Welcome back. I think it's our last session of the day, right? So we've got an LSM maintainers panel on the far I guess would be to your left to my right. We've got Mikhail maintainer of Landlock we've got Mimi maintainer of Ima EVM the integrity LSM. I don't know What's it actually called integrity subsystem? There we go the integrity subsystem We've got John who maintains app armor, and we've got Casey who maintains smack So and I'm Paul. I'm gonna be moderating I maintain Essie Linux and kind of the LSM layer as a whole So anyway, we're kind of planning. We've got a couple questions kind of to start off And then we're gonna open up to you guys. Hopefully you guys will have some questions If not, I've got a whole stack of cards here So we should be able to fill 45 minutes if you're feeling shy today. So anyway We're gonna start off and I guess Mikhail I'll start off with you and we'll kind of work our way down Then we can snake back. So first question What do you view is the biggest challenge facing LSM's today? And this could either be your specific LSM or just LSM's in general and I guess it's a bonus follow-on question What planes if any do you have to address that? So I think the biggest well my point of view the biggest challenges for LSM to be accessible to be usable and Well to do something useful So usability I would get I would say That's very think probably that applies for most of us What do you have any plans to to address that? Well, I mean my best with Slunlock And Then that well, I think Well, what can use a space tools tooling and the condition is what we should do. So Yeah, nothing magic, but yeah All right. Thank you Mimi you want to repeat the question. Sorry. Okay So what do you view is the biggest challenge facing LSM's and this could be you know feel-free to answer specific to integrity subsystem or just LSM's in general and As a bonus if you've got a good answer for this, you know, do you have any specific plans to address that? okay, so we're gonna stay on the integrity subsystem and So the biggest challenge is making sure that no new integrity Gaps are introduced and How we do that I Think that'll leave that for later That's fair. That's fair Okay, thank you. John do what I can repeat Actually, my answer kind of follows on Mimi's there because I think one of our biggest challenges is we keep having new capabilities introduced in the kernel that we don't have mediation for and we keep having kernel devs avoid the LSM and I really don't know how to get them to You know check with us and get hooks and or at least work with us work with us. Yeah Yeah, no, I I understand I think we've kind of all felt that pain at some point And I guess to be clear when you say capabilities you're talking about just functionality in general functionalities not posix capabilities Well, I'm that yeah, that's a whole issue in them itself the you know them throwing Everything at Cap Mac admin or Yeah, okay Do you have any plans on or do you have any thoughts rather and how to improve that? I Do have some thoughts on how to maybe improve it, but getting people to go along with it would be difficult So I I would like to see you know actually capabilities broken out in the kernel and it become LSM calls instead and then re put back together So we have more context when it's coming in as to everything being Cap Mac admin and then if Nobody had access to directly to capability or P trace like that and they would be forced to say security something and then Potentially we might get a little bit more interaction It's a good point Yeah, especially when you consider most of the places in the kernel that We would want an LSM hook you generally have a capability call of some sort in that section of code So yeah, that could be a good idea Thank you Casey. I know you've got some ideas. Yeah Yeah, I can repeat the question. No, that's quite all right I think the biggest single issue that we've got with the LSM is That our security paradigms are 30 years old We're starting to see things like landlock come in where it's a different mindset a different way of looking at things as opposed to what we mostly got now which is Based on the main frame sitting in the corner being shared by people who don't trust each other By encouraging more new things to come in New paradigms new ideas new ways to look at security that are more appropriate for the systems. We have today Then the systems we had 30 years ago, I think that we can actually greatly improve the systems and the Usability and the usefulness and and avoid a lot of the things that we see as modern problems Got any plans to fix that? Well, I'm glad you asked I think one of the biggest One of the obstacles we've got is it's very difficult to Implement a new idea LSM if you're looking out at the current distros and you're saying this would be great But I can't get it into there's no way I can get this into the distros so if we can get Module stacking to the point where you can use Use useful things in addition to s e-linux not to say s e-linux isn't the useful thing necessarily but That will actually should help grease the skids as it were and make it easier for people to do things Think that's fair All right, why don't we do one more question, then we'll we'll open it up So I guess we'll we'll snake so this is I'll start with you again case right so you don't get any time off on this okay Shifting gears a little bit so Not necessarily talking about problems, although it could be a problem, but it's nice if we've got positive up here But so what do you view is the most important change? That's currently under development once get this game to be something that you're working on or something at least that you're that you're aware of Well, I can't help but say that the LSM stacking is the most important thing That's fair. I was expecting that It doesn't shouldn't come as a surprise and the first iteration of stacking that we got in That enabled Yama to be something other than a wart and there were a couple of other other lesser elements that were coming along there We're gonna be warts to Warts are bad. Generally, generality is usually a good thing Sometimes you have to have to pay a price for it and we are we're paying a bit of a price for this But I Think that that actually it opens up things in a way that they're they're really not now They're it's too too much Overhead to get in as an LSM these days and if we can make that easier that'd be really a positive thing I think that's right. I think that's probably what we all expected you to reply with so well that he didn't Really? All right. Anyway So all right, so John hopefully hopefully a different answer surprise us surprise you So I do think Casey's right that LSM stacking is the next immediate thing the thing we need to follow on with that Yeah, after that though is is somehow to come up with some name spacing Around the LSM and it's a question that we very much haven't solved yet and it it Stacking in itself is not sufficient for several of the use cases And so that is the next thing we have to be working on and figure out around the LSM's and whether you know whether some there's something we can do that's Unifying to them or you know just enough that each one can do its thing. I don't know Yeah, I think it's fair and I think I know at least in informal discussions whenever this comes up I think it's still very much an open question for just all of us. It's the best way to handle that Well, I don't even think most of LSM's know how they want to handle it themselves. Yeah. Yeah, there's some There's some big challenges there for a lot of yeah right So I'm actually the biggest gap right now. We had a talk on it by Nika and that is the interpreters and Way that files can be read and executed by the interpreters if we can close that in Integrity gap that would be amazing. So I'm waiting and looking forward to having that and Any help I can offer Yeah, so Well First thing is without SM stacking at least the first step, which is upstream yet our luck will not be There are at least not useful. So I think SM stacking is very very important but yeah as It was already said Stacking is what one thing and being able to compose different LSM policies or different security policies but in this case different SM policy Would be quite a challenge. So That would be interesting Definitely, but very difficult to So we still got plenty of time left so why don't we open it up if you guys aren't asleep yet? Any questions that you guys might have for anybody up here or for everyone feel free What do you feel are some of the most significant emerging threats to Linux systems these days? Always a fun question, right? Does anybody want to jump in otherwise I can start picking at people I Would say at this point. It's the divergence between phones and embedded systems They have fundamentally different security threat models and we're using the exact same software in both cases That's going to lead to a case where things will drift in one direction for a while at the expense of another of the other Other side and then these people are gonna say oh, we've got to fix those problems And it'll start drifting back and then they'll cause sister problems over here. So Coming in some way and Whatever this is to identify The threat models more clearly So that they can be differentiated so you can say I'm fixing this for this threat model And I'm not fixing it for this one because this one doesn't really care about it and so people could have an understanding of Why is this security feature going in is completely worthless? You know, who could possibly be using it? Well the light bulb people want it Well light bulb people have different Requirements and so so long as you understand that there's a reason for it. Even if it's not your reason We can get I think a more synergistic Flow of understanding and tolerance of other people's development I think that's interesting sometimes because in cases where the different requirements can be made compatible I think that works, but I think we've all seen cases where sometimes requirements are at odds I think that's where the real fun begins But you know we have ways to dealing with that and you just have to pick sometimes which It's not great, but it does work Same body else wanna sure One of the big threats we're seeing is everything is Everybody wants things to be secure, but they're pulling their source code from everywhere It's like we're just pulling straight from GitHub, you know We have our script. We're running our script and it goes and grabs a script and brings it down and starts running it and Trying to secure that source chain and what's coming in and verify what's there I mean the supply chain attack is the really big problem right now for from our point of view as a company that we work at Trying to figure out how to deal with that and what people's workloads are with everything being so dynamic It's it's ugly We even I mean even extending beyond that to problems that you think we should have solved and we've been talking about this week Yeah, I mean BPF right there's still no sign integrity checking of BPF programs So you're loading code into the kernel then right no No assurance of that hasn't been tampered with or where it came from so yeah, this is still a big problem Right Thank you for answering the integrity aspect of this. Yeah, okay I didn't want to steal your thunder. I mean, do you have anything you want to add to that? No, that's fine. Okay. Okay. Yeah, okay Yeah, all right Yeah, I think the well one thing to to keep in mind and to Repeat and repeat and repeat is that there's no one Linux. There's a lot of different Linux different Canal first and different use cases and different systems. So a lot of different set models and Lot of different priorities It's difficult to To answer well, what is the most impotence? Well, what is the most important kind of attack? Well, it depends of Your system you're predicting what you do with that But I think what is becoming more and more important was the last decade maybe Is that the Well attackers well, it's becoming more and more. Well, it is like really real job and the attacker skills are more and more Well professional and So yeah, this thread is kind of higher than it was maybe 20 years ago I think it's basically for well attacking critical stuff like the colon So we need to protect user space with an SM on any acceptable system But we also need to care a lot about the canal and to find new ways to protect it Well to help it protect itself or to rely on something else Hopefully we answered your question a little bit. All right. Thank you. Do anybody else have a question? I Wanted to push a little bit on ebpf, which you just mentioned in that last question Besides Signing ebpf ebpf so that we have something much like sign modules. Do you see any other place? Where lsm has a role to play with respect to ebpf? I think historically speaking, you know modules have been considered out of scope for LSM because we're just sort of extending the kernel And you know LSM is really more about you know trying to control what user processes do But ebpf is sort of in this weird middle space it both extends the kernel and is very often arbitrary things that are inserted into the kernel by not necessarily trusted user space programs and That's a little terrifying It is and there's I think there's some Philosophical differences around access control between most of the people in this room and a lot of the ebpf developers which further complicates things sometimes But anyway, let me open it up to you guys Somebody surely got to have thoughts on this ebpf is terrifying So From a distro point of view One of the things we've had to deal with is all the CVE is coming in from ebpf and all the attacks It has been used every year in Pondone when we've been a participant Then they just keep adding new things and they keep saying the verifier is you know It's security by a verifier and yet so for example hot BPF not to pick on it, but Yeah, the verifier can do so much But as soon as you open it up to being able to write to the kernel the verifier That's not really doing anything for you as security wise now. You can do anything with it, right? As every time they open up a new capability for ebpf we see new problems and There's no real control of that and I would I mean there there's a little bit of control in ebpf on What subsystems are available, but I would like to see Much better control over that Where we can do something more than just say well, we're just gonna block ebpf and Some granularity there I would love love to see better controls on that Yeah, and I think that's a good point about not wanting to block things. I mean a lot of times I feel like people Especially other subsystems in terms of like why you just wanted to say what we really don't want to disable stuff, right? I mean we don't we We're developers we're users too, right? I mean we want to be able to make use of all these things But we wanted to be safe and we want to make sure that we have all the necessary Stop gaps and controls in there. So yeah, I think that's a good point which is sometimes lost, but And and the first one is of course from an integrity perspective That we only want those things that are signed by known keys That we control and how they get in is really important and not Randomly so It's still the same issue an integrity gap, but that doesn't answer your question. I mean disabling ebpf we Can all sort of pretend like is it abling ebpf is still an option But realistically it's not like that shipper say it right if you look at a modern distribution today Fedora Whatever then you will be Faced with lots of ebpf programs and usually and not necessarily it's it's not wrong like useful Abilities David is looking at me like I just committed heresy I Mean the only way to realistically Address this is if there is some sort of regular exchange like how involved are the LSM and to security modules in In ebpf and like I agree. I mean there's a lot of I wouldn't call it terrifying, but there's a lot of creative and Potentially security sensitive changes coming and they keep innovating which is they're right To do so, but so we in the end need to deal with this like we can't just tell them Go away. I mean you can try but you will fail well, so the one of the things that I I think is very important about the the ebpf is that I Believe now I couldn't be wrong here but my understanding is when it was accepted in there was kind of this notion that you guys are gonna be careful with this and And Well and first off the the people who develop a program right okay. Well the people who develop the programs aside There are things about the way it was implemented that Were eyebrow weight raising to begin with for example that the there's a hook for every LSM hook available Which isn't the model of the LSM infrastructure and And that has led to it to more than one significant problem and If somebody really wanted to do bad things on an s c Linux system all they would have to do is implement an ebpf hook for Security context to sec ID Which could cause all kind yeah, it could cause all sorts of bad things to happen and so There wasn't a lot of you know it was put in it was like oh here's here's the convenient way to do it. Okay now. We're done. Well you'd need to be more careful than that and I think that that's something we've seen in a couple of other subsystems as well recently I owe you ring For example, yeah, where it's just they weren't careful and it being more careful with the Going into the infrastructure that's there already is is something that We could do better on in Linux in general and think that in in the vicinity in the vicinity of security in particular And I think at the risk of Generalizing your question a little bit too much. So apologies if I do that but It's all your points like I said, we're we're not trying to disable stuff like I said, I mean I want to use the cool new features too, right but I think the the issue isn't necessarily specific to eBPF there's this greater issue at large when we mentioned I owe you ring and At LSS last year that I gave a talk on this and some of the challenges we had there and you know next year It's probably going to be something else and there'll be something else the year after that There's what thousands of kernel developers and I don't even know how many different subsystems there are and unfortunately There's not nearly enough LSM developers. I'm not just talking about us just developers and people interested in kernel development or on access controls Where we can go out and keep track of every single development effort that's going on, you know, there's there's We try I've been trying to automate somewhat, you know Watching Linus's tree to detect when things come in with certain things that generally tend to be of interest from access control perspective It's you know, we got to read stuff like LW on a lot, you know, I live reading the LW on things Just try and catch things but even then sometimes it's we're talking about this one of the problems we had with IOU ring is There's the credential sharing issue, which I think we probably don't know about this point But when they reduced it they called it personalities Which is challenging because some of you may not know this there's already a personality concept in the kernel And so if I remember reading the LW on article and I saw personalities and I thought it's kind of odd Why would I you didn't care about personalities and so I just kind of ignored it But then we look at the code and realize no personalities. It's actually credentials So there's all sorts of challenges and I don't think there's a right answer other than we need to find a way to work together, right and We can try like I said we can go out, but I think we also need to Somehow get the other subsystems to be willing to work with us a little bit more You know and when they're when they're developing significant new features just Send out a post to the LSM list even if you don't want to post the full patch set just say hey We're working on this. Here's a pointer to the mailing list archive. Can you can you take a look? Tell us what you think tell us there Is there anything we should potentially be concerned about and I think I don't think anyone up here would object to that No, yeah So I just want to add one more thing to that and I was wondering if we have Documentation on all the steps that have to go through when you apply send-in patches Why can't adding a step that says make sure that if there's any Sort of security or integrity issue that there's a call there that there's a security hook Whether or not and then we will at least have a heads up that something is going on and that would be more of Maybe for the documentation people Well, I think also just kind of socializing that with other Colonel developers and and maybe the maintainers of the larger subsystems and I know one of the suggestions that Case made when we were We were talking about you ring last year and I apologize I haven't had the time to follow up on this yet, but you can put I think you said you put some Regular expressions in the maintainers file so that when people use You know get maintainers, you know if we can flag certain certain keywords certain functions That will get sent to the LSM list, but I also kind of wonder how many How many experienced Colonel developers actually still use get maintainers, right? I think get maintainers is one of those things that you when you first starting out you use it But I think all of us one was the last time use get maintainer Recently what about two weeks ago? Oh when I write something in another Okay, yeah Okay If you use before for sending patches, it will automatically run it Constantine would be very happy that you mentioned that he's right here today, but yeah before is great If you're watching on the video see there we go All right, I think that before we move on to anybody else want to Know all right Well, thank you. That was a good question. Did anybody else I am contractually obligated to ask Has anyone given me thought to using rust in LSM layer Yes, but I need to piss people off All kidding aside A language transition is probably the most dangerous thing you can do is Probably a better idea to rewrite from scratch than it is to try to change your system from one language to another The thought paradigms are very different when you're writing in One language from another I once did an implementation of make in Pascal It was very small and it worked. It worked just fine, but You there were things that just fall out naturally when you're writing in C That if you're writing in a different language You don't do it that way you do it a different way and so I think that The whole notion of oh, well will incrementally switch Linux from C to rust is Is going to Be very frustrating and I think it's probably not the right approach But that's I'm an old guy So I've thought about rust as well my biggest issue with rust there is is time, right? We're already Way under, you know, we need help, right? And we don't have enough time to do everything we need to do and then trying to take the time to rewrite something And rust is just is that one extra thing and you're never getting to anything else? I do have concerns that you know, how do I rewrite just a part, you know, just one part So I can do it incrementally and and not break everything You know, it's it's it's a problem I also think that a bitter approach is probably to look at Some of these ancient services and demons that we've got that haven't changed in 16 years Those might be better candidates They don't have any bugs, right? I think it's a It's quite for the colonel, but it's quite funny software rewriting from one language synthesized costly time in Well bugs that just that are already fixed and so on So yeah, definitely Developing new stuff in rest is definitely a good idea rewriting stuff much more the annoying phone is mine. Sorry But yeah, I'm nobody ever waits. I'm really grateful that we can write some kind of code in rest. It's very good And I think a shameless plug you've got a lamac library Yeah, yeah, yeah for you space. It's uh, yeah, yeah and Further shameless promotion if if other people were interested in rewriting really small LSM's that exist already in the kernel in rust. I Would be happy to review that Not that I have time to do it myself. Do you have any suggestions load pin? What's that? I think the load pin LSM would be really straightforward because yeah, I'm a little bit of checking simpler I mean, I'm just one page of code Yama's awkward because it walks the process tree and trying to do that. I don't think we've got good API's for that right now Oh load pen is Really simple That's it Well, thank you So just a follow-on question. Would it make sense to have an LSM rust API that like a native Rust API in the kernel so new LSMs could be written in rust Do you mean when you say an LSM API you're talking about the hooks layer? Yep Is that how it would work? I don't know how it would be a requirement. Yes, it would be a what a requirement We need well if you want to write a new LSM well you need to have an LSM API in rust yeah, and I think that would probably be We're intentionally trying to keep that layer as thin as possible. So the logic in the LSM layer itself is Pretty slight. I think even with stacking it still remains relatively slight. Yeah Pushing things into the individual LSM code rather than having it in the layer. There are a couple of places where that's rather inconvenient and dubious, but You you do want to have some sort of philosophy about your if you're going to have an infrastructure you want to have a philosophy behind it and I think the other thing with making a rust version of it is that we would very much have to Take a significant look at what we've got and see whether what we've got is actually The right thing to do to pull that you know to enable that whether That infrastructure is really Appropriate for that for that kind of user if we're going to do something like that. Do we want to have something else? The only thing I can add to that Wearing my LSM maintainer hat is I think I'd want to see the Rust capabilities in the kernel develop a little bit more get gained a little more maturity before we started to go down that path Yeah, putting on my distro hat right now rust is a problem For building kernels. So we have to build kernels back on older releases And we have run into already on into problems with kernels with the rust landed and it's broken kernel builds And so we very much would like to see a little bit more maturity on the rest side before we roll it out more Sorry, it's still on the rest side of things My understanding of rust as well is that currently it doesn't actually build on all the architectures that the Linux kernel builds on Which could be a bit of a problem for anything that's considered to be kind of core to the kernel like an LSM So that's why it feels like rust is a great fit for leaf driver modules type thing But not only for something as core as like rewriting one of the main LSMs, for example And so one thing to keep in mind if for any piece of software if you want to rewrite it well developers and Mainers need to understand that so and to Yeah, have this skill So that takes time to One of my personal favorite ways of breaking catch 22s of it's not mature enough yet is to make things require it and suddenly maturity evolves rapidly and Oh, no, I can't build the kernel on this architecture Suddenly we gain architectural support that we needed so I'm not sure it's a reason to avoid those kinds of things I think it creates work, but it's work that is already needed. So I think it's it's it's a way to prove where there are actual needs as opposed to theoretical deficiencies, so I I Think it would be an interesting area to explore because I think the interface is relatively simple as far as the hooking goes compared to you know DMA and graphics engine Submission and all of the crazy things that we do have interfaces for Now so I think it would be an interesting area to explore. So I'm very sympathetic to the let's just do it and see who complaints are a thing I mean, I think probably I've definitely done that in the past on a few things I'll throw it in the next branch and see well force for somebody's hand, but I think there is the other issue that we It's popped up in a few of the questions We're there's a lot of work to be done and we just don't have nearly enough people to help contribute on this You know, well, that's another interesting part about it is suddenly if you have a rustic API other people materialize To do the work or maybe less because sometimes less but yeah doesn't appear to be happening So I'm excited by that piece as well as someone goes. Oh wait. You mean I don't have to write in C Well, yes, I'm yeah, let's do some kernel work I've been burned enough times on the if you build it. They will come sort of argument that that does I Understand that's an argument. I know a lot of people believe strongly in that and rust is extremely popular these days, but I Personally, I'm gonna need a different argument for that, but it will require mentorship That's gonna be true for anything. Yeah, if it's not a rust question. You can actually ask two questions It's not a rest question. Hey, you get to that. Unfortunately. I only have one question. Oh So I'm going back to a slightly earlier topic. I'm one of those BPF developers that makes incorrect assumptions and terrifies you guys Casey you touched on this briefly earlier, but I was curious what all of you guys's thoughts are on BPF LSM the BPF LSM. Yeah I'll use his answer, which is it's terrifying it It's insufficiently well-defined as to what's going to what's going to happen if you have this LSM in place With respect to the other LSM's There was a bug a while back with one in one of the hooks where Nobody got called ahead of BPF and it said yep, I'm returned the wrong value There the other than what was expected This is probably a pretty reasonable assumption for this the BPF developers to make based on the general behavior of the LSM infrastructure, but this was one that did things a little bit differently and so when When you don't have the level of review that we provide for LSM someone somebody Proposes a new LSM in general that gets pretty thoroughly kicked around We all look at it These couple of the other people always look at it because well, we're kind of curious about what it is that they're trying to do that we didn't think of and That's not true with an eBPF program no best we can tell nobody's gonna look at it and Best we can tell the BPF infrastructure that's implemented as an LSM Isn't going to protect it that well either So it doesn't Fit fit very well into the paradigm we've got Well understand why you want it and what the advantages of it are but It would be real nice if it were more like other LSM's in the way it's implemented the way it's actually Fit into the system Yeah Yeah The other one of the other issues I have with eBPF LSM is it is allowing for Security modules that are not Basically going to be reviewed by the community. They're they're coming private companies They're they're making these modules and it's not being open sourced essentially and it's going into the kernel and doing its thing And we don't get to see what's going on. I know of a couple of cases cases of this already And that you know from a open source perspective that really bothers me Yeah, it's very flexible. You can do a lot of stuff, but yes, it's done tight So yeah, if you don't trust the people that write the code to policy Well, there's an issue so So when we talk about signing things signing the eBPF modules and things like that first of all On the maintainer basically told me I'ma is not the solution and He kind of kicked us out The other issue not that we're listening and I believe that Roberto tried to address it and his patches are still waiting there But I think that maybe We had a side discussion earlier and the talk that addressed The last talk was about requiring more information in this In the keys how can keys be used what they should be used for and I think that That going forward maybe we need more granularity and to say how eBPF Can't if they're a sign assuming we get the signatures in Then how can these be signed and which keys can be used so that we don't have this? You know enormous granular, you know, no granularity. It's either all or nothing And I think that that might be a way of constraining it and I think with that we're at time, aren't we? Okay Does it well does anybody have any questions? I mean you still have an extra question if you want it All right, James, this will be our last one. So there was discussion of names security namespaces So people are saying yeah, there are problems with that, but maybe for you know, it's what are the actual challenges and Would it help to have like a container ID in the kernel or something like that? Oh good I was afraid you're gonna ask a really complicated question To tackle this one first. Yeah No, I'm waiting for your answer Container ID is really nice. Yeah, I'm the moderator. I asked the questions. I don't have to answer them. So Yes, I a lot of people have been asking for that over the years and Container IDs would probably help We need some way to to figure out What's being associated together as a container to even try to make a unifying namespace type thing for the LSM because everybody's doing everything different and that's okay, but then You know, I'm doing something different and the namespaces are different and then SE Linux is doing something different And when you try to get these all together you have no idea what's going on And if we had some way of grouping it it would help us a little bit. I don't I don't think it's a huge win From an LSM namespacing point of view, but I do think it would help To be able to have something that groups all those different resources together. So you see what's you know there Yeah, it's just a difficult problem And no and having them I refer to it as having them coming is going and not being able to Group them and know what you're how it's grouped is a major problem The other thing is locking is becomes an issue and And that's one of the main problems that that we're having with the I'm a namespacing is that anybody who's going to start using State information per I know state information is going to have the same problem because Either the namespace is going away or the file is going away and how you have Can free them safely is a major thought so any help with the locking that's going to be involved I think yeah, there's two I think there's two issue with that this like a formal identification of a container and This well basically everything which is related to the fact is them because you need to use extended attributes also that and then Well, you need to have a way to make them permanent For the ephemeral part Maybe see groups might be useful, but that is not enough The other issue is the relationship between the security attributes and the various namespaces For example, we have our network in namespace. Do we have separate net label implementations and configurations for each? No, we don't With user namespaces, did you want to have different security policies in the different namespaces well some people say yes You do other people say No, you don't So If you want to do a system a contain you want to do a container. It's using username spaces using network namespaces We're Significantly complicating the whole motion a container is supposed to be simple right that's That's why people buy them They're simple. They're easy to use and We're coming in and saying well if we're gonna do anything with these and if we're gonna have security namespace separate from that We have to have to figure out how to how to integrate them if we're going to make a part of those other namespaces We have integrated in there in any way you slice it. It's gonna get more complicated Yeah, I think I mean as you've heard it's We're all aware of it and I think the only thing that I think is really clear is that we need I think we're all in agreement that we would like some concepts of some sort of kernel container ID But even you know what that means and the semantics behind that are One of those things has been debated quite a bit and you know I think that's gonna be largely a user space problem, but just being able to track that inside the kernel Would I think be helpful and then there's the other issue of namespacing which we've talked about in a few of the questions So you're gonna challenge the one last question thing, aren't you? I wasn't going to ask a question. I was going to provide a running commentary. Oh, wow, please I'm just I'm just joking. This is a very hard problem. I think and You know, we have tried various approaches over the years with David's being the most aggressive one as usual Defining basically really making containers an in kernel object Which was rejected for for various reasons The problem really is that I see is If you look at services for example a service isolation the the the Doesn't really make sense to define it as a container, but it uses every every thinkable combination of isolation Is used out there and that's what really makes it Difficult, so either we have to opt for I think we either we have to opt for something like we really make a rigid definition Of what a container is and we don't care about the rest But then you leave all of the Kubernetes folks and service isolation and so on people behind It means you can't treat them as a container anymore. That's just some weird type of sandboxing. So sorry ignore that and German word, right? Yes. Yeah, or Or you make it an arbitrary label almost like p-tax where you say this Slap some identifier on there and that's what we we keep tracking as a container And it can be some sort of arbitrary combination between namespaces and c-groups and whatever and that's a hard boundary to draw and it's like Yeah Yeah, and as an alternative would be to use what can what some of them can already already provide Let's say a domain for cd nukes or well a lot of stuff or even a dynamic domain So, yeah, there's a lot of different options But maybe the question is what do we really want this feature for? Is it just to identify a set of processes or is it to enforce some stuff on that? Yeah, and There's likely going to be different answers paralysis. Yeah, so just to add another variable in there Can I just say one use case? Yeah, so one use case would be people running containerized Operating systems. So they have different disperse running in containers I think that's a reasonably common thing for people when they're building things to just be able to do their labeling That kind of thing and different different different versions All right. Well, I think out of respect for the schedule, which we've already shot and had 10 minutes ago This is Friday night, and I'm sure people have planes to catch and buses and trains So I think we'll go ahead and wrap up But I think a few of us are going to be here for a little bit longer So feel free to to catch us in the hallway or in the back of the room So just want to thank all of you for the questions Thank the Linux Foundation all of our sponsors for helping out to run this and you know Putting the bill for a large part of this we couldn't do that without them So thank you and thank you to all of you and thank you to our panelists here and I think that's it I think we're done, right?


How can we define the multiplication of the integers? Again, it's helpful to think about A, B as the integer A minus B, and we note that if we multiply our two ordered pairs, well, if we multiply A minus B times C minus D, we get. And if we want to read this back as an ordered pair, we need to express it as something minus something, which gives us our component. And this suggests a way we can define the multiplication of two equivalence classes when the equivalence classes represent integers. And of course, this is well-defined, and the product of two integers is an integer. Well, maybe you should prove these things. Now remember, our class representative has components that are natural numbers, and this means we can determine whether A is less than B, A is equal to B, or A is greater than B. Definitions are the whole of mathematics, but we know what less than, equal or greater than means, so let's just go straight to and define positive and negative. Now since we're thinking of this equivalence class as the integer A minus B, this suggests the following. The equivalence class AB is going to be called positive if A is greater than B, negative if A is less than B, and if A and B happen to be the same thing, this equivalence class is just the additive identity zero. Remember we showed that a little earlier. And now that we have positive and negative, let's prove one of the great mysteries of mathematics that the product of two negatives is positive. So let's take two negative integers, the equivalence class AB, and the equivalence class CD. Definitions are the whole of mathematics, since we want to talk about the product, let's go ahead and pull in that definition of product. And so the product of the two integers is. Now this will be kind of a complicated proof, so let's go ahead and put in where we want to be. We want to conclude that our product is positive. Definitions are the whole of mathematics, all else is commentary. We have a definition for positive and negative. Since we want our product to be positive, that means our first term has to be greater than the second term, which allows us to construct one step back on our bridge. On the other hand, the integers we're starting with are negative, which means the first term is actually less than the second term. And so we know that. Now since inequalities are directional, it's helpful if they all point in the same direction. So here we have less than, less than, but at the end we have greater than. So let's switch this last inequality around. And remember that a, b, c, and d are natural numbers and so we can assume that we've proven all of their properties because you have done all your homework right. So I want an ad on the left. Well if I multiply this first inequality by d on both sides, I do get ad less than bd. I also want a bc. So if I multiply this inequality by b, I get my bc. Oh and now I can add these two inequalities together and I'm stuck. Now we can try and fix this proof, but let's think about this for a moment. One objection we might have is that this expression we're working with is kind of complicated and so we might ask whether we can simplify this. Well remember, definitions are the whole of mathematics, all else is commentary, and our definition relies on this notion of greater than or less than for the natural numbers. And we didn't define it because everybody knows what it is, but maybe we should define it. Here's one possibility. Let a and b be natural numbers, a is less than b if there is some other natural number not equal to zero where a plus k is equal to b. So since we want a to be less than b and c to be less than d, then we know that a plus k is equal to b and c plus m is equal to d. And since a, k, b, c, m and d are all natural numbers and all of the properties we've proven for the natural numbers still hold. So I can rewrite one side using the additive identity zero. Definitions are the whole of mathematics, all else is commentary. Remember that our definition for our equivalence relation is, and so I can rewrite both of these statements in terms of our equivalence relation. Well what good does that do? One of the things to remember is that since we are working with equivalence classes, we can use any other class representative. And so instead of the equivalence class with class representative a, b, we'll use another class representative, zero, k. And likewise for the equivalence class with class representative c, d, we'll use a different class representative, zero, m. And now we have much easier equivalence classes to work with, and we can find their product. And since k, m is greater than zero, this product will be positive.  First of all, the first time we tried it, we tried to use just the definitions that we had, and that didn't work so well because we ended up getting stuck at the midway. And part of the problem is that we didn't have a definition for what it meant for one natural number to be less than another. It was only after we introduced a definition that we were able to complete the proof. In fact, definitions are the whole of mathematics, all else is commentary. If we take out the lines of the proof that rely on the definitions, well, we'd have to remove this line because that came from the definition of when an integer was positive or negative, and then this statement came from our definition of what it means for one natural number to be greater or less than another. So this next statement is gone. Now we can keep the next statement because we actually prove that zero is the additive identity, but recovering the equivalence of the ordered pairs came from our definition of our equivalence relation, and so this line, too, would be gone. Our next line is actually a theorem, so we'll keep it, but after that we use our definition of multiplication, and then our definition of positive and negative again. And as you can see, if we take out everything that relies on the definition, we don't actually have anything left that makes any sense at all, including our conclusion. And so again, definitions are the whole of mathematics, all else is commentary.


Welcome everyone, I hope you had a great lunch and our goal is to defeat the lunch dip and talk about network policies the not so hard way With Sillian why it's different and how you can effectively secure your workloads in your clusters today with me is Tracy home So like to introduce Tracy. She's going to run the actual lab with you guys I'm going to first start with the presentation. My name is Raymond. The own I'm from my surveillance I'm a solutions architect and I hear today to talk about network policies So the agenda first we'll talk about silly mini BPF as an introduction Talk about security and observability. What features Sillian has for you to secure your workloads to observe your workloads then a little bit about strategies for designing and working with network policies after which we Sure have a short demo using how will you why as well? after which we will dive into the lab with Tracy and we want you to also do the lab alongside with us and For that purpose, I would like you to ask already to go to ISO failing dot-com forward slash labs and Then starts the getting started with Sillian OSS labs It takes a few minutes for the labs to be actually be created It's an actual lab running on kinds based clusters for that to be provisioned with a group It makes sense for people to already start it. Just wait to continue before Tracy will start the lab with you Okay, back to the presentation Cool Sillian any BPF introduction. So we're from ISO failing where the originators from Sillian We invented Sillian and donated it to the community and Sillian is widely used Amongst multiple different environments for different use cases among security Sillian is based on eBPF and eBPF is a technology What we like to say is that it's a technology similar to JavaScript to the browser Sillian or eBPF is to the kernel and it makes the kernel programmable in a very efficient way without actually changing the kernel and It's very powerful because it can run on kernel events. So anything a process opening a socket or Network device sending a packet. Those are kernel events where we can attach eBPF programs on And that's very powerful because we can do things with that. We can expose metrics We can see identities. We can observe flows as we will show today Sillian is built on eBPF and you don't have to be an eBPF engineer to use Sillian because Sillian abstracts complex technology for you It will automatically program the required eBPF programs Depending on what you configure and it provides a software defined networking solution for the cloud native age including external workloads and obviously in Kubernetes environment it takes care of Identities instead of IPs Sillian has a lot of Functionalities and features of which of networking Observabilities with Hubble which we'll show and demonstrate today as well We've introduced a service mesh solution, which is a sidecar less Implementation powered with eBPF to accelerate the service mesh capabilities to do layer seven path-based routing Providing ingress out of out of the box without using a sidecar which three to four times improves latency and performance and obviously removes Resources you may need for running sidecars in your clusters So let's talk about security with Sillian. Sillian provides an identity based Solution in Kubernetes clusters IPs come and go. They are ephemeral such as with the workloads What Sillian does is for each unique set of labels attached to your workloads think about tier front-end application and genics that you unique set of labels will result in an identity and Sillian uses this identity to attach this identity using eBPF to the actual IP packet and We're able to also observe and identify indent that identity for example on the destination so a front-end reaching out to a back-end means that the front-end gets that identity attached and The back-end will be able to inspect that identity when to get traffic goes Inbound and depending on the network policies you configure it allows or denies that traffic Furthermore Sillian provides API aware authorization Now what that means is that not only layer three on my piece or late and or layer four on ports We also provide layer seven rules and capabilities to be able to filter HTTP request on specific calls methods on specific paths and This is an example of a Sillian network policy where we have a HTTP aware rule for a namespace demo where we apply this rule to an applications called server match labels Equal server and then have a rule ingress from endpoints clients to port 80 and then notice the rules HTTP method get on the path forward slash so this is a rule example where we only allow this specific Method on this specific path and nothing else in the lab. You will see there are some some examples of this as well Another example is a constant Cassandra Sillian network policy So besides HTTP we also support Cassandra to only allow a specific Career reaction on a specific table. We can also filter on Kafka topics or GAPC calls amongst others Furthermore, what's very powerful is the Sillian network policies which are DNS aware, which means that for example, you're running Storage workloads on S3 buckets as you may know IPs of those buckets change all the time So securing those resources is hard to track Using fully qualified domain names. However, you can filter traffic to specific buckets And that means that using DNS aware Sillian network policies. You can secure access to a given fully qualified domain name how it works is that one front end does a query for for specific domain we're able to intercept that and Based on that using eBPF allow or deny that specific traffic Besides lay free layer layer free matching capabilities We're also able to match on things like cloud providers labels such as instance labels subnet subnet names subnet tax Or other security group names as well And we also have logical identities things like worlds or local hosts or remote hosts Ingress and such which are also useful in some specific use cases working with Sillian network policies Sillian network policies are very powerful, but without the right observability tools. You're still lost Applying a specific configuration of security on your workloads Sillian Sorry How will you how well is our? observability solution on top of Sillian and we provide a UI which shows a surface dependency map Allows you to see the flows between surfaces On protocol level depending on the policies you set you can even see flows for layer 7 rules as well for more advanced Use cases troubleshooting or inspection We also support a CLI which allows you to also do extensive filtering and also be able to allow output to Jason And the Hubble metrics components everything related to getting metrics out of Sillian and Hubble and export them through Prometheus to Gravana for example or in advanced use cases also to see platforms to get alerts For example in Splunk on security incidents This is how the CLI looks like I'm not going to talk a lot about this because you will also discover this in the Lab, but what you will see and what's important to notice is that we able to identify The HTTP calls the fully qualified domain names being accessed and also the identities being attached to those workloads This is a quick example of a service map where we can see the dependencies of services that the Communication between services and also note that in some examples for example the core API We can see these specific URLs and specific methods being used to reach that service And this provides you the tools to get started with your securing your workloads without breaking your applications This is an example of Hubble metrics if we have time today I have also an example of policy verdict metrics. So using Gravana We're also able to track policy verdicts things like allowed or denied which should match your policies where you can see how many Policies are actually matching and also what kind of domains are being reached out so Working with psyllium network policy or network policies in general can be a very big challenge You don't want to be in the way of your developers, but on the other side you have requirements that you need to secure your applications If you deploy a deny all policy it's most likely to become very difficult and hard to for each independent service and application to Introduce the psyllium network policy and to troubleshoot that You also need to keep them up to date You need to know when an application changes What is actually changed and and what you need to do to change your psyllium network policy and How do you prove that and what are the risks? so our goal of today is also to talk a bit more about some mechanisms to Understand our approach this challenge and to be effectively secure workloads, and I want to talk about four risks and Risks exposure obviously from the internet where you're exposing services. That's a huge risk From internal networks if you just expose from any destination that can be a risk people accessing data Which they are not allowed to if we look at the intra cluster or between cluster we have lateral movement risk or egress risk for workloads reaching resources in external network for example a physical database Obviously things like reaching back to internet as well. You want to avoid people being able to open a reverse shell for example So the goals to reduce you unused access Which creates exposure without being required for the application to work So we also want to reduce the blast radius, right? so if a pot gets compromised it can expose or Move on to pots in its same namespace, but even but beyond namespaces or beyond clusters So we also want to limit the blast radius So there are different ways you can do it for example the denial is is very effective But will be very hard to work with so what we try to work with our customers is to get a starting policy Which is good enough? reducing risks only exposing to get started for example pots between and for Within a given namespace for posts being able to reach out to each other's to allow Service-to-service communication within a given namespace, but denying resin egress from a namespace Accept things for example Prometheus which needs to monitor workloads and obviously cube DNS being used to resolve DNS requests and then you can basically start with a course grained per namespace policy where using Hubble you can start with opening ports to Observe traffic and then moves move on to slowly introducing more specific firewall rules for for your workloads and the goal is then to move to a fine grade namespace policy Where you don't only allow on a specific IP IP and port But even better on a specific fuller qualified domain name and only allow an or expose a service through a low balance on a given port as such And I will show and demonstrate this a bit in a demo as well Obviously slave sodium can be very powerful in github's kind of operation DevOps security DevOps operations using github and GitLab integration using Argo or flux to basically automate PR from Celium network policies which have for example any as a destination or zero zero zero four slash zero and automatically Denied a PR for you to be changed to a more specific DNS DNS So with that I'm going to move to a short demo as an introduction to the actual lab So the overview is that we have deployed a namespace with a starting network policy which allows traffic from that namespace and I'm slowly going to use hobble or I'm going to use hobble to slowly introduce more specific Celium network policies to secure that namespace and eventually Remove the allow all rule to have that specific policy All right. Let's hope the demo gods are with us. I hope everyone can see this in the back Please let me know if it's big enough Little bit more. Okay, cool. Give me a second So I've set up a demo cluster on GKE Installing Celium 1.12 Also with hobble So I will demonstrate the application So this is a simple example. We see we've deployed this namespace called my app. We have a simple client server Application running and we can see traffic from the client to the server on port 80 most likely HTTP but we don't see it yet and TCP traffic And we see that the client is also reaching out to some kind of destinations outside the cluster Perhaps even on the internet. So we want to know more Looking on the flows the live flows. We can see it's actually public IPs. So We need to investigate that a bit So to do that we need to have some specific policies in place Is this big enough as well for the audience? Good Sorry So For starters, we want to see the external access so what I want to do introduce is that I'm going to introduce a Celium network policy which is going to inspect That's the NS traffic from that client. So what I do I select all endpoints Using this and then specify egress to allow access to cube system to port 53 but I also specifically have a Rules section where it specifically matches for DNS and using this wildcard. I'm able to allow DNS requests But I will also see The FQDNs being reached out to so I can take further action based on that. So let's apply this policy So it's the DNS demo I've applied it good Quick check of if I'm still in the same namespace I'm not actually Good to check that Let me first Change namespace. All right All right, so I'm play I'm applying this policy Now we already can see that Celium detects or hobble detects automatically that we're now reaching out to isovalent.com and Celium.io. So we have better information what this client is trying to reach out to So with this information we can make a more specific Informed decision on how to secure the specific workloads on the client side We do see that the client is not only reaching out to isovalent and celium But also to the server on port 80. So with this information, I'm now going to apply this Celium network policy Which is applied to the client? Note this ingress part using this I'll deny everything ingress for this specific end point and then egress I allow the server To sorry allow egress connectivity to the server on port 80 And I also need obviously to allow QP API access and Now I can actually add The two for loophole of my domain names piece where I only allow these two domains on port 4 for three like this So this won't change anything in Hubble, but I've applied this policy and next is the server part I want to secure ingress to the server and considering time I will start with Applying a policy on the server also explicitly deny egress connectivity But allow ingress from the client to port 80 So again, this won't change anything here And now I've applied a client rule a server rule a DNS rule Which should mean that I also have Secured all workloads So what I can now do is remove the two broadly specified allow all rule which I applied for the application to function And if I did things correctly, I should not see any drops And this means that now The client application is working the serve application is working and it is allowed to access external resources But let's say we have another application being introduced So let me quickly go through this and then So let's say there's another namespace another client application wanting to reach out to the server application and It's being introduced but We can now see this another app tries to Reach to the server, but it's not able to reach it We see drops and we can click on Hubble UI to zoom in on this another app workloads And you see drops and forward you may wonder why is that? Well, it's because the another app Doesn't have any policies applied to it yet. So egress from that app is Allowed, but ingress on the surface obviously denied because we didn't allow that specific destination So let's suppose this is required. So we need to allow this That means that we need to go back to The policies directory I've stored them So let's allow We know this endpoint will we allow this another app to reach from the namespace another app To port 80 and we also know we've been informed that they are running HTTP For access so we also allow that only HTTP on layer 7 is allowed So we're updating the server policy and now we can check in Hubble What this means I think the drops are already gone. Yep, everything is being allowed and We also see we now also have the layer 7 visibility because we can see that we This client another app client is reaching on does a get call on the default path Okay, so that concludes the demo a way for securing your workloads and From here, I will hand over to Tracy to go through the lab with you. So you get more hands-on experience yourself With a star wars based example secure and get workload Tracy here you go. Thank you So if you haven't done that already go to ISO valent.com forward slash labs to start the getting started on OSS lab We also have doffy if you have an issue Doffy's happy to help as well If you run into an issue in the lab, let us know And we can support you. I'll come to you to help you as well for those of you They can't see doffy space. He was just as surprised as I wasn't here that way Um So, let's say question Hold on just a second Yo Has anyone here not ever touched psyllium like raise your hand. Oh This is gonna be good. Okay. Has anyone in here never used instruct before Okay, so first things first Ray told you all about the URL when we first started if you hit launch When he first started talking go back out and go back in what instruct will do is it when you get to a certain time? limit it will kick you out and I don't want that to happen to you all while you're in the middle of the lab the URL again is ISOvalent.com forward slash labs and The very first one on the left side of the grid is getting started with psyllium OSS cool This is not a terribly long lab So if you if you do have questions while I'm going through Ray is still miked up He can help Duffy here with the Amazing black hat that he is known for will also help. You want to see it. See it. Okay, I got you Thank you Let's see what I can do. I never use this app, but it might come in handy this time. That's not helping No, that's because I'm not in the font Y'all saw nothing That's the URL How many advocates does it take to change the font size on something? Can everyone see it now? Yes, no Yes, okay, this is getting started with psyllium lab as you all will know I will read the majority of this just in case. I don't know if English is everyone's first language So therefore you those of you that are watching hopefully you can understand me the other thing is I am a fan of typing things out So if you've never used instruct before when we get to the first page I'm going to show you something to make sure you don't miss any of the commands. That's that are on the right side of the page so ensuring security on Kubernetes How do you enforce policies troubleshoot the network and stay secure with minimal effort a New approaches needed you get to talk about psyllium today. I'm not going to go through this However, Ray just told you all about this that would be redundant. You are free to review that While my environment is creating because that's going to take about a minute or two Yeah, Ray you you covered all of this. Thank you And you all have already met Hubble so hopefully you're getting into the labs while this is happening Oh, yeah, so you will also have quizzes I'm going to need you all to yell out an answer or a letter or something to make sure that I'm getting green before We go through so just know that I will stop and ask And yeah, now we just have to wait. So sorry about that I would sing background music, but I'm horrible. I thought Ray. I think you jinxed my environment set up No, it's it's creating. It's just taking a minute. That's very helpful. Thank you So maybe it's just me There we go. All right, so start. Phew. Sorry about that. Thank you all for being patient I didn't have any jokes ready. I apologize So for those of you that never use instruct if you look on the right side where you see the kind cluster You'll notice there are drop-down arrows for everything if you want to work ahead Absolutely fine. However, make sure that you scroll down because some of the text will hide Things that you need to expand before you can move on got it Yes Yes, okay. Good. No, it's all right. So We're running a kind Kubernetes cluster and on top of that. We're running psyllium. So while the client kind cluster is finishing It's start Let's look at the config I'm not typing that up And that is too small for those of you that are trying to see that Let's do this Is that better or worse? Better. Okay. All right. So in the node section, you can see that the cluster consists of three nodes one control plane node and that's running the the case control plane and Two worker nodes that will use to deploy the applications and the networking section in the config file The default CNI has been disabled So the cluster won't have any pod network when it starts instead psyllium is being deployed to the cluster to provide This functionality. So psyllium will be your CNI. So let's see if the kind cluster is ready Hopefully doesn't take as long as the lab did to start up and we'll make sure that the cluster is running properly We're gonna list those nodes Control V does work in this for pasting. You can also just copy the command whenever you see the code the Copy button should pop up so you can copy it that way if you'd like All right, so you see all three of the nodes appear. So you see those on the screen all are marked not ready That's normal the CNI is disabled and after this page. We're gonna install psyllium so if you don't see all the nodes they might still be joining the cluster and Hey, since we have a cluster, let's go install psyllium All right So what we'll be using if you've ever if you've never worked through one of our Getting started guides in the docks. There are a couple of ways to get to this point There's actually a brew command install psyllium or at least get the agent there Or also like a curl command. So that's what's already been done in the background after that step is where we're at. So psyllium CLI tool is provided to install and check the status of psyllium in the cluster so we can know what's going on but it'll also It helps us install and update psyllium, but you can also like enable hubble and cluster mesh from the CLI So let's go do some of that and you are literally typing psyllium install That's gonna take about 3045 seconds to get done And it will let you know that it's installed and ready after that We can check the status to make sure that everything is is nice and healthy and and happy Everybody with me so far Yeah, okay cool Also, if there are any terms you don't understand again I have very very nice people in here Including some that probably have on shirts that are hiding and don't want to be called on in case you need help for definitions or anything like that Honestly think psyllium is mad at me, right? The labs don't like me anymore There we go. I have to fuss. Okay. It'll even tell you what to type to to view the installation help So I'll just follow the instructions from the command line So let's do psyllium status and see what's going on all right so the very first two things you see are that psyllium isn't okay and Operators doing okay. We haven't enabled hubble and we haven't enabled cluster mesh. So those are going to show as disabled So now that we're functional Let's go deploy the demo app. I love instruct that tells me well done Thank you instruct. Ah quiz number one the psyllium CLI Allows us to and we can have multiple answers if needed. So which one should I click first? Top one. All right Anything else check the psyllium status that that was somebody said middle one. Okay Anything else? No All right, let's see what happens Goal star. Thank you so much. If you don't already know we're fans of Star Wars here. It's fairly So everything going forward if you're a tricky I apologize in advance So to learn how to use it in force policies with psyllium. We have prepared a demo example We're gonna have three microservice applications. That's gonna be the death star a tie fighter in the X-Wing Death Star service is it runs the HTTP web service on port 80 That's exposed as a Kate service to load balance request the death star across two pod replicas The death star service provides landing services to the Empire spaceships so that they can request a landing port The tie fighter pod represents a landing request client service on a typical Empire ship X-Wing represents a similar service on an alliance ship And with this setup we can test different security policies for access control to death star landing services It's just like your house. You don't want people going in and out of your house. They don't that shouldn't have a key, right? It's basically what we're doing just the Star Wars version. All right, so Let's check to make sure that all the components have been properly deployed. Let me move this over So you all can see some of us. There we go It may take a few seconds to display the results. You all are very patient and have been so I don't think that's gonna be an issue All right, so let's successfully rolled out. Let's deploy the demo out So you'll know which is what is what? Because of the labels so the death star is going to be the Empire org and it's going to be a death star class The Imperial tie fighters also in the same org So it's an Empire organization and it's going to be a different class as tie fire And then the X-Wing is the Alliance organization And the class of course is X-Wing So the deployment will also have a death star service what we just talked about and that's going to load balance all the traffic to all of the pods with the label org equals Empire and Death Star class, so let's install everything. There's a manifest in the background YAML And we are going to install so All of our objects are and are created. Let's see that everything's actually deployed the way that it should be I Can't type See this is why I don't type stuff. I Bet if I copied it works Well, that was just rude. There we go. All right, so At this point is already saying running But each part of go through several states until it reaches running at the point that pod is ready. So let's try it again Well, if you need to try it again until you see that everything has a running status Each part will also be represented represented in Sillium as an endpoint. So we want to see a list of all the endpoints that are managed by Sillium the Sillium endpoint or CEP CEP Resource can also be used. I will tell you now. I tried to manually type in and it did not work earlier So you might want to copy and paste this one and I promise I actually typed it correctly and it did that earlier Yeah It does work the second time. Thank you because that happened to me earlier and I was like who hates me All right, let's try it again. I had the same to this morning. Yeah, okay. I think there's a small delay. Thank you for that I appreciate it All right, so as you can see we've got our demo app installed and so let's go check on to our first test Yeah, before you do that notice the identities as well, right? So you can see The DevStar have similar labels because it's two pods So they have the same identity being allocated to the DevStar So that's under the roof Sillium providing a unique identity for similar workloads. So with this command you can actually Point and troubleshoot that did you all hear him over on that side? Kind of okay. Cool. All right, so let's go launch our first test So let's talk about DevStar access from the perspective of the DevStar service only the ships with the label Org equals Empire or anything that's an Empire org are allowed to connect and request a landing We don't have any rules in for it. So like what will happen if not only the tie fighter, but also the X-Wing request Landing so let's find out so Instead of actually running the full connectivity tests. We're gonna be using Curl to execute some API calls So let's see if we can land our tie fighter on the DevStar by running the following command Shift landed All right So the command above get let's us get a shell on the tie fighter pod and run an HTTP post request to the DevStar service to request Landing the command should work because the tie fighter and DevStar are all on the same side of you know the war Also known as the bad guys, which I hate because I'm a Boba Fett person, but anyway Now test if we can land the X-Wing the good guys. What do you all think's gonna happen? It's gonna work. All right, so let's see And you are correct So that's good for the rebels because they can get where they technically shouldn't be But unfettered access to the DevStar Is not great for them So Apparently a security policy is missing So let's here's a brief blurb about identities and cloud native IP Addresses are no longer relevant for cloud native workloads because security policies need something else. They just do Silly provides this so I'm uses the labels of science of the pots to define the security policies We're gonna start with a basic policy Restricting the DevStar landing requests you only the shifts that have the label or give us empire This should block or this blocks any shifts without the label to even connect to the DevStar service It's a simple policy that I'm not even say simple policy It's a policy that filters only on network layer three So that's the IP protocol and network layer four, which is a TCP protocol So it's often referred to as an L3 oh for network security policy And so this is what it looks like It has a graphic So let's go do some more stuff All right So the first thing first we're gonna start with that policy to restrict that star landing requests to the ships that only have The label or equals empire before we start changing policies right away Let's think about what that looks like or should look like I should say I'm gonna expand this just a little bit. Come on mouse. You like me today, right? There we go. So we need to match on Empire ships only so that label is what we need to match on And that's what that would look like Match labels or Empire class that star We also have to make sure that ingress from the endpoints with the label Empire are also allowed to port 80 for protocol TCP We see that in the image So while this example is relatively simple Operators sometimes find it difficult to understand and to build network policies And silly me has a solution for this So if you look at the top where you see terminal right next to that you will see the network policy editor What I will say is if you aren't something that has a size a MacBook Air-sized screen you are going to need to collapse Right here, you're gonna use that to collapse so you can actually see the visualization or else it won't show up Don't ask me how I know Thought some of those wrong earlier So I'm going to go through this blurb first and then just show you what the Netpol editor looks like So you can all click on that while I'm reading through this So click on it to see a visual and interactive representation of your policy and change some of the values if you want to play around It's better understand what the policy is doing and I'm going to be completely honest with you Networking has never been my forte. I used to cry for Cisco stuff like it just hasn't break fixes my thing The one thing I did like when I started using Silium or starting learning Silium because honestly I'm still learning is this editor that you all are looking at because it was easier for me to follow along with What everything was going on? Some people are visual and I just happen to be one of those people So the central part of the diagram represents the network policy selector and then each side will show Respectively which ingress and egress are allowed for the workload. So you basically want to verify that your current selector Which are the org equals empire class equals that star only allowed ingress track from pods label as org equals empire And that's what that would look like You can also check the corresponding network policy manifest in the editor below and note You can either use the Silium network policy or you can use the kubernetes network policy The other thing is if you're ever at home and you want to use something like this without having to spend a lot of Things up we do have editor Silium.io and I'm going to click on that before I actually show you the one in instruct because it's very very Easy to use and I talk about it all the time. So you'll get this most times Whenever you get on here, but this is what this looks like I'm not sure you would want to do try to do it from a mobile device But outside of that it's very very helpful and whenever you have the policy you want You can actually download it or just copy and paste it into your Yamaha All right, so this is what it looks like on the tutorial side This is basically the same thing. I just showed you it just doesn't have anything preloaded and that's that All right, so Let's enforce the policy and we're going to do that actually using the terminal So you might want to go back to the terminal tab And we can apply the pre-configured network policy with the values that we just talked about for the demo system So let's copy and paste that it'll let you know that it was created and let's try to land the Empire TIE fighter again To the Death Star Which she'll still which should still work Ship is landed now if you try to request a landing with your X-Wing However, you should see that it's gonna hang like nothing at all should happen at this point And if we still got ships landing that means I probably copy and pasted something incorrectly And as you see nothing is happening happening So that means that our rule actually did what it was supposed to do to get out of that control C So we blocked the access to the Death Star from X-Wing So let's see if we can make it a bit more fine grain that those of you that work in government separation of duties That's basically what we're about to do Or any other place similar All right, so it was sufficient to give either the TIE fighter X-Wing full access to Death Stars API or no access at all But are you absolutely sure that you can trust all of the TIE fighter pilots of the entire Empire? You're not because you don't know all of them if you do we got bigger problems We must provide the strongest security so enforce lease privilege Between microservices in each service that calls the Death Stars API should be limited to making only the set of HTTP requests It requires for legitimate operation So we just need to fill through the actual HTTP request and that's what this will look like So let's go do that All right, so think about this the Death Star service exposes some maintenance API's which should not be called by random Empire ships to see why those API's are sensitive We're gonna run this cube cuddle. Yes cuddle Say it again. We're gonna run this cube cuddle.  All right, so This is an illustrative example and yet it's kind of dramatic But unauthorized access such as above can have adverse security repercussions things can blow up So we need to enforce the policies on the HTTP layer which is layer seven to limit what exact API's The typewriter is allowed to call and which ones they aren't So we're gonna extend the existing policy with an HTTP rule that looks like this and That should restrict the API access to only The landing path and thus prevent users from accessing the exhaust port which is why we had something blow up a little while ago So again We're gonna go back to the network policy tab and It should be pre-filled. I'm just gonna show the image because you all know how to get there at this point But you want to verify that the policy will filter access to the Death Star by its path All right, so now let's enforce it. So we're back in the terminal and We are going to apply the updated policy Hey, hey, I said apply. Oh Now you're just being being hold on please There we go What am I copied a paste a copy of blank space? That's what I did Apologies, let me get that There we go, there we go It will let you know that's configured and then we're going to run the same test that we ran at the beginning And now you see access is denied, which is what we want it So with l7 security policies We're able to restrict the access only to the required API resources on Death Star and that may we that way We've implemented a least privilege security approach for the communication between the microservices And I think we're about to have another quiz Are we? I think yes All right, you all got me a last time. Let's see what happens this time All right. What's the first one? I need to check network policies can block or allow traffic between pods. Yes or no? All right L304 network policies can filter HTTP request Okay, we got some yups in the yeses L7 network policies can filter on HTTP paths Yes, okay, and the last one is psyllium supports standard kubernetes network policies All right, I got let's see what we got They could have just given us an all of the above, but you know ah One of these is wrong The second one. All right, let's try taking out the second one you get a gold star Thank you so much. Let's move on to the next part. We're almost through Actually, I think we are through so we saved the death star and we made the Empire safe place and I think you know what? We all deserve a gold star for that And some good coffee So let's let me hit this because I want to show you something So if you want to know more about psyllium and I think Ray has one more slide that he wanted to show you all We're helpful, which I really think is a really good UI if you go to The psyllium Website it'll give you a breakdown of what psyllium is It's going to give you a link to our slack Our slack is huge But everyone in there is exceptionally helpful, especially to beginners. I still ask beginner questions all the time But the other thing is if you want to contribute if you want to see the documentation Or if you want to know how to install on cake like cake 3s for example, or like I use my desktop it also has Instructions to do that also So please go check it out. And if you have any questions, you are free to tweet me and I'm gonna let Ray come back up Thank you. Thank you and as a bonus anyone completing the challenge We are working on some badges the correctly digital badges. So as soon they become available You will award it that batch for this lab as well, but be patient with us. We need some work to do there to make it work So, yeah, thank you Tracy. Thank you for running the lab. I hope you all liked it Please provide feedback to us if you want to know more and there are I think already 10 labs we provide Both open source and enterprise labs on different topics also cluster mesh egress gateway things like BGP and advanced networking So let me plug in my No, it's fine So besides slack we have on this conference two booths, we have a psyllium booth. We have an isovalent booth Feel free to to visit us if you want to know more about ebpf we provide you keep the option or the Opportunity I would say to get the what is ebpf book signed by Liz and we also have Natalia who has the security Advanced ebpf book. So if you want to know really more about that technology, how it actually work I recommend to visit it as us at the booth and even get it signed by Liz For enterprise solutions go to isovalent.com to know more about that and that concludes this session Thank you, Tracy. Thank you Duffy for helping out. I hope you liked it. Enjoy kube.com and thanks for joining Good good points Answer questions. No, all right. Okay. Oh wait. You got one. Oh You want to see Hubble Hubble. Yeah, this is Hubble UI Didn't I just shared it or did you join a bit later? Is there something specific you want to see? Oh Wait, did you want to see the CLR? Did you want to see the UI? Yeah, okay. Yeah, yeah, so so to to give it a bit more so on the left here on the top You can select namespaces to monitor so I can also monitor kube system if I like But let's go back to the app example So basically the top section allows you to filter either by selecting components and services or Entering a filter you can filter on verdicts dropped forwarded and such The top section shows live flows and if you click on a specific Service it will focus the view for that given service and it will focus all the flows as well Ingress and egress from that given service Does that help? Good welcome another question. It's the actual traffic doesn't matter if it's allowed or denied We can already using ebpf observe flows between them between services so if I would have a Deny policy or not allowing specific traffic you would see drops Continuing in the flows Appearing and if it's allowed it will just forward and show it as well. You have to have traffic. Yeah, that's that's the case We yeah, you have to have traffic to have Hubble observe that traffic Welcome Any other question? Yes, please. I'm no not on on on that layer for the WT So with sidecar you mean you service measure mean yeah, so so authorization Authentication is coming in Cillium 1.13. So that's a roadmap implementation Any other question? Cool. Thank you for again for joining us. Enjoy your day


Hello, and how are you all? Question says integrate the following. Now the function which is given to us is 1 divided by sin x cos cube x. Now let us integrate this function with respect to dx. Now, we know that 1 can be written as sin square x plus cos square x, right? So in substituting it we have sin square x plus cos square x divided by sin x cos cube x into dx. Now here we can write it also as sin square x divided by sin x cos cube x plus into dx cos square x divided by sin x cos cube x into dx. In simplifying we have the answer as sin x divided by cos cube x dx plus 1 over sin x cos x dx. Now here we can write this function as tan x into we are left with 1 upon cos square x which can be written as sin square x into dx plus here we can write sin square x divided by tan x. Now let t be equal to tan x. So dt will be equal to sin square x into dx, right? So on substituting we have t into dt plus dt over that is equal to here integral of t into dt is t square divided by 2 plus integral of dt by t is log mod of t plus c. Now on substituting the value of t as tan x we have tan square x divided by 2 plus log of mod tan x plus c which can be written also as on rearranging log of mod of tan x plus 1 by 2 tan square x plus so these are the required answer to the question. Hope you understood it well and enjoy it too. Have a nice day.


Hello. Today we're going to talk about how you save your file that you made in PowerPoint. So you're going to come up to the File tab on the ribbon. You left-click. Then you left-click on Save As. You have a pop-up window. Make sure you take a moment and check to see where you're saving it. If it's on your desktop, you still need to look to see where it's going to go. If you're saving it on a flash drive, you need to click here. The name of my flash drive is my passport. So you would click there. Come down to the File Name box. Type a special name in it, as you see I've given it. And then all you need to do is click Save. Now, I already have this file on my hard drive or on my flash drive, and so watch what happens. It says it already exists. Do you want to replace it? You would say no if you've made changes, but you want to keep the first file. But if you've made changes and you only want to keep one file, then you just say yes. It will delete your first file. Okay. And then all you need to do is close out by clicking the X in the top right corner. But let's take a review first. Okay, what do I need to do to save this file? Yes, you click on the File tab on the ribbon. Now I get this other pop-up box that comes to my screen. What do I do next? Correct. I click Save As. Then you're going to get one more box. So what's next? So you give it a file name. You check to make sure you know where it's going to be saved at on your laptop or on your flash drive. And then you click Save. Nice job.