Open Source Summit + Embedded Linux Conference + OSPOCon 2021

Containers are generally perceived less secure than virtual machines. Without doing into a theological argument about the actual state of the affairs, we suggest to explore the possibility of using MMU as the hardware isolation mechanism to make containers even more secure. Traditionally, Linux kernel uses a single page table to manage all its objects and any kernel data is accessible from anywhere in the kernel. From security standpoint, such ability of the kernel to access any memory from any part of the code is a liability. The fundamental mechanism of container isolation - namespaces - makes most of the kernel objects private for a namespace. There is no need for the kernel code that runs outside the namespace to access these private objects. We present restricted kernel address spaces and their use with Linux namespaces to ensure that private objects of a namespace cannot be accessed by other parts of the kernel. A restricted page table is assigned to a namespace in a way that minimizes overhead and allows removing private objects from the default kernel page table. Besides, we present possible optimizations for direct map management to reduce performance penalty caused by the direct map fragmentation.