In this lesson, you will learn how to reinforce network namespace boundaries by applying Mandatory Access Control (MAC) policies to ensure services cannot escape their assigned networking constraints.
The Concept of Layered Isolation
A network namespace provides an isolated view of the network stack, including routing tables, firewall rules, and interfaces. While namespaces are excellent for logical separation, they are not a security boundary on their own. An attacker with code execution inside a process might still attempt to interact with privileged system resources (like /proc/sys/net/ or raw sockets) that technically exist outside the intended namespace scope. By integrating AppArmor profiles with these namespaces, we add a second layer of defense that governs what the service is allowed to do, regardless of its network view.
Applying MAC to Namespace-Aware Services
When you run a process in a private network namespace, you are effectively reducing its "surface area." However, the process still relies on the kernel to interact with the network stack. An AppArmor profile can be used to explicitly restrict a service’s ability to manipulate the network stack further or access sensitive files that might be used to influence networking configurations.
Consider a service running in a namespace that should only bind to a specific internal port. Even if the namespace configuration is misapplied, the following policy provides a "safety net":
profile net-isolated-service /usr/bin/my-service flags=(attach_disconnected) {
# Deny raw socket access to prevent escaping namespace constraints
deny network raw,
# Allow only TCP connections on the intended port
network tcp,
# Prevent modification of network settings
deny /proc/sys/net/** w,
# Standard file protections
/usr/bin/my-service r,
/etc/my-service/config.conf r,
}
By adding deny network raw and restricting access to /proc/sys/net/, you ensure that even if the namespace isolation were compromised, the MAC layer prevents the process from reconfiguring the host's networking or sniffing traffic outside its virtual interface. This combination ensures that the logical separation provided by the network namespace is backed by the hard policy enforcement of AppArmor, creating a robust, multi-layered security posture for your microservices.
Key Takeaway: Network namespaces provide logical isolation, but applying MAC policies is essential to enforce strict resource constraints and prevent unauthorized interaction with the host’s network control plane.