 3.10 release. So it will be a good platform to get early feedback/suggestion/contribution for this feature.
Speakers: Jiffin Tony Thottan