Unprivileged Containers Jess Frazelle, @jessfraz How do containers - - PowerPoint PPT Presentation

▶

Mar 31, 2024 554 likes •824 views

Unprivileged Containers Jess Frazelle, @jessfraz How do containers help security? Containers are not going to be the answer to preventing your application from being compromised, but they can limit the damage from a compromise. How do

SLIDE 1

Unprivileged Containers

Jess Frazelle, @jessfraz

SLIDE 2

How do containers help security?

Containers are not going to be the answer to preventing your application from being compromised, but they can limit the damage from a compromise.

SLIDE 3

How do containers help security?

The world an attacker might see from inside a very strict container with custom AppArmor/Seccomp profiles greatly differs than that without the use of containers.

SLIDE 4

Sandboxes Today

SLIDE 5

Chrome

Seccomp
Namespaces
Apparmor
NOT RUN AS ROOT

SLIDE 6

Containers today

Namespaces
Apparmor
Selinux
Capabilities Limiting
Cgroups
Run as root :(

SLIDE 7

How can we get to sandboxes with containers?

SLIDE 8

Back to the Basics

A “container” is what we have come to call a group of namespaces and control groups applied to a process.

SLIDE 9

Control Groups (cgroups)

Limit what the process can use. Resource metering and limiting. Types: memory, CPU, blkio, network, device, pid..

SLIDE 10

PID Cgroup

SLIDE 11

Namespaces

Limit what the process sees. Types: pid, net, mnt, uts, ipc, user Created with clone() or unshare()

SLIDE 12

Net Namespace

SLIDE 13

UTS Namespace

SLIDE 14

IPC Namespace

SLIDE 15

PID Namespace

SLIDE 16

User Namespace

SLIDE 17

Makings of a Sandbox: Containers

Namespaces
Apparmor
Selinux
Capabilities Limiting
Cgroups

NOT RUN AS ROOT

SLIDE 18

POC or GTFO

SLIDE 19

POC or GTFO

SLIDE 20

What is this sorcery?

User namespaces can be created without

root.

But only if the {uid,gid}_map is mapped to

the current user creating the namespace.

SLIDE 21

Not Perfect …. yet

Cgroups devices cannot be created

without CAP_SYS_ADMIN

SLIDE 22

New Hotness: Cgroup Namespace

In Kernels 4.6+, not

yet released, on RC5 currently

False prophet to

solve all the problems, but maybe in the future.

SLIDE 23

Cgroup Namespace

SLIDE 24

What to look forward to...

Containers in a multi-tenant environment not run as

root.

Sane defaults with the ability to customize for a

sandbox experience.

Better designed user experiences for dealing with

security policies.

SLIDE 25

Resources

https://github.com/docker/docker/issues/17142 http://www.sysdig.org/falco/