- 1 Policy on the Endorsement and Operations of Virtual Machine Images
- 1.1 Introduction
- 1.2 Definitions
- 1.3 Use case classification
- 1.4 Policy Requirements on the VM Operator
- 1.5 Policy Requirements on the Endorser
Policy on the Endorsement and Operations of Virtual Machine Images
As a result of the January 2011 SPG meeting, there is an item to work on a generalisation of the HEPiX Virtual Machines Endorsement Policy document.
The original HEPiX policy is available at https://edms.cern.ch/document/1080777
This document describes the security-related policy requirements for the generation, distribution and operations of virtual machine (VM) images on a distributed infrastructure.
The aim is to enable VM images to be generated according to best practices and to be both trusted and operated elsewhere.
This policy does not compel resource centres to instantiate images endorsed in accordance with this policy nor limit the rights of a resource centre to decide to instantiate a VM image generated by any other non-compliant procedures, should they so desire. The resource centre is still bound by all applicable security policies and is required to consider the security implications of such an action on other participants.
The following terms are defined.
- Endorser: A role, held either by an individual or a team, who is responsible for confirming that a particular VM image has been produced according to the requirements of this policy and states that the image can be trusted. An Endorser should be one of a limited number of authorised and trusted individuals appointed either by a VO or a resource centre. The appointing VO or resource centre must assume responsibility for the actions of the Endorser and must ensure that he/she is aware of the requirements of this policy.
- VM operator: A role, held either by an individual or a team, who is responsible for the security of the VM during its operation phase, from the time it is instantiated, until it is terminated. Typically this addresses individuals with root access on the VM.
Use case classification
The current policy document addresses the following use cases.
Endorser: resource centre, VM operator: resource centre
This class addresses use cases where the VM is provided and operated by the resource centre.
Virtualisation is not directly accessible by users. It includes, for example, the use of virtual Grid worker nodes that act in a similar way to real worker nodes.
The resource centre is both the Endorser and the VM operator and is responsible to ensure the compliance of the VM with existing security policies.
Endorser: Third party, VM operator: resource centre
This class addresses use cases where the resource centre runs a VM as a resource centre originated VM, as described in "Endorser: resource centre, VM operator: resource centre", when this VM is obtained as an untrusted party VM, as described in "Endorser: Third party, VM operator: Third Party".
In this class, the resource centre is the VM operator, and the trust relationship is established between the resource centre and the Endorser.
Endorser: Third party, VM operator: Third Party
This class addresses use cases where the VM is provided and operated by a third party (e.g. end users).
In this class, the resource centre runs the VM but is not the VM operator, and the trust relationship is established between:
- the resource centre and the VM operator
- the VM operator and the Endorser (both roles can be combined)
The resource centre is responsible to ensure sufficient traceability in order to enable malicious network activity to be linked with any VM and its VM operator, as defined in the Grid Security Traceability and Logging policy.
The resource centre has no direct trust relationship with the Endorser and may decide to apply specific restrictions to control the access of the VM to other resources, including network services.
Policy Requirements on the VM Operator
By acting as an VM Operator you agree to the conditions laid down in this document and other referenced documents, which may be revised from time to time.
- You are responsible to fulfil all the operational security and incident response requirements expressed in other policies
- You are responsible to ensure that any VM being run has been endorsed and to ensure its compliance with existing security policies, including but not limited to security patching, vulnerability management, incident response, logging and traceability.
- You are responsible for handling all problems related to the execution of any licensed software in a VM image. You shall ensure that any software run in a VM, complies with applicable license conditions and you shall hold the resource centre running the image free and harmless from any liability with respect thereto.
- You are responsible for contextualising any endorsed image, including credentials and certificates.
Policy Requirements on the Endorser
By acting as an Endorser you agree to the conditions laid down in this document and other referenced documents, which may be revised from time to time.
- You are held responsible by the infrastructure and by the resource centres for checking and confirming that a VM image has been produced according to the requirements of this policy and that there is no known reason, security-related or otherwise, why it should not be trusted.
- You recognise that the VM must be generated according to current best practice, the details of which may be documented elsewhere by the infrastructure. These include but are not limited to:
- any image generation tool used must be fully patched and up to date;
- all operating system security patches must be applied to all images and be up to date;
- images are assumed to be world-readable and as such must not contain any confidential information;
- there should be no installed accounts, host/service private keys, ssh private keys or user credentials of any form in an image;
- images must be configured such that they do not prevent resource centres from meeting the finegrained monitoring and control requirements defined in the Grid Security Traceability and Logging policy to allow for security incident response;
- the image must not prevent resource centres from implementing local authorisation and/or policy decisions, e.g. blocking the running of Grid work for a particular user.
- You must disclose to the infrastructure or to any resource centre on request the procedures and practices you use for checking and endorsing images.
- You must provide and maintain an up to date digitally signed list of your currently endorsed images together with the metadata relating to each VM image, as defined in the VM Image Catalogue document.
- You must keep an auditable history of every image endorsed including the unique identifier, date/time of generation and full list of OS/packages/versions in both the VM Base Image and VO Environment. This must be made available to resource centres on demand.
- You must remove or revoke images from the list of endorsed images whenever a problem is found, e.g. a new security update is required. This removal must also be recorded locally in your auditable history.
- You are responsible for handling all problems related to the distribution of any licensed software in a VM image. You shall ensure that any software distributed in a VM image, complies with applicable license conditions and you shall hold the resource centre running the image free and harmless from any liability with respect thereto.
- You must assist the infrastructure in security incident response and must have a security vulnerability assessment process in place.
- You recognise that the infrastructure, the resource centres, and/or the VOs reserve the right to block any endorsed image or terminate any instance of a virtual machine and associated user workload for administrative, operational or security reasons.
- You recognise that if a resource centre runs an image which no longer appears on your list of endorsed images, that you are not responsible for any consequences of this beyond the time of your removal of the image from the list