Capcom has confirmed over on Twitter that the original chapter of the long-running Devil May Cry series will arrive on the Switch this Summer. This marks the first time Dante’s game will be made available on a Nintendo platform. But is Capcom playing it slightly too safe by just bringing the original outing instead of the whole PlayStation 2 trilogy to the system? Further details (like the price point), will no doubt be revealed in time.

Interestingly, this announcement follows on from comments made by the director (Hideaki Itsuno) and producer (Matt Walker) of the fifth game in the series, back in February, when they said they would “love” to play this franchise on Switch. In a separate interview, Itsuno even mentioned how the fifth entry would be considered for Nintendo’s hybrid device if Dragon’s Dogma: Dark Arisen sold well enough. For now, though, let’s just enjoy the fact the first entry in this divine series is coming to Switch.

Are you a fan of Dante’s hack, slash and shooting adventures? We’re looking forward to hearing your ‘Dante for Super Smash Bros. Ultimate confirmed!’ theories in the comment section below.

2006 was an interesting time for the Final Fantasy series, as Square returned to a single-player driven entry in the series after the MMO experiment of Final Fantasy XI. The development of Final Fantasy XII was rocky to say the least, as its protracted five-year development cycle cost Square close to thirty-five million dollars and its initial director, Yasumi Matsuno, suffered a mental collapse halfway through that saw him leaving the company for good. Fortunately, the final product turned out to be a reasonably consistent and high-quality JRPG; not the best in the series, but far from the back alley dumpster fire that it easily could’ve been. Now, Square has remastered the game as Final Fantasy XII: The Zodiac Age, which throws in improvements from the later-released international version along with a whole slew of modern nips and tucks, all of which come together to make for a wonderfully sharp experience that stands as the definitive way to play this classic.

The story of Final Fantasy XII: The Zodiac Age takes a less character-centric approach to its narrative, a move which certainly increases the scope of the plot, but at the cost of making it less relatable than some predecessors in the series. Echoing some of the earlier Fire Emblem games, this is more a story about the political intrigue surrounding an ongoing war between national superpowers. In the land of Ivalice (which acts as the setting of several other games from Square) the two nations of Archadia and Rozzaria are at war with each other, catching the much smaller kingdom of Dalmasca in the crossfire. After a lengthy and mildly confusing introduction segment, the plot picks up following Vaan, an orphaned petty thief with big dreams of one day becoming a sky pirate. Vaan leads a relatively simple life of being a sort of Robin Hood-like figure, but his misadventures quickly lead to him getting caught up in a resistance movement with Dalmasca’s princess, Ashe, who aims to reverse the annexation of Dalmasca into the Archadian empire.

It’s all rather high-concept – even for a Final Fantasy game – and this comes as something of a double-edged sword. While it’s impressive how much detail is put into the lore and history of the world of Ivalice, not nearly as much effort is put into making the cast particularly memorable or three dimensional. Much like how combat requires several different roles working in tandem, all the major players in the story are clearly there to fill a specific niche in moving the plot forward and they seldom break out of their cliché archetypes. For example, Balthier is the ‘cool’, roguish sky pirate out to fill his boots with treasure; he initially doesn’t want to get involved in the resistance movement because it’s not his cup of tea, but his kind heart eventually wins out and he shows there’s more to him then a trigger finger and one-liners. Everyone in the main party is like this to an extent. They’re likable and well-written, but predictable and rather boring as a result. Though the voice acting is spot-on, there’s a general sense of detachment one gets when playing through this story; it’s just hard to care about the plight of Dalmasca when the game doesn’t give you much reason to beyond the tired ‘empires are evil’ song and dance. There are much worse stories to be found in RPG’s, but relative to the rest of the Final Fantasy series, Final Fantasy XII: The Zodiac Age is left a bit wanting.

Fortunately, the gameplay picks up the slack, coming off as something akin to a single player MMO. Though it’s not exactly open-world, the on-rails nature of Final Fantasy X is long gone here, replaced by a gameplay structure that encourages you to take frequent breaks from the main narrative in favor of some good old-fashioned side quest grinding. These take the form of ‘Hunts’, which see you fulfilling contracts for NPCs in towns who need you to take down certain powerful creatures in the surrounding areas for some contrived reason. More often than not, the locations of these creatures are generalized and require a bit of poking around the map, which naturally results in you finding treasure and hidden secrets as you fight your way through the countless fodder enemies that populate the environments. On paper, it all sounds rather cookie cutter, but there’s something about the reward loop of grinding hunts, getting more gil and better equipment, and using that to then do harder hunts that proves to be insatiably addictive. In this way, Final Fantasy XII: The Zodiac Age proves that innovation isn’t necessarily the only requirement to stellar game design, sometimes all it takes is brilliant execution of well-worn ideas.

That being said, one place where Final Fantasy XII: The Zodiac Age definitely innovates is in its combat, specifically the Active Dimensional Battle system, which finally eschews the random encounters of the series in favor of a more active focus. Perhaps inspiring the Xenoblade Chronicles games that would come many years later, battles are simply started right there in the overworld as soon as you’re within the visual or attack range of an enemy. Once the battle starts, character actions are then governed by an ATB style system in which each character has an auto-filling bar that grants them an action every time it fills, but one way in which Final Fantasy XII: The Zodiac Age puts all other RPGs to shame is in the depth of micromanagement it offers players through the “Gambit” system.

The Gambit system is a marketing friendly term for programmable actions, all of which can be set up in the pause menu. Essentially, every character has a set of Gambits that function as ‘if/then’ commands, and how you order the Gambits dictates how the character behaves in battle. Every Gambit slot has a ‘target’ and an ‘action’, and a vast list of selectable factors for each, which ensures that you have near-limitless amount of ways in which you can set up each character. So, for example, you can set a Gambit that ensures your healer-focused character will cast “Blindna” every time a party member is stricken with the “Blind” status effect by an enemy. Or, you can set multiple Gambits on your black mage to ensure that they’ll use whatever magic the currently targeted enemy is weak to. Unlike most other RPGs, you no longer have to worry about lackluster AI limiting the effectiveness of your team, as you can control exactly where, when, and how each party member reacts to certain scenarios.

It takes a bit of getting used to, but the true strength of the Gambit system lies in using trial and error to figure out how to turn your team into a perfectly balanced, unstoppable killing force that requires only occasional input from you. Some may think it sounds a bit boring to have a combat system primarily centered around playing itself, but the nature of the Gambit system always leaves room for a little more improvement or player interaction. Each character only has so many Gambit slots to fill, and even when you’ve found a nice equilibrium for the team, there are still plenty of scenarios where it’s simply quicker to tell a character to do a specific action. What’s nice about this system is how much stress it takes off the player in the moment to moment decision making; you can watch the action unfold automatically and intervene as needed, filling the gaps in as a sort of meta party member.

Character growth is handled in a manner akin to the Sphere Grid system of Final Fantasy X, but it’s slightly more freeform in its approach. There are twelve jobs to pick from and each character can be equipped with a main class and a subclass, each of which has a unique, chess-like board that charts their mastery of that class. Every job board contains a collection of “Licenses” which dictate the level of gear or the skills that the character can use. So, for example, you may find a fancy new armlet in a treasure chest that requires a level 3 accessory license to equip; only characters that have unlocked the “Accessory 3” spot on their job board will be capable of putting it on. Every enemy you kill grants each character “License Points” which can then be spent to buy more spots on their job boards, but you can only buy spots that are directly adjacent to any of the ones you’ve already bought. What’s nice about this setup is how it allows you to control your character’s growth within their class towards the way that you play them; if you feel comfortable with their current equipment setup, for example, then you can forgo buying higher ranks of armor licenses in favor of more direct stat buffs or skill licenses. And, unlike the Sphere Grid, there are no predefined paths here that you choose to follow, it all radiates outward from the starting point and you’re given complete freedom over what corners of the board to work towards.

Also, new to this Switch version, you’re allowed to respec characters and reclass them as you please, and you’re even refunded all invested LP. With this change, you’re now given greater ability to experiment with different party setups as you don’t have to commit to any string of decisions you make in growing any characters. It’s small, sure, but little quality of life changes like this can make a world of difference in ratcheting up the replayability and fun factor; it’s a lot less stressful knowing that you can undo your mistakes.

Speaking of quality of life changes, this Switch port also features the lovely inclusion of three swappable Gambit sets for each character, allowing you to create varying setups for different situations. For example, boss fights often like to throw some curveballs your way and introduce status debuffs and attacks that you likely haven’t predicted with your Gambit setups. In previous versions of Final Fantasy XII, you’d have to redo your party’s Gambits to fit that boss, then have to remember your previous setups and reimplement them again after you were done; this way, you can have one or two ‘main’ setups and use the remainders for specific situations. Another welcome inclusion (which wasn’t present in the initial PS2 release) is the ability to double or quadruple the speed of the game by simply pressing in the left stick, enormously cutting back on the downtime that grinding tends to bring. Especially when paired with a party that can fight mostly on its own, having the ability to expedite the process of fights that are otherwise set in stone lets you get to rewards that much faster and move on to whatever’s next. It’s clear that Final Fantasy XII: The Zodiac Age is designed to be a game that’s respectful of your time, even if the nature of the genre demands that you pour in dozens of hours to get the ‘full’ experience.

From a presentation perspective, Final Fantasy XII: The Zodiac Age doesn’t necessarily impress, but it certainly satisfies. Updated character models and up-rezzed textures bring the PS2-era graphics into the modern age and provide some solid visuals, but character expressions and jagged geometry ensure that it’s still unmistakably a game from days past. That’s not to say it looks bad, but coming into this one with managed expectations is wise; next to other modern RPG’s, it can look a bit lackluster. The world is presented in a rather painterly look that brings to mind shades of the system used in the Valkyria Chronicles, characterized by soft colors that tend to blur together occasionally punctuated by loud, vibrant colors that all but pierce the screen, such as when a powerful magic spell is cast in battle.

This is all well and good, but the visual style feels a bit let down by the slightly more reined in fantasy elements, bringing a more grounded approach to the world. There are still dragons and magic and all the trappings that one would come to expect from a Final Fantasy game, but the decidedly more political approach to the storytelling seems to have rubbed off a bit on the art direction, which is concerned with making the world of Ivalice seem like a place that could almost be real, somewhere. Of course, it looks great in motion and runs at 30 FPS – whether you’re playing on the Switch or the TV – and as far as we could tell, appears to be mostly on-par with the versions available on other platforms. Also, for you music aficionados, there are three different versions of Hitoshi Sakimoto’s soundtrack work here – Original, orchestral, and OST – and though the differences won’t be too noticeable to an untrained ear, it’s nice to see that the developers went to the trouble of making sure the audio received the same TLC that the rest of the game did.

Microsoft Build is underway in Seattle, and this year’s premier developer conference is focused on empowering developers of all kinds, from experienced computer scientists to tech beginners with big ideas. We’re sharing the latest on Microsoft platforms, tools and services that are making it easier to create and innovate using AI and mixed reality with the intelligent cloud and the intelligent edge, as well as helping people and organizations do more each day.

Here’s a peek at some of the event’s highlights:

Check out the new features in Microsoft Edge built on Chromium OSS that will make it easier to collect, organize and share content, and give you additional privacy controls to make your own decisions about how third parties can track you.

See how technology is helping Starbucks and their baristas deliver great customer experiences including managing predictive maintenance on coffee machines with Azure Sphere; giving personalized recommendations to customers via the Starbucks mobile app with reinforcement learning on Azure; and powering digital traceability efforts to track coffee beans from farm to store with Azure blockchain service.

Read about Fluid Framework, a web-based platform expected to be available later this year that will give teams new ways to create together, enabling content to be deconstructed and reconstructed into modular components and allowing intelligent agents to work alongside people to co-author, provide photo suggestions, translate data and more.

Learn more about Microsoft’s vision for intelligent agents that leverage breakthroughs in conversational AI and machine learning pioneered by Semantic Machines, which Microsoft acquired in May 2018. We’re showcasing a calendaring application of the technology that can make organizing your day with an intelligent assistant a more natural and powerful experience, and the same technology will eventually be integrated into our conversational AI moving forward across all of Microsoft’s products and services.

See how more everyday uses of AI in Microsoft 365 and Office 365 can help improve productivity, including Ideas in Word for Word Online, which can help you easily design and present polished documents, and Microsoft Search, a new enterprise search experience that applies AI technology from Bing and deep personalized insights surfaced by the Microsoft Graph.

Learn more about a new platform that can help make it easier for companies to create autonomous systems, whether it’s a robot that can help in life-threatening situations, a drone that can inspect remote equipment or systems that can autonomously calibrate factory equipment. The first component in this platform is now available in a limited preview program.

Learn what developers will be able to do with Microsoft Graph data connect, a service that helps organizations bring together productivity data from the Microsoft Graph with their own business data securely, providing new opportunities to create insight-powered apps while helping address the challenges of moving and managing large amounts of data.

Learn about the new tools and capabilities in Azure AI for developers and data scientists, including Ink Recognizer, which lets developers embed digital ink recognition, an advanced speech-to-text capability that transcribes meeting conversations in real time so participants can fully engage in the discussion and know who said what later on.

See how the new Azure Blockchain Service will empower developers, letting them deploy a fully managed consortium network with a few simple clicks and use built-in governance to add new members, set permissions and authenticate user applications. They’ll also be able to monitor their network’s health and activity.

Check out IoT Plug and Play. One of the greatest challenges customers face when deploying Internet of Things solutions broadly is connecting their IoT devices to the cloud. IoT Plug and Play offers a new open modeling language to help make this happen seamlessly, as well as a large ecosystem of partner-certified devices that simply work, with over a dozen certified devices now available.

Get more details on all of these announcements and more on our Microsoft Build 2019 website.

Lead photo by Brian Smale

Obsidian’s Knights of the Old Republic II: The Sith Lords holds a strange place in the Star Wars video game canon.

KOTOR II was critically acclaimed on its 2004 release, with weird and morally ambiguous characters who felt more at home in a Fallout game than the George Lucas-verse. But it didn’t receive the same universal praise as its predecessor.

Firm deadlines led to many bugs, and complaints that the story felt “unfinished.” Its plot wrapped up very quickly and ended on a mysterious cliffhanger; modders later discovered entire storylines that were included on the disc but had not been implemented. Most players assumed that KOTOR II would remain an unpolished gem unless Obsidian was able to revisit it and fill in some of the gaps.

Then on July 22nd, all of that changed. Publisher Aspyr Media, responsible for porting games to non-Windows platforms including OSX, Linux, iOS and Android, updated KOTOR II on Steam for the first time in 10 years, and with it came a crucial patch note: support for Steam Workshop mods, and with that, The Sith Lords Restored content mod.

Now any KOTOR II player can install this fabled mod with a simple button push, and play the storylines that were previously abandoned. The work of one dedicated modder community has fleshed out a flawed masterpiece, and their work is sure to bring newfound attention to this game. (It’s already drawing praise from KOTOR II’s lead narrative designer, Chris Avellone.)

“I don’t feel like I ever ‘own’ a game I work on. It’s something to be shared, improved upon, and whenever possible, seen from a new perspective that gives the title new life. – Chris Avellone”

The mod includes numerous bug fixes, new areas, and dialogue options that flesh out the story in the main game. It was actually in development since before 2009, when it was first released in open beta by modder Zbigniew Staniewicz, aka Zbyl, with his modding partner Darth Stoney.

Staniewicz was a big fan of the KOTOR series, and wanted to play the cut content  as soon as he heard about it. “I also thought ‘finishing up’ the game would make me super famous, but I may have overestimated the size and reach of the KOTOR community,” he jokes.

Staniewicz and Stoney’s first versions of The Sith Lords Restored, built on the back of research and work done by other modders, added what they believed to be part of a known list of cut content found on the disc. “It turned out our list didn’t include even half of the trivial stuff left out of the game,” he says. “It was always exciting and at times surprising to realize how much more there was buried in there.”

Staniewicz was joined by modder Hassat Hunter as development on The Sith Lords Restored continued. Hunter started out in the mod community bug testing and teaching himself the dialogue editing tools for KOTOR before signing on to work on The Sith Lords Restored.

Hunter’s passion for fixing KOTOR II’s bugs grew into a desire to dig out all the unknown story content and present a “true” version of KOTOR II to the players.

“We didn’t just want people to experience the cut content, we wanted to give people the KOTOR 2 that should have been,” Hunter says. “I don’t think anyone expected to still work on it five years later, or that eventually we’d take up a greater scope, albeit in steps.”

Doing this kind of restorative mod work isn’t just a process of cleaning up bugs and extracting unused models though. As Staniewicz and Hunter describe their process, it becomes clear that they wound up doing plenty of design work too, building on Obsidian’s work from a decade prior.

Doing this kind of restorative mod work isn’t just a process of cleaning up bugs and extracting unused models.

“For example in the very first closed beta of [the mod], you could finish the HK assassin droid factory without firing a single shot,” says Hunter. “That just didn’t fit the story of the HK droids though, not to mention that it was extremely boring. The factory went through a lot of transitions, but I think the current version works very well.”

Much of the restored content reflects the core of what made KOTOR II so unusual as a Star Wars game. HK-47, a murderous assassin droid from the first KOTOR, began his life as a fan-favorite character in the context of a more traditional hero’s story (or villain’s story depending on the player’s choice), but like many other plot points from the first KOTOR  he and other characters evolved under the moral lenses Obsidian took to the Star Wars universe. KOTOR II spends a large amount of its cut and uncut content examining how droids shape the world of Star Wars, and how the way most species treat them leaves them in a perfect position to perform acts of villainy or heroism overlooked by most.

KOTOR II’s lead narrative designer, Chris Avellone, has loosely kept up with modder’s progress over the years, with the HK Droid Factory being one of the biggest pieces of content he’s glad players can experience. “While we had HK-50 and HK-51 droids in the game, I always…intended the player and even HK-47 itself to feel offended by their presence,” he says

“This was intended to make the final confrontation with them all the sweeter when HK-47 gets to turn the tables on its upstart “successors” by using their programming that they inherited from him as a weakness,” he adds. “There’s a ‘panicked’ sequence in the excised content where the HK-50s figure this out, and I always meant it as a scene to make the player grin.”

Elsewhere, Kreia’s cut lines reinforce her as a character who possesses traits of both the Jedi and the Sith, constantly judging the player no matter which side of the Force they give in to, and the Sith are shown more to be a complicated, nuanced political group rather than an embodiment of raw evil. All of these ideas are far removed from their film incarnations, and are not even the kind of storytelling that Disney has endorsed in its video game tie-ins realesed after the Lucasfilm acquisition.

Hunter says that Aspyr approached them a month before it planned to push out KOTOR II on Steam (mostly to open up ports for Mac and Linux), but wasn’t able at first to properly say why they were interested in talking to the KOTOR II modders.

When they learned of Aspyr’s plans though, Hunter and Stanwiecz dove in to patch the mod to be Steam Workshop ready.

“They pretty much laid down for us what we had to do to make [the mod] work for the Steam Workshop so everything could go as smooth as possible at release,” says Hunter. “And now hopefully we can get rid of all the remaining bugs and annoyances still in this version, and be in the unique position to fix things we couldn’t as modders. I can’t say that we or anyone else expected this to happen at this time or date, so that was a pretty nice surprise.”

For its part, Aspyr Media’s primary goal was to include Steam Workshop among a large batch of featured updates, including controller support, Steam Achievements, and playability on Linux and other platforms. Product manager Michael Blair explains that they knew the mod would be a huge feature to have on launch, which was why they reached out to Staniewicz and Hunter to get them on board. 

“In order for our QA team to test ‘live’ content from months of working on this update, we moved our Steam branches from beta to live 2 days before launch,” Blair says. “During that time, we allowed the mod team access and instructions on how to get their mod up in the Workshop, and ensured it remained hidden from public view. Our team then tested it before we hit ‘go’ on the launch.'”

Obsidian’s only involvement in the game’s update seems to be unofficial. Hunter says Obsidian lead programmer Adam Brennecke voices a character on the planet M4-78EP, but that connection came from chatting with him during a Pillars of Eternity (Obsidian’s latest RPG) promotional stream, not any official endorsement.

Regardless, Hunter and Staniewicz both are floored by the positive feedback that they’ve received for their work, and are glad more players can make their mod a core part of playing KOTOR II. For his part, Avellone remains thrilled by the collaborative spirit of the modders pulling his old work out of the shadows.

“I love it, and I have much respect for the Total Restoration mod and any modders willing to experiment with gameplay and narrative aspects to our titles,” he says.

“I don’t feel like I ever ‘own’ a game I work on, it’s something to be shared, improved upon, and whenever possible, seen from a new perspective that gives the title new life.”

In this 2017 GDC session, Lunarch Studios’ David Churchill describes the Hierarchical Portfolio Search AI system created for Prismata, and how it can be adapted to fit almost any genre of game, including search-heavy ones like strategy games.

It was a detailed dive into a fascinating technical challenge rich in takeaways for game devs, so if you missed seeing it live, take advantage of the fact that you can now https://www.youtube.com/watch?v=sQSL9j7W7uA“>watch it for free on the official GDC YouTube channel!

In addition to this presentation, the GDC Vault and its accompanying YouTube channel offers numerous other free videos, audio recordings, and slides from many of the recent Game Developers Conference events, and the service offers even more members-only content for GDC Vault subscribers.

Those who purchased All Access passes to recent events like GDC or VRDC already have full access to GDC Vault, and interested parties can apply for the individual subscription via a GDC Vault subscription page. Group subscriptions are also available: game-related schools and development studios who sign up for GDC Vault Studio Subscriptions can receive access for their entire office or company by contacting staff via the GDC Vault group subscription page. Finally, current subscribers with access issues can contact GDC Vault technical support

Starting at 2:00 p.m. PST today, members of the Xbox One Preview Beta Ring will begin receiving the latest 1905 Xbox One system update (19H1_RELEASE_XBOX_DEV_1905\18362.3038.190424-1940) Read on for more about the new features, fixes and known issues in the latest 1905 system update.

DETAILS:

• OS version released: 19H1_RELEASE_XBOX_DEV_1905\18362.3038.190424-1940
• Available: 2:00PM PDT 4/27/19
• Mandatory Date/Time: 3:00 AM PDT 4/28/19

New Features:

The 1905 features are highlighted here in a new blog post  https://news.xbox.com/en-us/2019/04/25/improvements-to-xbox-game-pass-friends-list-and-messaging-coming-to-xbox-insiders/

My Games and Apps – Better Sorting

• Based on user feedback, we’re broadening your ability to sort games and apps by date, including updated options to “last updated” or “last used” title selection. Please check out this change in “My Games & apps” and let us know what you think!

Friends list shows where your friends are playing

• You can now see where your friends are playing their games. Keep an eye out for the console, mobile and PC icons next to your friends’ names in your friends list in the Guide!

Voice channels in messaging

• Voice channels have been added to Xbox Live messaging on console. This feature is only available in Alpha and can only be used between Alpha users. If you and a friend are both in Preview Alpha, we’d highly encourage you try adding a voice channel and let us know what you think!

Fixes:

My Games and Apps

• Additional fixes for an issue in which switching from media apps such as Youtube/Hulu to a game or from a game to a media app would crash the console.

Known Issues:

Audio

• Headsets are not being assigned to the users profiles.
• Some users are experiencing no audio with headsets and we are investigating
• Some users are encountering no audio on their Xbox console after boot (no shell audio, no game audio, no app audio), then have CSS ask them to perform the following steps:

1. Cold reboot the console

OR

2. Go to Audio settings on console
3. Change their HDMI audio settings to the highest supported uncompressed channel count for their equipment
4. Switch back to the desired format
5. Audio should be restored

My Games and Apps

• We are tracking the video corruption issue with Youtube and Netflix 4k playback.

Profile Color

• Sometimes users may encounter the incorrect Profile color when powering on the console.

Today’s Deal: Save 67% on Sid Meier’s Civilization® VI and the Digital Deluxe Edition!*

Look for the deals each day on the front page of Steam. Or follow us on twitter or Facebook for instant notifications wherever you are!

*Offer ends May 20 at 10AM Pacific Time

While modern IT environments move towards Linux containers, the need to secure these environments is as relevant as ever. Containers are a process isolation technology. While containers can be a defense mechanism, they only excel when combined with SELinux.

Fedora SELinux engineering built a new standalone tool, udica, to generate SELinux policy profiles for containers by automatically inspecting them. This article focuses on why udica is needed in the container world, and how it makes SELinux and containers work better together. You’ll find examples of SELinux separation for containers that let you avoid turning protection off because the generic SELinux type container_t is too tight. With udica you can easily customize the policy with limited SELinux policy writing skills.

SELinux technology

SELinux is a security technology that brings proactive security to Linux systems. It’s a labeling system that assigns a label to all subjects (processes and users) and objects (files, directories, sockets, etc.). These labels are then used in a security policy that controls access throughout the system. It’s important to mention that what’s not allowed in an SELinux security policy is denied by default. The policy rules are enforced by the kernel. This security technology has been in use on Fedora for several years. A real example of such a rule is:

allow httpd_t httpd_log_t: file { append create getattr ioctl lock open read setattr };

The rule allows any process labeled as httpd_t to create, append, read and lock files labeled as httpd_log_t. Using the ps command, you can list all processes with their labels:

$ ps -efZ | grep httpd
system_u:system_r:httpd_t:s0 root 13911 1 0 Apr14 ? 00:05:14 /usr/sbin/httpd -DFOREGROUND
...

To see which objects are labeled as httpd_log_t, use semanage:

# semanage fcontext -l | grep httpd_log_t
/var/log/httpd(/.)? all files system_u:object_r:httpd_log_t:s0 
/var/log/nginx(/.)? all files system_u:object_r:httpd_log_t:s0 
...

The SELinux security policy for Fedora is shipped in the selinux-policyRPM package.

SELinux vs. containers

In Fedora, the container-selinux RPM package provides a generic SELinux policy for all containers started by engines like podman or docker. Its main purposes are to protect the host system against a container process, and to separate containers from each other. For instance, containers confined by SELinux with the process type container_t can only read/execute files in /usr and write to container_file_t files type on host file system. To prevent attacks by containers on each other, Multi-Category Security (MCS) is used.

Using only one generic policy for containers is problematic, because of the huge variety of container usage. On one hand, the default container type (container_t) is often too strict. For example:

• Fedora SilverBlue needs containers to read/write a user’s home directory
• Fluentd project needs containers to be able to read logs in the /var/log directory

On the other hand, the default container type could be too loose for certain use cases:

• It has no SELinux network controls — all container processes can bind to any network port
• It has no SELinux control on Linux capabilities — all container processes can use all capabilities

There is one solution to handle both use cases: write a custom SELinux security policy for the container. This can be tricky, because SELinux expertise is required. For this purpose, the udica tool was created.

Introducing udica

Udica generates SELinux security profiles for containers. Its concept is based on the “block inheritance” feature inside the common intermediate language (CIL) supported by SELinux userspace. The tool creates a policy that combines:

• Rules inherited from specified CIL blocks (templates), and
• Rules discovered by inspection of container JSON file, which contains mountpoints and ports definitions

You can load the final policy immediately, or move it to another system to load into the kernel. Here’s an example, using a container that:

• Mounts /home as read only
• Mounts /var/spool as read/write
• Exposes port tcp/21

The container starts with this command:

# podman run -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

The default container type (container_t) doesn’t allow any of these three actions. To prove it, you could use the sesearch tool to query that the allow rules are present on system:

# sesearch -A -s container_t -t home_root_t -c dir -p read 

There’s no allow rule present that lets a process labeled as container_t access a directory labeled home_root_t (like the /home directory). The same situation occurs with /var/spool, which is labeled var_spool_t:

# sesearch -A -s container_t -t var_spool_t -c dir -p read

On the other hand, the default policy completely allows network access.

# sesearch -A -s container_t -t port_type -c tcp_socket
allow container_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };
allow sandbox_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };

Securing the container

It would be great to restrict this access and allow the container to bind just on TCP port 21 or with the same label. Imagine you find an example container using podman ps whose ID is 37a3635afb8f:

# podman ps -q
37a3635afb8f

You can now inspect the container and pass the inspection file to the udica tool. The name for the new policy is my_container.

# podman inspect 37a3635afb8f > container.json
# udica -j container.json my_container
Policy my_container with container id 37a3635afb8f created!

Please load these modules using:
 # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}

Restart the container with: "--security-opt label=type:my_container.process" parameter

That’s it! You just created a custom SELinux security policy for the example container. Now you can load this policy into the kernel and make it active. The udica output above even tells you the command to use:

# semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}

Now you must restart the container to allow the container engine to use the new custom policy:

# podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash

The example container is now running in the newly created my_container.process SELinux process type:

# ps -efZ | grep my_container.process
unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434 1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash
system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305 0 13:49 pts/0 00:00:00 bash

Seeing the results

The command sesearch now shows allow rules for accessing /home and /var/spool:

# sesearch -A -s my_container.process -t home_root_t -c dir -p read
allow my_container.process home_root_t:dir { getattr ioctl lock open read search };
# sesearch -A -s my_container.process -t var_spool_t -c dir -p read
allow my_container.process var_spool_t:dir { add_name getattr ioctl lock open read remove_name search write }

The new custom SELinux policy also allows my_container.process to bind only to TCP/UDP ports labeled the same as TCP port 21:

# semanage port -l | grep 21 | grep ftp
 ftp_port_t tcp 21, 989, 990
# sesearch -A -s my_container.process -c tcp_socket -p name_bind
 allow my_container.process ftp_port_t:tcp_socket name_bind;

Conclusion

The udica tool helps you create SELinux policies for containers based on an inspection file without any SELinux expertise required. Now you can increase the security of containerized environments. Sources are available on GitHub, and an RPM package is available in Fedora repositories for Fedora 28 and later.

Photo by Samuel Zeller on Unsplash.

By Christine McKee
Monday, May 06, 2019, 06:16 pm PT (09:16 pm ET)

B&H Photo just unveiled the Payboo Card, which offers shoppers a tax-equivalent loyalty reward to counteract sales tax assessed on purchases. This new marketing initiative sets B&H apart from competitors, such as Best Buy and Amazon, that collect sales tax on purchases in all applicable states without the reward, potentially putting hundreds of dollars back in the pockets of consumers.

B&H Photo Payboo Credit Card with tax incentive

Shoppers subscribed to B&H emails began receiving a message describing Payboo as “the solution to the sales-tax challenge,” which references the South Dakota vs Wayfair ruling that allows states to collect sales tax on purchases made from out-of-state sellers, even when said sellers do not have a physical presence in the state. As we reported in October 2018, B&H began collecting sales tax in additional states after the ruling, with even more states added to the list during the remainder of 2018. As it stands now, B&H collects sales tax in a total of 26 states and reports purchases in several more, due to local taxation laws.

Shortly after 6 p.m. Pacific, B&H launched the Payboo Credit Card page, with a message reading “you pay the tax, we pay you back.” Shoppers in eligible states will receive a reward equivalent to the amount paid in sales tax on every purchase with the B&H Payboo Card. At press time, the tax-equivalent loyalty reward is not valid in Alabama, District of Columbia, Indiana, Iowa, Nebraska, North Dakota, Vermont, West Virginia and Wyoming, although other Payboo Card incentives may be available.

Payboo comes on the heels of Apple’s own Apple Card announcement, which offers 3% cash back on purchases made at Apple and 2% back on purchases using the Apple Card via Apple Pay.

This story is developing. Stay tuned for more details following B&H’s official announcement.