ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืึทื“ืžื™ื ื™ืกื˜ืจืึทืฆื™ืข > Secomp in Kubernetes: 7 ื˜ื™ื ื’ื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื•ื•ื™ืกืŸ ืคึฟื•ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘

Secomp in Kubernetes: 7 ื˜ื™ื ื’ื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื•ื•ื™ืกืŸ ืคึฟื•ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘

ื ืื˜ื™ืฅ. ื˜ืจืึทื ืกืœ.: ืžื™ืจ ืคืึธืจืฉื˜ืขืœืŸ ืฆื• ื“ื™ื™ืŸ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ื˜ ื“ื™ ืื™ื‘ืขืจื–ืขืฆื•ื ื’ ืคื•ืŸ ืึทืŸ ืึทืจื˜ื™ืงืœ ืคื•ืŸ ืึท ืขืœื˜ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื–ื™ื›ืขืจื”ื™ื™ื˜ ื™ื ื–ืฉืขื ื™ืจ ื‘ื™ื™ ื“ื™ ื‘ืจื™ื˜ื™ืฉ ืคื™ืจืžืข ASOS.com. ืžื™ื˜ ืื™ื, ืขืจ ื”ื™ื™ื‘ื˜ ืึท ืกืขืจื™ืข ืคื•ืŸ โ€‹โ€‹ืื•ื™ืกื’ืื‘ืขืก ื“ืขื“ืึทืงื™ื™ื˜ืึทื“ ืฆื• ืคึฟืึทืจื‘ืขืกืขืจืŸ ื–ื™ื›ืขืจื”ื™ื™ื˜ ืื™ืŸ ืงื•ื‘ืขืจื ืขื˜ืขืก ื“ื•ืจืš ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ืกืขืงืึธืžืคึผ. ืื•ื™ื‘ ืœื™ื™ืขื ืขืจ ื•ื•ื™ ื“ื™ ื”ืงื“ืžื”, ืžื™ืจ ื•ื•ืขืœืŸ ื ืึธื›ืคืึธืœื’ืŸ ื“ืขื ืžื—ื‘ืจ ืื•ืŸ ืคืึธืจื–ืขืฆืŸ ืžื™ื˜ ื–ื™ื™ืŸ ืฆื•ืงื•ื ืคึฟื˜ ืžืึทื˜ืขืจื™ืึทืœืก ืื•ื™ืฃ ื“ืขื ื˜ืขืžืข.

Secomp in Kubernetes: 7 ื˜ื™ื ื’ื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื•ื•ื™ืกืŸ ืคึฟื•ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘

ื“ืขืจ ืึทืจื˜ื™ืงืœ ืื™ื– ื“ืขืจ ืขืจืฉื˜ืขืจ ืื™ืŸ ืึท ืกืขืจื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ื”ื•ื“ืขื•ืช ื•ื•ืขื’ืŸ ื•ื•ื™ ืฆื• ืฉืึทืคึฟืŸ ืกืขืงืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืื™ืŸ ื“ื™ ื’ื™ื™ืกื˜ ืคื•ืŸ SecDevOps, ืึธืŸ ืจื™ื–ืึธืจื˜ ืฆื• ืžืึทื’ื™ืฉ ืื•ืŸ ื•ื•ื™ื˜ืฉืงืจืึทืคื˜. ืื™ืŸ ื˜ื™ื™ืœ XNUMX, ืื™ืš ื•ื•ืขื˜ ื“ืขืงืŸ ื“ื™ ื‘ืึทืกื™ืงืก ืื•ืŸ ื™ื ืขืจืœืขืš ื“ืขื˜ืึทื™ืœืก ืคื•ืŸ ื™ืžืคึผืœืึทืžืขื ื™ื ื’ ืกืขืงืึธืžืคึผ ืื™ืŸ Kubernetes.

ื“ื™ Kubernetes ื™ืงืึธื•ืกื™ืกื˜ืึทื ืึธืคืคืขืจืก ืึท ื‘ืจื™ื™ื˜ ืคืึทืจืฉื™ื™ื“ื ืงื™ื™ึทื˜ ืคื•ืŸ ื•ื•ืขื’ืŸ ืฆื• ื‘ืึทื•ื•ืึธืจืขื ืขืŸ ืื•ืŸ ื™ื–ืึธืœื™ืจืŸ ืงืึทื ื˜ื™ื™ื ืขืจื–. ื“ืขืจ ืึทืจื˜ื™ืงืœ ืื™ื– ื•ื•ืขื’ืŸ ื–ื™ื›ืขืจ ืงืึทืžืคึผื™ื•ื˜ื™ื ื’ ืžืึธื“ืข, ืื•ื™ืš ื‘ืืงืื ื˜ ื•ื•ื™ ืกืขืงืงืึธืžืคึผ. ื–ื™ื™ึทืŸ ืขืกืึทื ืก ืื™ื– ืฆื• ืคื™ืœื˜ืขืจ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคื˜ ื‘ื ื™ืžืฆื ืคึฟืึทืจ ื“ื•ืจื›ืคื™ืจื•ื ื’ ื“ื•ืจืš ืงืึทื ื˜ื™ื™ื ืขืจื–.

ืคืืจื•ื•ืืก ืื™ื– ืขืก ื•ื•ื™ื›ื˜ื™ืง? ื ืงืึทื ื˜ื™ื™ื ืขืจ ืื™ื– ื ืึธืจ ืึท ืคึผืจืึธืฆืขืก ืคืœื™ืกื ื“ื™ืง ืื•ื™ืฃ ืึท ืกืคึผืขืฆื™ืคื™ืฉ ืžืึทืฉื™ืŸ. ืื•ืŸ ืขืก ื ื™ืฆื˜ ื“ื™ ืงืขืจืŸ ืคึผื•ื ืงื˜ ื•ื•ื™ ืื ื“ืขืจืข ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–. ืื•ื™ื‘ ืงืึทื ื˜ื™ื™ื ืขืจื– ืงืขืŸ ื“ื•ืจื›ืคื™ืจืŸ ืงื™ื™ืŸ ืกื™ืกื˜ืขื ืงืึทืœืœืก, ื–ื™ื™ืขืจ ื‘ืึทืœื“ ืžืึทืœื•ื•ืึทืจืข ื•ื•ืึธืœื˜ ื ื•ืฆืŸ ื“ืขื ืฆื• ื‘ื™ื™ืคึผืึทืก ืงืึทื ื˜ื™ื™ื ืขืจ ืืคื’ืขื–ื•ื ื“ืขืจื˜ืงื™ื™ื˜ ืื•ืŸ ื•ื•ื™ืจืงืŸ ืื ื“ืขืจืข ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–: ื™ื ื˜ืขืจืกืขืคึผื˜ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข, ื˜ื•ื™ืฉืŸ ืกื™ืกื˜ืขื ืกืขื˜ื˜ื™ื ื’ืก, ืขื˜ืง.

seccomp ืคึผืจืึธื•ืคื™ื™ืœื– ื“ืขืคื™ื ื™ืจืŸ ื•ื•ืึธืก ืกื™ืกื˜ืขื ืจื•ืคื˜ ื–ืึธืœ ื–ื™ื™ืŸ ืขืจืœื•ื™ื‘ื˜ ืึธื“ืขืจ ืคืึทืจืงืจื™ืคึผืœื˜. ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ืึทืงื˜ืึทื•ื•ื™ื™ืฅ ื–ื™ื™ ื•ื•ืขืŸ ืขืก ืกื˜ืึทืจืฅ ืึทื–ื•ื™ ืึทื– ื“ืขืจ ืงืขืจืŸ ืงืขื ืขืŸ ืžืึธื ื™ื˜ืึธืจ ื–ื™ื™ืขืจ ื“ื•ืจื›ืคื™ืจื•ื ื’. ื ื™ืฆืŸ ืึทื–ืึท ืคึผืจืึธื•ืคื™ื™ืœื– ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื‘ืึทื’ืจืขื ืขืฆืŸ ื“ื™ ื‘ืึทืคืึทืœืŸ ื•ื•ืขืงื˜ืึธืจ ืื•ืŸ ืจืขื“ื•ืฆื™ืจืŸ ืฉืขื“ื™ืงืŸ ืื•ื™ื‘ ืงื™ื™ืŸ ืคึผืจืึธื’ืจืึทื ืื™ืŸ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ (ื“"ื”, ื“ื™ื™ืŸ ื“ื™ืคึผืขื ื“ืึทื ืกื™ื– ืึธื“ืขืจ ื–ื™ื™ืขืจ ื“ื™ืคึผืขื ื“ืึทื ืกื™ื–) ืกื˜ืึทืจืฅ ืฆื• ื˜ืึธืŸ ืขืคึผืขืก ื•ื•ืึธืก ืขืก ืื™ื– ื ื™ืฉื˜ ืขืจืœื•ื™ื‘ื˜ ืฆื• ื˜ืึธืŸ.

ื‘ืึทืงื•ืžืขืŸ ืฆื• ื“ื™ ื‘ืึทืกื™ืงืก

ื“ื™ ื’ืจื•ื ื˜ ืกืขืงืงืึธืžืคึผ ืคึผืจืึธืคื™ืœ ื›ื•ืœืœ ื“ืจื™ื™ึท ื™ืกื•ื“ื•ืช: defaultAction, architectures (ืึธื“ืขืจ archMap) ืื•ืŸ syscalls:

{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "arch_prctl",
                "sched_yield",
                "futex",
                "write",
                "mmap",
                "exit_group",
                "madvise",
                "rt_sigprocmask",
                "getpid",
                "gettid",
                "tgkill",
                "rt_sigaction",
                "read",
                "getpgrp"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

(medium-basic-secomp.json)

defaultAction ื“ื™ื˜ืขืจืžืึทื ื– ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ื’ื•ืจืœ ืคื•ืŸ ืงื™ื™ืŸ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื ื™ื˜ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ ืึธืคึผื˜ื™ื™ืœื•ื ื’ syscalls. ืฆื• ืžืึทื›ืŸ ื“ื™ ื˜ื™ื ื’ื– ื’ืจื™ื ื’ืขืจ, ืœืึธืžื™ืจ ืคืึธืงื•ืก ืื•ื™ืฃ ื“ื™ ืฆื•ื•ื™ื™ ื”ื•ื™ืคึผื˜ ื•ื•ืึทืœื•ืขืก ื•ื•ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜:

  • SCMP_ACT_ERRNO - ื‘ืœืึทืงืก ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ืึท ืกื™ืกื˜ืขื ืจื•ืคืŸ,
  • SCMP_ACT_ALLOW - ืึทืœืึทื•ื–.

ืื™ืŸ ืึธืคึผื˜ื™ื™ืœื•ื ื’ architectures ืฆื™ืœ ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจื– ื–ืขื ืขืŸ ืœื™ืกื˜ืขื“. ื“ืึธืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ื•ื•ื™ื™ึทืœ ื“ื™ ืคื™ืœื˜ืขืจ ื–ื™ืš, ื’ืขื•ื•ืขื ื“ื˜ ืื™ืŸ ื“ื™ ืงืขืจืŸ ืžื“ืจื’ื”, ื“ืขืคึผืขื ื“ืก ืื•ื™ืฃ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื™ื“ืขื ื˜ื™ืคื™ืขืจืก, ืื•ืŸ ื ื™ืฉื˜ ืื•ื™ืฃ ื–ื™ื™ืขืจ ื ืขืžืขืŸ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ืขื ืคึผืจืึธืคื™ืœ. ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ื•ื•ืขื˜ ื’ืœื™ื™ึทื›ืŸ ื–ื™ื™ ืฆื• ื™ื“ืขื ื˜ื™ืคื™ืขืจืก ืื™ื™ื“ืขืจ ื ื•ืฆืŸ. ื“ืขืจ ื’ืขื“ืึทื ืง ืื™ื– ืึทื– ืกื™ืกื˜ืขื ืงืึทืœืœืก ืงืขื ืขืŸ ื”ืึธื‘ืŸ ื’ืึธืจ ืคืึทืจืฉื™ื“ืขื ืข IDs ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ืกื™ืกื˜ืขื ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจ. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืกื™ืกื˜ืขื ืจื•ืคืŸ recvfrom (ื’ืขื•ื•ื™ื™ื ื˜ ืฆื• ื‘ืึทืงื•ืžืขืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืคื•ืŸ โ€‹โ€‹ื“ื™ ื›ืึธืœืขืœ) ื”ืื˜ ID = 64 ืื•ื™ืฃ X64 ืกื™ืกื˜ืขืžืขืŸ ืื•ืŸ ID = 517 ืื•ื™ืฃ X86. ื“ืึธ ืื™ืจ ืงืขื ืขืŸ ื’ืขืคึฟื™ื ืขืŸ ืึท ืจืฉื™ืžื” ืคื•ืŸ ืึทืœืข ืกื™ืกื˜ืขื ืจื•ืคื˜ ืคึฟืึทืจ ืงืก86-ืงืก64 ืึทืจืงืึทื˜ืขืงื˜ืฉืขืจื–.

ืื™ืŸ ื“ืขืจ ืึธืคึผื˜ื™ื™ืœื•ื ื’ syscalls ืจืฉื™ืžื•ืช ืึทืœืข ืกื™ืกื˜ืขื ืจื•ืคื˜ ืื•ืŸ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ื•ื•ืึธืก ืฆื• ื˜ืึธืŸ ืžื™ื˜ ื–ื™ื™. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื™ืจ ืงืขื ืขืŸ ืžืึทื›ืŸ ืึท ื•ื•ื™ื™ื˜ืœื™ืกื˜ ื“ื•ืจืš ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ defaultAction ืื•ื™ืฃ SCMP_ACT_ERRNO, ืื•ืŸ ืจื•ืคื˜ ืื™ืŸ ื“ื™ ืึธืคึผื˜ื™ื™ืœื•ื ื’ syscalls ื‘ืึทืฉื˜ื™ืžืขืŸ SCMP_ACT_ALLOW. ืื–ื•ื™, ืื™ืจ ื ืึธืจ ืœืึธื–ืŸ ืงืึทืœืœืก ืกืคึผืขืกืึทืคื™ื™ื“ ืื™ืŸ ื“ื™ ืึธืคึผื˜ื™ื™ืœื•ื ื’ syscalls, ืื•ืŸ ืคืึทืจื•ื•ืขืจืŸ ืึทืœืข ืื ื“ืขืจืข. ืคึฟืึทืจ ื“ื™ ื‘ืœืึทืงืœื™ืกื˜ ืื™ืจ ื–ืึธืœ ื˜ื•ื™ืฉืŸ ื“ื™ ื•ื•ืึทืœื•ืขืก defaultAction ืื•ืŸ ืึทืงืฉืึทื ื– ืฆื• ื“ื™ ืคืึทืจืงืขืจื˜.

ืื™ืฆื˜ ืžื™ืจ ื–ืึธืœ ื–ืึธื’ืŸ ืึท ื‘ื™ืกืœ ื•ื•ืขืจื˜ืขืจ ื•ื•ืขื’ืŸ ื ื•ืึทื ืกื™ื– ื•ื•ืึธืก ื–ืขื ืขืŸ ื ื™ืฉื˜ ืึทื–ื•ื™ ืงืœืึธืจ ื•ื•ื™ ื“ืขืจ ื˜ืึธื’. ื‘ื™ื˜ืข ื˜ืึธืŸ ืึทื– ื“ื™ ืจืขืงืึทืžืึทื ื“ื™ื™ืฉืึทื ื– ืื•ื ื˜ืŸ ื™ื‘ืขืจื ืขืžืขืŸ ืึทื– ืื™ืจ ื–ืขื ืขืŸ ื“ื™ืคึผืœื•ื™ื“ ืึท ืฉื•ืจื” ืคื•ืŸ ื’ืขืฉืขืคื˜ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ืื•ื™ืฃ Kubernetes ืื•ืŸ ืื™ืจ ื•ื•ื™ืœืŸ ื–ื™ื™ ืฆื• ืœื•ื™ืคืŸ ืžื™ื˜ ื“ื™ ืžื™ื ื“ืกื˜ืขืจ ืกื•ืžืข ืคื•ืŸ โ€‹โ€‹ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ืžืขื’ืœืขืš.

1. AllowPrivilegeEscalation=ืคืึทืœืฉ

ะ’ securityContext ืงืึทื ื˜ื™ื™ื ืขืจ ื”ืื˜ ืึท ืคึผืึทืจืึทืžืขื˜ืขืจ AllowPrivilegeEscalation. ืื•ื™ื‘ ืขืก ืื™ื– ืื™ื ืกื˜ืึทืœื™ืจืŸ ืื™ืŸ false, ืงืึทื ื˜ื™ื™ื ืขืจื– ื•ื•ืขื˜ ืึธื ื”ื™ื™ื‘ืŸ ืžื™ื˜ (on) ื‘ื™ืกืœ no_new_priv. ื“ืขืจ ื˜ื™ื™ึทื˜ืฉ ืคื•ืŸ ื“ืขื ืคึผืึทืจืึทืžืขื˜ืขืจ ืื™ื– ืงืœืึธืจ ื•ื•ื™ ื“ืขืจ ื˜ืึธื’ ืคื•ืŸ ื“ืขื ื ืึธืžืขืŸ: ืขืก ืคึผืจื™ื•ื•ืขื ืฅ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ ืคื•ืŸ ืœืึธื ื˜ืฉื™ื ื’ ื ื™ื™ึท ืคึผืจืึทืกืขืกืึทื– ืžื™ื˜ ืžืขืจ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื– ื•ื•ื™ ืขืก ื–ื™ืš.

ื ื–ื™ื™ึทื˜ ื•ื•ื™ืจืงื•ื ื’ ืคื•ืŸ ื“ืขื ืึธืคึผืฆื™ืข ืื™ื– ื‘ืึทืฉื˜ื™ืžื˜ ืฆื• true (ืคืขืœื™ืงื™ื™ึทื˜) ืื™ื– ืึทื– ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ืึทืคึผืœื™ื™ื– ื“ื™ ืกืขืงืึธืžืคึผ ืคึผืจืึธืคื™ืœ ืื™ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘ ืคื•ืŸ ื“ื™ ืกื˜ืึทืจื˜ืึทืคึผ ืคึผืจืึธืฆืขืก. ืื–ื•ื™, ืึทืœืข ืกื™ืกื˜ืขื ืจื•ืคื˜ ืคืืจืœืื ื’ื˜ ืฆื• ืœื•ื™ืคืŸ ื™ื ืขืจืœืขืš ืจื•ื ื˜ื™ืžืข ืคึผืจืึทืกืขืกืึทื– (ืœืžืฉืœ ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ื‘ืึทื ื™ืฆืขืจ / ื’ืจื•ืคึผืข ื™ื“ืก, ื“ืจืึทืคึผื™ื ื’ ื–ื™ื›ืขืจ ืงื™ื™ืคึผืึทื‘ื™ืœืึทื˜ื™ื–) ืžื•ื–ืŸ ื–ื™ื™ืŸ ืขื ื™ื™ื‘ืึทืœื“ ืื™ืŸ ื“ืขื ืคึผืจืึธืคื™ืœ.

ืฆื• ืึท ืงืึทื ื˜ื™ื™ื ืขืจ ื•ื•ืึธืก ื˜ื•ื˜ ื ื™ืฉื˜ื™ืง ื–ืื›ืŸ echo hi, ื“ื™ ืคืืœื’ืขื ื“ืข ืคึผืขืจืžื™ืฉืึทื ื– ื•ื•ืขื˜ ื–ื™ื™ืŸ ืคืืจืœืื ื’ื˜:

{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "arch_prctl",
                "brk",
                "capget",
                "capset",
                "chdir",
                "close",
                "execve",
                "exit_group",
                "fstat",
                "fstatfs",
                "futex",
                "getdents64",
                "getppid",
                "lstat",
                "mprotect",
                "nanosleep",
                "newfstatat",
                "openat",
                "prctl",
                "read",
                "rt_sigaction",
                "statfs",
                "setgid",
                "setgroups",
                "setuid",
                "stat",
                "uname",
                "write"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

(hi-pod-secomp.json)

... ืึทื ืฉื˜ืึธื˜ ืคื•ืŸ ื“ื™:

{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "arch_prctl",
                "brk",
                "close",
                "execve",
                "exit_group",
                "futex",
                "mprotect",
                "nanosleep",
                "stat",
                "write"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

(hi-container-secomp.json)

ืื‘ืขืจ ื•ื•ื™ื“ืขืจ, ื•ื•ืึธืก ืื™ื– ื“ืึธืก ืึท ืคึผืจืึธื‘ืœืขื? ืคึผืขืจืกื ืึทืœื™, ืื™ืš ื•ื•ืึธืœื˜ ื•ื™ืกืžื™ื™ื“ืŸ ื•ื•ื™ื™ื˜ืœื™ืกื˜ื™ื ื’ ื“ื™ ืคืืœื’ืขื ื“ืข ืกื™ืกื˜ืขื ืจื•ืคื˜ (ืกื™ื™ึทื“ืŸ ืขืก ืื™ื– ืึท ืคืึทืงื˜ื™ืฉ ื ื•ื™ื˜ ืคึฟืึทืจ ื–ื™ื™): capset, set_tid_address, setgid, setgroups ะธ setuid. ืึธื‘ืขืจ, ื“ื™ ืคืึทืงื˜ื™ืฉ ืึทืจื•ื™ืกืจื•ืคืŸ ืื™ื– ืึทื– ื“ื•ืจืš ืึทืœืึทื•ื™ื ื’ ืคึผืจืึทืกืขืกืึทื– ื•ื•ืึธืก ืื™ืจ ื”ืึธื˜ ืœืขื’ืึทืžืจืข ืงื™ื™ืŸ ืงืึธื ื˜ืจืึธืœ ืื™ื‘ืขืจ, ืื™ืจ ื‘ื™ื ื“ืŸ ืคึผืจืึธื•ืคื™ื™ืœื– ืฆื• ื“ื™ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข. ืื™ืŸ ืื ื“ืขืจืข ื•ื•ืขืจื˜ืขืจ, ืื™ื™ืŸ ื˜ืึธื’ ืื™ืจ ืงืขืŸ ื’ืขืคึฟื™ื ืขืŸ ืึทื– ื ืึธืš ืึทืคึผื“ื™ื™ื˜ื™ื ื’ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ืกื•ื•ื™ื•ื•ืข (ืึธื“ืขืจ ื“ื•ืจืš ืื™ืจ ืึธื“ืขืจ, ืžืขืจ ืžืกืชึผืžื, ื“ื•ืจืš ื“ื™ ื•ื•ืึธืœืงืŸ ืกืขืจื•ื•ื™ืก ืฉืคึผื™ื™ึทื–ืขืจ), ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจื– ืคึผืœื•ืฆืœื™ื ื’ ื”ืึทืœื˜ืŸ ืคืœื™ืกื ื“ื™ืง.

ื˜ื™ืคึผ 1: ืœื•ื™ืคืŸ ืงืึทื ื˜ื™ื™ื ืขืจื– ืžื™ื˜ AllowPrivilegeEscaltion=false. ื“ืึธืก ื•ื•ืขื˜ ืจืขื“ื•ืฆื™ืจืŸ ื“ื™ ื’ืจื™ื™ืก ืคื•ืŸ ืกืขืงืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืื•ืŸ ืžืึทื›ืŸ ื–ื™ื™ ื•ื•ื™ื™ื ื™ืงืขืจ ืฉืคึผื™ืจืขื•ื•ื“ื™ืง ืฆื• ืขื ื“ืขืจื•ื ื’ืขืŸ ืื™ืŸ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข ืกื•ื•ื™ื•ื•ืข.

2. ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ื‘ื™ื™ึท ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืžื“ืจื’ื”

ื“ื™ ืกืขืงืงืึธืžืคึผ ืคึผืจืึธืคื™ืœ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืฉื˜ืขืœืŸ ืื•ื™ืฃ ื“ื™ ืคึผืึธื“ ืžื“ืจื’ื”:

annotations:
  seccomp.security.alpha.kubernetes.io/pod: "localhost/profile.json"

... ืึธื“ืขืจ ืื™ืŸ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืžื“ืจื’ื”:

annotations:
  container.security.alpha.kubernetes.io/<container-name>: "localhost/profile.json"

ื‘ื™ื˜ืข ื˜ืึธืŸ ืึทื– ื“ื™ ืื•ื™ื‘ืŸ ืกื™ื ื˜ืึทืงืก ื•ื•ืขื˜ ื˜ื•ื™ืฉืŸ ื•ื•ืขืŸ Kubernetes secomp ื•ื•ืขื˜ ื•ื•ืขืจืŸ ื’ื (ื“ื™ ื’ืขืฉืขืขื ื™ืฉ ืื™ื– ื’ืขืจื™ื›ื˜ ืื™ืŸ ื“ืขืจ ื•ื•ื™ื™ึทื˜ืขืจ ืžืขืœื“ื•ื ื’ ืคื•ืŸ Kubernetes - 1.18 - ืึทืคึผืคึผืจืึธืงืก ื˜ืจืึทื ืกืœ.).

ื•ื•ื™ื™ื ื™ืง ืžืขื ื˜ืฉืŸ ื•ื•ื™ืกืŸ ืึทื– ืงื•ื‘ืขืจื ืขื˜ืขืก ื”ืื˜ ืฉื˜ืขื ื“ื™ืง ื’ืขื”ืื˜ ื–ืฉื•ืงื•ื•ืึธืก ื”ืึธื˜ ื’ืขืคึฟื™ืจื˜ ืฆื• ืกืขืงืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืคึผื•ื™ื–ืข ืงืึทื ื˜ื™ื™ื ืขืจ. ื“ื™ ืจื•ื ื˜ื™ืžืข ืกื•ื•ื™ื•ื•ืข ื˜ื™ื™ืœ ืงืึทืžืคึผืึทื ืกื™ื™ืฅ ืคึฟืึทืจ ื“ืขื ื›ื™ืกืึธืจืŸ, ืึธื‘ืขืจ ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ ื˜ื•ื˜ ื ื™ืฉื˜ ืคืึทืจืฉื•ื•ื™ื ื“ืŸ ืคื•ืŸ ื“ื™ ืคึผืึธื“ืก, ื•ื•ื™ื™ึทืœ ืขืก ืื™ื– ื’ืขื ื™ืฆื˜ ืฆื• ืงืึทื ืคื™ื’ื™ืขืจ ื–ื™ื™ืขืจ ื™ื ืคืจืึทืกื˜ืจืึทืงื˜ืฉืขืจ.

ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืึทื– ื“ืขื ืงืึทื ื˜ื™ื™ื ืขืจ ืฉื˜ืขื ื“ื™ืง ืกื˜ืึทืจืฅ ืžื™ื˜ AllowPrivilegeEscalation=true, ื•ื•ืึธืก ืคื™ืจื˜ ืฆื• ื“ื™ ืคืจืื‘ืœืขืžืขืŸ ื•ื•ืึธืก ื–ืขื ืขืŸ ื’ืขื•ื•ืขืŸ ืื™ืŸ ืคึผืึทืจืึทื’ืจืึทืฃ 1, ืื•ืŸ ื“ืึธืก ืงืขืŸ ื ื™ืฉื˜ ื–ื™ื™ืŸ ื’ืขื‘ื™ื˜ืŸ.

ื“ื•ืจืš ื ื™ืฆืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืื•ื™ืฃ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืžื“ืจื’ื”, ืื™ืจ ื•ื™ืกืžื™ื™ื“ืŸ ื“ืขื ื’ืจื•ื‘ ืื•ืŸ ืงืขื ืขืŸ ืžืึทื›ืŸ ืึท ืคึผืจืึธืคื™ืœ ื•ื•ืึธืก ืื™ื– ื˜ื™ื™ืœืขืจื“ ืฆื• ืึท ืกืคึผืขืฆื™ืคื™ืฉ ืงืึทื ื˜ื™ื™ื ืขืจ. ื“ืึธืก ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื˜ืืŸ ื‘ื™ื– ื“ื™ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ืคืึทืจืจื™ื›ื˜ืŸ ื“ืขื ื–ืฉื•ืง ืื•ืŸ ื“ื™ ื ื™ื™ึทืข ื•ื•ืขืจืกื™ืข (ืืคึฟืฉืจ 1.18?) ื•ื•ืขื˜ ื–ื™ื™ืŸ ื‘ืืจืขื›ื˜ื™ื’ื˜ ืคึฟืึทืจ ืึทืœืขืžืขืŸ.

ื˜ื™ืคึผ 2: ืฉื˜ืขืœืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืื•ื™ืฃ ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืžื“ืจื’ื”.

ืื™ืŸ ืึท ืคึผืจืึทืงื˜ื™ืฉ ื–ื™ื ืขืŸ, ื“ื™ ื”ืขืจืฉืŸ ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ ืกืขืจื•ื•ืขืก ื•ื•ื™ ืึท ื•ื ื™ื•ื•ืขืจืกืึทืœ ืขื ื˜ืคืขืจ ืฆื• ื“ื™ ืงืฉื™ื: "ืคืืจื•ื•ืืก ื˜ื•ื˜ ืžื™ื™ืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธืคื™ืœ ืึทืจื‘ืขื˜ ืžื™ื˜ docker runืึธื‘ืขืจ ื˜ื•ื˜ ื ื™ืฉื˜ ืึทืจื‘ืขื˜ืŸ ื ืึธืš ื“ื™ืคึผืœื•ื™ื™ื ื’ ืฆื• ืึท Kubernetes ืงื ื•ื™ืœ?

3. ื ื™ืฆืŸ ืจื•ื ื˜ื™ืžืข / ืคืขืœื™ืงื™ื™ึทื˜ ื‘ืœื•ื™ื– ื•ื•ื™ ืึท ืœืขืฆื˜ืข ืจื™ื–ืึธืจื˜

Kubernetes ื”ืื˜ ืฆื•ื•ื™ื™ ืึธืคึผืฆื™ืขืก ืคึฟืึทืจ ื’ืขื‘ื•ื™ื˜-ืื™ืŸ ืคึผืจืึธื•ืคื™ื™ืœื–: runtime/default ะธ docker/default. ื‘ื™ื™ื“ืข ื–ืขื ืขืŸ ื™ืžืคึผืœืึทืžืขื ืึทื“ ื“ื•ืจืš ื“ื™ ืงืึทื ื˜ื™ื™ื ืขืจ ืจื•ื ื˜ื™ืžืข, ื ื™ืฉื˜ Kubernetes. ื“ืขืจื™ื‘ืขืจ, ื–ื™ื™ ืงืขืŸ ื–ื™ื™ืŸ ืึทื ื“ืขืจืฉ ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื“ื™ ืจื•ื ื˜ื™ืžืข ืกื•ื•ื™ื•ื•ืข ืื•ืŸ ื–ื™ื™ึทืŸ ื•ื•ืขืจืกื™ืข.

ืื™ืŸ ืื ื“ืขืจืข ื•ื•ืขืจื˜ืขืจ, ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜ ืคื•ืŸ ื˜ืฉืึทื ื’ื™ื ื’ ืจื•ื ื˜ื™ืžืข, ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ืงืขืŸ ื”ืึธื‘ืŸ ืึทืงืกืขืก ืฆื• ืึท ืึทื ื“ืขืจืฉ ื’ืึทื ื’ ืคื•ืŸ ืกื™ืกื˜ืขื ืจื•ืคื˜, ื•ื•ืึธืก ืขืก ืงืขืŸ ืึธื“ืขืจ ืงืขืŸ ื ื™ืฉื˜ ื ื•ืฆืŸ. ืจื•ื‘ึฟ ืจื•ื ื˜ื™ืžืข ื ื•ืฆืŸ ื“ืึธืงืงืขืจ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ. ืื•ื™ื‘ ืื™ืจ ื•ื•ื™ืœื˜ ืฆื• ื ื•ืฆืŸ ื“ืขื ืคึผืจืึธืคื™ืœ, ื‘ื™ื˜ืข ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ืขืก ืื™ื– ืคึผืึทืกื™ืง ืคึฟืึทืจ ืื™ืจ.

ืคึผืจืึธืคื™ืœ docker/default ื“ื™ืคึผืจื™ืฉื™ื™ื™ื˜ื™ื“ ื•ื•ื™ ืคื•ืŸ Kubernetes 1.11, ืึทื–ื•ื™ ื•ื™ืกืžื™ื™ื“ืŸ ื ื™ืฆืŸ ืขืก.

ืื™ืŸ ืžื™ื™ืŸ ืžื™ื™ื ื•ื ื’, ืคึผืจืึธืคื™ืœ runtime/default ื‘ื™ืฉืœื™ื™ืžืขืก ืกื•ื˜ืึทื“ ืคึฟืึทืจ ื“ื™ ืฆื™ืœ ืคึฟืึทืจ ื•ื•ืึธืก ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืืฉืืคืŸ: ืคึผืจืึทื˜ืขืงื˜ื™ื ื’ ื•ืกืขืจืก ืคื•ืŸ ื“ื™ ืจื™ืกืงืก ืคึฟืึทืจื‘ื•ื ื“ืŸ ืžื™ื˜ ืขืงืกืึทืงื™ื•ื˜ื™ื ื’ ืึท ื‘ืึทืคึฟืขืœ docker run ืื•ื™ืฃ ื–ื™ื™ืขืจ ืงืึทืจืก. ืึธื‘ืขืจ, ื•ื•ืขืŸ ืขืก ืงื•ืžื˜ ืฆื• ื’ืขืฉืขืคื˜ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– ื•ื•ืึธืก ืœื•ื™ืคืŸ ืื•ื™ืฃ Kubernetes ืงืœืึทืกื˜ืขืจื–, ืื™ืš ื•ื•ืึธืœื˜ ืึทืจื•ื™ืกืคืึธื“ืขืจืŸ ืฆื• ื˜ืขื ื”ืŸ ืึทื– ืึทื–ืึท ืึท ืคึผืจืึธืคื™ืœ ืื™ื– ืฆื• ืึธืคืŸ ืื•ืŸ ื“ืขื•ื•ืขืœืึธืคึผืขืจืก ื–ืึธืœ ืคืึธืงื•ืก ืื•ื™ืฃ ืงืจื™ื™ื™ื˜ื™ื ื’ ืคึผืจืึธื•ืคื™ื™ืœื– ืคึฟืึทืจ ื–ื™ื™ืขืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื– (ืึธื“ืขืจ ื˜ื™ื™ืคึผืก ืคื•ืŸ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–).

ื˜ื™ืคึผ 3: ืฉืึทืคึฟืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืคึฟืึทืจ ืกืคึผืขืฆื™ืคื™ืฉ ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–. ืื•ื™ื‘ ื“ืึธืก ืื™ื– ื ื™ื˜ ืžืขื’ืœืขืš, ืฉืึทืคึฟืŸ ืคึผืจืึธื•ืคื™ื™ืœื– ืคึฟืึทืจ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื˜ื™ื™ืคึผืก, ืœืžืฉืœ, ืฉืึทืคึฟืŸ ืึท ืึทื•ื•ืึทื ืกื™ืจื˜ืข ืคึผืจืึธืคื™ืœ ื•ื•ืึธืก ื›ื•ืœืœ ืึทืœืข ื“ื™ ื•ื•ืขื‘ ืึทืคึผื™ืก ืคื•ืŸ ื“ื™ Golang ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ. ื ืึธืจ ื ื•ืฆืŸ ืจื•ื ื˜ื™ืžืข / ืคืขืœื™ืงื™ื™ึทื˜ ื•ื•ื™ ืึท ืœืขืฆื˜ืข ืจื™ื–ืึธืจื˜.

ืื™ืŸ ืฆื•ืงื•ื ืคึฟื˜ ืึทืจื˜ื™ืงืœืขืŸ, ืื™ืš ื•ื•ืขื˜ ื“ืขืงืŸ ื•ื•ื™ ืฆื• ืฉืึทืคึฟืŸ SecDevOps-ื™ื ืกืคึผื™ื™ืขืจื“ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื–, ืึธื˜ืึทืžื™ื™ื˜ ื–ื™ื™ ืื•ืŸ ืคึผืจื•ื‘ื™ืจืŸ ื–ื™ื™ ืื™ืŸ ืคึผื™ื™ืคึผืœื™ื™ื ื–. ืื™ืŸ ืื ื“ืขืจืข ื•ื•ืขืจื˜ืขืจ, ืื™ืจ ื•ื•ืขื˜ ื”ืึธื‘ืŸ ืงื™ื™ืŸ ืึทื ื˜ืฉื•ืœื“ื™ืงืŸ ื ื™ืฉื˜ ืฆื• ืึทืคึผื’ืจื™ื™ื“ ืฆื• ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ-ืกืคึผืขืฆื™ืคื™ืฉ ืคึผืจืึธื•ืคื™ื™ืœื–.

4. ื•ื ืงืึธื ืคื™ื ืขื“ ืื™ื– ื ื™ืฉื˜ ืึทืŸ ืึธืคึผืฆื™ืข.

ืคื•ืŸ ืขืจืฉื˜ืขืจ Kubernetes ื–ื™ื›ืขืจื”ื™ื™ื˜ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืขืก ืคืืจืงืขืจื˜ ืื•ื™ืก ืึทื– ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜ ืกืขืงืงืึธืžืคึผ ืคืึทืจืงืจื™ืคึผืœื˜. ื“ืขื ืžื™ื˜ืœ ืึทื– ืื•ื™ื‘ ืื™ืจ ื˜ืึธืŸ ื ื™ื˜ ืฉื˜ืขืœืŸ PodSecurityPolicy, ื•ื•ืึธืก ื•ื•ืขื˜ ื’ืขื‘ืŸ ืขืก ืื™ืŸ ื“ืขื ืงื ื•ื™ืœ, ืึทืœืข ืคึผืึธื“ืก ืคึฟืึทืจ ื•ื•ืึธืก ื“ื™ ืกืขืงืึธืžืคึผ ืคึผืจืึธืคื™ืœ ืื™ื– ื ื™ืฉื˜ ื“ื™ืคื™ื™ื ื“ ื•ื•ืขื˜ ืึทืจื‘ืขื˜ืŸ ืื™ืŸ seccomp=unconfined.

ืึทืคึผืขืจื™ื™ื˜ื™ื ื’ ืื™ืŸ ื“ืขื ืžืึธื“ืข ืžื™ื˜ืœ ืึทื– ืึท ื’ืึทื ืฅ ืฉื™ื›ื˜ืข ืคื•ืŸ โ€‹โ€‹ื™ื ืกืึทืœื™ื™ืฉืึทืŸ ืื™ื– ืคืึทืจืคืึทืœืŸ ื•ื•ืึธืก ืคึผืจืึทื˜ืขืงืฅ ื“ื™ ืงื ื•ื™ืœ. ื“ืขื ืฆื•ื’ืึทื ื’ ืื™ื– ื ื™ืฉื˜ ืจืขืงืึทืžืขื ื“ื™ื“ ื“ื•ืจืš ื–ื™ื›ืขืจื”ื™ื™ื˜ ืขืงืกืคึผืขืจืฅ.

ื˜ื™ืคึผ 4: ืงื™ื™ืŸ ืงืึทื ื˜ื™ื™ื ืขืจ ืื™ืŸ ื“ืขื ืงื ื•ื™ืœ ื–ืึธืœ ื–ื™ื™ืŸ ืคืœื™ืกื ื“ื™ืง ืื™ืŸ seccomp=unconfined, ืกืคึผืขืฆื™ืขืœ ืื™ืŸ ืคึผืจืึธื“ื•ืงืฆื™ืข ื™ื ื•ื•ื™ื™ืจืึทื ืžืึทื ืฅ.

5. "ืื•ื“ื™ื˜ ืžืึธื“ืข"

ื“ืขืจ ืคื•ื ื˜ ืื™ื– ื ื™ืฉื˜ ื™ื™ื ืฆื™ืง ืฆื• Kubernetes, ืึธื‘ืขืจ ื ืึธืš ืคืืœืŸ ืื™ืŸ ื“ื™ ืงืึทื˜ืขื’ืึธืจื™ืข "ื˜ื™ื ื’ื– ืฆื• ื•ื•ื™ืกืŸ ืื™ื™ื“ืขืจ ืื™ืจ ืึธื ื”ื™ื™ื‘ืŸ".

ื•ื•ื™ ืขืก ื›ืึทืคึผืึทื ื–, ืฉืืคืŸ ืกืขืงืึธืžืคึผ ืคึผืจืึธื•ืคื™ื™ืœื– ืื™ื– ืฉื˜ืขื ื“ื™ืง ื’ืขื•ื•ืขืŸ ื˜ืฉืึทืœืึทื ื“ื–ืฉื™ื ื’ ืื•ืŸ ืจื™ืœื™ื™ื– ืฉื•ื•ืขืจ ืื•ื™ืฃ ืคึผืจืึธืฆืขืก ืื•ืŸ ื˜ืขื•ืช. ื“ืขืจ ืคืึทืงื˜ ืื™ื– ืึทื– ื™ื•ื–ืขืจื– ืคืฉื•ื˜ ื”ืึธื‘ืŸ ื ื™ืฉื˜ ื“ื™ ื’ืขืœืขื’ื ื”ื™ื™ื˜ ืฆื• ืคึผืจื•ื‘ื™ืจืŸ ื–ื™ื™ ืื™ืŸ ืคึผืจืึธื“ื•ืงืฆื™ืข ื™ื ื•ื•ื™ื™ืจืึทื ืžืึทื ืฅ ืึธืŸ ืจื™ื–ื™ืงื™ืจืŸ "ื“ืจืึทืคึผื™ื ื’" ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ.

ื ืึธืš ื“ื™ ืžืขืœื“ื•ื ื’ ืคื•ืŸ ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ 4.14, ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืžืขื’ืœืขืš ืฆื• ืœื•ื™ืคืŸ ืคึผืึทืจืฅ ืคื•ืŸ ืึท ืคึผืจืึธืคื™ืœ ืื™ืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืžืึธื“ืข, ืจืขืงืึธืจื“ื™ื ื’ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ืึทืœืข ืกื™ืกื˜ืขื ืจื•ืคื˜ ืื™ืŸ ืกื™ืกืœืึธื’, ืึธื‘ืขืจ ืึธืŸ ื‘ืœืึทืงื™ื ื’ ื–ื™ื™. ืื™ืจ ืงืขื ืขืŸ ืึทืงื˜ืึทื•ื•ื™ื™ื˜ ื“ืขื ืžืึธื“ืข ืžื™ื˜ ื“ืขื ืคึผืึทืจืึทืžืขื˜ืขืจ SCMT_ACT_LOG:

SCMP_ACT_LOG: seccomp ื•ื•ืขื˜ ื ื™ืฉื˜ ื•ื•ื™ืจืงืŸ ื“ื™ ืคืึธื“ืขื ื•ื•ืึธืก ืžืึทื›ืŸ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ืื•ื™ื‘ ืขืก ืฉื˜ื™ืžืขืŸ ื ื™ืฉื˜ ืฆื• ืงื™ื™ืŸ ื”ืขืจืฉืŸ ืื™ืŸ ื“ื™ ืคื™ืœื˜ืขืจ, ืึธื‘ืขืจ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ื“ื™ ืกื™ืกื˜ืขื ืจื•ืคืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืœืึธื’ื“.

ื“ืึธ ืื™ื– ืึท ื˜ื™ืคึผื™ืฉ ืกื˜ืจืึทื˜ืขื’ื™ืข ืคึฟืึทืจ ื ื™ืฆืŸ ื“ืขื ืฉื˜ืจื™ืš:

  1. ืœืึธื–ืŸ ืกื™ืกื˜ืขื ืจื•ืคื˜ ื•ื•ืึธืก ื–ืขื ืขืŸ ื“ืืจืฃ.
  2. ืคืึทืจืฉืคึผืึทืจืŸ ืงืึทืœืœืก ืคื•ืŸ ื“ื™ ืกื™ืกื˜ืขื ื•ื•ืึธืก ืื™ืจ ื•ื•ื™ืกืŸ ื•ื•ืขื˜ ื ื™ืฉื˜ ื–ื™ื™ืŸ ื ื•ืฆื™ืง.
  3. ืจืขืงืึธืจื“ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ื•ื•ืขื’ืŸ ืึทืœืข ืื ื“ืขืจืข ืงืึทืœืœืก ืื™ืŸ ื“ื™ ืงืœืึธืฅ.

ื ืกื™ืžืคึผืœืึทืคื™ื™ื“ ื‘ื™ื™ึทืฉืคึผื™ืœ ืงื•ืงื˜ ื•ื•ื™ ื“ืึธืก:

{
    "defaultAction": "SCMP_ACT_LOG",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "arch_prctl",
                "sched_yield",
                "futex",
                "write",
                "mmap",
                "exit_group",
                "madvise",
                "rt_sigprocmask",
                "getpid",
                "gettid",
                "tgkill",
                "rt_sigaction",
                "read",
                "getpgrp"
            ],
            "action": "SCMP_ACT_ALLOW"
        },
        {
            "names": [
                "add_key",
                "keyctl",
                "ptrace"
            ],
            "action": "SCMP_ACT_ERRNO"
        }
    ]
}

(ืžื™ื˜ืœ-ื’ืขืžื™ืฉื˜-secomp.json)

ืึธื‘ืขืจ ื’ืขื“ืขื ืงื˜ ืึทื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ืึทืœืข ืงืึทืœืœืก ื•ื•ืึธืก ืื™ืจ ื•ื•ื™ืกืŸ ื•ื•ืขื˜ ื ื™ืฉื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ืื•ืŸ ื•ื•ืึธืก ืงืขืŸ ืคึผืึทื˜ืขื ื˜ืฉืึทืœื™ ืฉืึทื˜ืŸ ื“ืขื ืงื ื•ื™ืœ. ื ื’ื•ื˜ืข ื™ืงืขืจ ืคึฟืึทืจ ืงืึทืžืคึผื™ื™ืœื™ื ื’ ืึท ืจืฉื™ืžื” ืื™ื– ื“ืขืจ ื‘ืึทืึทืžื˜ืขืจ ื“ืึธืงืงืขืจ ื“ืึทืงื™ื•ืžืขื ื˜ื™ื™ืฉืึทืŸ. ืขืก ื“ืขืจืงืœืขืจื˜ ืื™ืŸ ื“ืขื˜ืึทืœ ื•ื•ืึธืก ืกื™ืกื˜ืขื ืจื•ืคื˜ ื–ืขื ืขืŸ ืืคื’ืขืฉื˜ืขืœื˜ ืื™ืŸ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ืคึผืจืึธืคื™ืœ ืื•ืŸ ื•ื•ืึธืก.

ืึธื‘ืขืจ, ืขืก ืื™ื– ืื™ื™ืŸ ื›ืึทืคึผืŸ. ื›ืึธื˜ืฉ SCMT_ACT_LOG ื’ืขืฉื˜ื™ืฆื˜ ื“ื•ืจืš ื“ื™ ืœื™ื ื•ืงืก ืงืขืจืŸ ื–ื™ื ื˜ ื“ืขื ืกื•ืฃ ืคื•ืŸ 2017, ืขืก ืื™ื– ื‘ืœื•ื™ื– ืœืขืคื™ืขืจืขืš ืœืขืฆื˜ื ืก ืืจื™ื™ืŸ ืื™ืŸ ื“ื™ Kubernetes ื™ืงืึธื•ืกื™ืกื˜ืึทื. ื“ืขืจื™ื‘ืขืจ, ืฆื• ื ื•ืฆืŸ ื“ืขื ืื•ืคึฟืŸ ืื™ืจ ื•ื•ืขื˜ ื“ืึทืจืคึฟืŸ ืึท ืœื™ื ื•ืงืก ืงืขืจืŸ 4.14 ืื•ืŸ runC ื•ื•ืขืจืกื™ืข ื ื™ื˜ ื ื™ื“ืขืจื™ืงืขืจ v1.0.0-rc9.

ื˜ื™ืคึผ 5: ืึท ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืžืึธื“ืข ืคึผืจืึธืคื™ืœ ืคึฟืึทืจ ื˜ืขืกื˜ื™ื ื’ ืื™ืŸ ืคึผืจืึธื“ื•ืงืฆื™ืข ืงืขื ืขืŸ ื–ื™ื™ืŸ ื‘ืืฉืืคืŸ ื“ื•ืจืš ืงืึทืžื‘ื™ื™ื ื™ื ื’ ืฉื•ื•ืึทืจืฅ ืื•ืŸ ื•ื•ื™ื™ึทืก ืจืฉื™ืžื•ืช, ืื•ืŸ ืึทืœืข ืื•ื™ืกื ืขืžืขืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืœืึธื’ื“.

6. ื ื™ืฆืŸ ื•ื•ื”ื™ื˜ืขืœื™ืกืฅ

ื•ื•ื”ื™ื˜ืขืœื™ืกื˜ื™ื ื’ ืจื™ืงื•ื•ื™ื™ืขืจื– ื ืึธืš ืžื™ ื•ื•ื™ื™ึทืœ ืื™ืจ ื”ืึธื‘ืŸ ืฆื• ื™ื“ืขื ื˜ื™ืคื™ืฆื™ืจืŸ ื™ืขื“ืขืจ ืจื•ืคืŸ ื•ื•ืึธืก ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืงืขืŸ ื“ืึทืจืคึฟืŸ, ืึธื‘ืขืจ ื“ืขืจ ืฆื•ื’ืึทื ื’ ื™ืžืคึผืจื•ื•ื•ื– ื–ื™ื›ืขืจื”ื™ื™ื˜:

ืขืก ืื™ื– ื”ืขื›ืกื˜ ืจืขืงืึทืžืขื ื“ื™ื“ ืฆื• ื ื•ืฆืŸ ื“ื™ ื•ื•ื™ื™ื˜ืœื™ืกื˜ ืฆื•ื’ืึทื ื’ ื•ื•ื™ื™ึทืœ ืขืก ืื™ื– ืกื™ืžืคึผืœืขืจ ืื•ืŸ ืžืขืจ ืคืึทืจืœืึธื–ืœืขืš. ื“ื™ ื‘ืœืึทืงืœื™ืกื˜ ื•ื•ืขื˜ ื–ื™ื™ืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื˜ ื•ื•ืขืŸ ืึท ืคึผืึทื˜ืขื ื˜ืฉืึทืœื™ ื’ืขืคืขืจืœืขืš ืกื™ืกื˜ืขื ืจื•ืคืŸ (ืึธื“ืขืจ ืึท ื’ืขืคืขืจืœืขืš ืคืึธืŸ / ืึธืคึผืฆื™ืข ืื•ื™ื‘ ืขืก ืื™ื– ืื•ื™ืฃ ื“ื™ ื‘ืœืึทืงืœื™ืกื˜) ืื™ื– ืฆื•ื’ืขื’ืขื‘ืŸ. ืื™ืŸ ื“ืขืจืฆื•, ืขืก ืื™ื– ืึธืคื˜ ืžืขื’ืœืขืš ืฆื• ื˜ื•ื™ืฉืŸ ื“ื™ ืคืึทืจื˜ืจืขื˜ื•ื ื’ ืคื•ืŸ ืึท ืคึผืึทืจืึทืžืขื˜ืขืจ ืึธืŸ ื˜ืฉืึทื ื’ื™ื ื’ ื–ื™ื™ึทืŸ ืขืกืึทื ืก ืื•ืŸ ื“ืขืจืžื™ื˜ ื‘ื™ื™ืคึผืึทืก ื“ื™ ืจื™ืกื˜ืจื™ืงืฉืึทื ื– ืคื•ืŸ ื“ื™ ื‘ืœืึทืงืœื™ืกื˜.

ืคึฟืึทืจ Go ืึทืคึผืœืึทืงื™ื™ืฉืึทื ื–, ืื™ืš ื“ืขื•ื•ืขืœืึธืคึผืขื“ ืึท ืกืคึผืขืฆื™ืขืœ ื’ืขืฆื™ื™ึทื’ ื•ื•ืึธืก ืึทืงืึทืžืคึผืึทื ื™ื– ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ืื•ืŸ ืงืึทืœืขืงืฅ ืึทืœืข ืงืึทืœืœืก ื‘ืขืฉืึทืก ื“ื•ืจื›ืคื™ืจื•ื ื’. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืคึฟืึทืจ ื“ื™ ืคืืœื’ืขื ื“ืข ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ:

package main

import "fmt"

func main() {
	fmt.Println("test")
}

... ืœืึธื–ืŸ ืก ืงืึทื˜ืขืจ gosystract ืึทื–ื•ื™:

go install https://github.com/pjbgf/gosystract
gosystract --template='{{- range . }}{{printf ""%s",n" .Name}}{{- end}}' application-path

... ืื•ืŸ ืžื™ืจ ื‘ืึทืงื•ืžืขืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืจืขื–ื•ืœื˜ืึทื˜:

"sched_yield",
"futex",
"write",
"mmap",
"exit_group",
"madvise",
"rt_sigprocmask",
"getpid",
"gettid",
"tgkill",
"rt_sigaction",
"read",
"getpgrp",
"arch_prctl",

ืื™ืฆื˜, ื“ืึธืก ืื™ื– ื‘ืœื•ื™ื– ืึท ื‘ื™ื™ืฉืคึผื™ืœ - ืžืขืจ ื“ืขื˜ืึทื™ืœืก ื•ื•ืขื’ืŸ ื“ื™ ืžื›ืฉื™ืจื™ื ื•ื•ืขื˜ ื ืึธื›ืคืึธืœื’ืŸ.

ื˜ื™ืคึผ 6: ืœืึธื–ืŸ ื‘ืœื•ื™ื– ื“ื™ ืจื•ืคื˜ ื•ื•ืึธืก ืื™ืจ ื˜ืึทืงืข ื“ืึทืจืคึฟืŸ ืื•ืŸ ืคืึทืจืฉืคึผืึทืจืŸ ืึทืœืข ืื ื“ืขืจืข.

7. ืœื™ื™ื’ืŸ ื“ื™ ืจืขื›ื˜ ื™ืกื•ื“ื•ืช (ืึธื“ืขืจ ืฆื•ื’ืจื™ื™ื˜ืŸ ืคึฟืึทืจ ืื•ืžื’ืขืจื™ื›ื˜ ื ืึทื˜ื•ืจ)

ื“ืขืจ ืงืขืจืŸ ื•ื•ืขื˜ ื“ื•ืจื›ืคื™ืจืŸ ื“ืขื ืคึผืจืึธืคื™ืœ ืจืึทื’ืึทืจื“ืœืึทืก ืคื•ืŸ ื•ื•ืึธืก ืื™ืจ ืฉืจื™ื™ึทื‘ืŸ ืื™ืŸ ืขืก. ืืคื™ืœื• ืื•ื™ื‘ ืขืก ืื™ื– ื ื™ืฉื˜ ืคึผื•ื ืงื˜ ื•ื•ืึธืก ืื™ืจ ื•ื•ื™ืœื˜. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื•ื™ื‘ ืื™ืจ ืคืึทืจืฉืคึผืึทืจืŸ ืึทืงืกืขืก ืฆื• ืงืึทืœืœืก ื•ื•ื™ exit ืึธื“ืขืจ exit_group, ื“ืขืจ ืงืึทื ื˜ื™ื™ื ืขืจ ื•ื•ืขื˜ ื ื™ืฉื˜ ืงืขื ืขืŸ ืฆื• ืคืึทืจืžืึทื›ืŸ ืึทืจืึธืคึผ ืจื™ื›ื˜ื™ืง ืื•ืŸ ืืคื™ืœื• ืึท ืคึผืฉื•ื˜ ื‘ืึทืคึฟืขืœ ื•ื•ื™ echo hi ื”ืขื ื’ืขืŸ ืื™ื ืื•ื™ืฃืึธ ืคึฟืึทืจ ืึท ื™ื ื“ืขืคืึทื ืึทื˜ ืฆื™ื™ึทื˜. ื•ื•ื™ ืึท ืจืขื–ื•ืœื˜ืึทื˜, ืื™ืจ ื•ื•ืขื˜ ื‘ืึทืงื•ืžืขืŸ ื”ื•ื™ืš ืงืคึผื• ื‘ืึทื ื™ืฅ ืื™ืŸ ื“ืขื ืงื ื•ื™ืœ:

Secomp in Kubernetes: 7 ื˜ื™ื ื’ื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื•ื•ื™ืกืŸ ืคึฟื•ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘

ืื™ืŸ ืึทื–ืึท ืงืึทืกืขืก, ืึท ื ื•ืฆืŸ ืงืขื ืขืŸ ืงื•ืžืขืŸ ืฆื• ืจืึทื˜ืขื•ื•ืขืŸ strace - ืขืก ื•ื•ืขื˜ ื•ื•ื™ื™ึทื–ืŸ ื•ื•ืึธืก ื“ื™ ืคึผืจืึธื‘ืœืขื ืงืขืŸ ื–ื™ื™ืŸ:

Secomp in Kubernetes: 7 ื˜ื™ื ื’ื– ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื•ื•ื™ืกืŸ ืคึฟื•ืŸ ื“ื™ ืึธื ื”ื™ื™ื‘
sudo strace -c -p 9331

ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ื“ื™ ืคึผืจืึธื•ืคื™ื™ืœื– ืึทื ื˜ื”ืึทืœื˜ืŸ ืึทืœืข ื“ื™ ืกื™ืกื˜ืขื ืงืึทืœืœืก ื•ื•ืึธืก ื“ื™ ืึทืคึผืœืึทืงื™ื™ืฉืึทืŸ ื“ืึทืจืฃ ืื™ืŸ ืจื•ื ื˜ื™ืžืข.

ื˜ื™ืคึผ 7: ื‘ืึทืฆืึธืœืŸ ื•ืคืžืขืจืงื–ืึทืžืงื™ื™ื˜ ืฆื• ื“ืขื˜ืึทืœ ืื•ืŸ ืžืึทื›ืŸ ื–ื™ื›ืขืจ ืึทื– ืึทืœืข ื ื™ื™ื˜ื™ืง ืกื™ืกื˜ืขื ืงืึทืœืœืก ื–ืขื ืขืŸ ื•ื•ื™ื™ื˜ืœื™ืกื˜ืขื“.

ื“ืึธืก ืขื ื“ื™ืงื˜ ื“ืขืจ ืขืจืฉื˜ืขืจ ื˜ื™ื™ืœ ืคื•ืŸ ืึท ืกืขืจื™ืข ืคื•ืŸ โ€‹โ€‹โ€‹โ€‹ืึทืจื˜ื™ืงืœืขืŸ ื•ื•ืขื’ืŸ ื ื™ืฆืŸ ืกืขืงืึธืžืคึผ ืื™ืŸ Kubernetes ืื™ืŸ ื“ื™ ื’ื™ื™ืกื˜ ืคื•ืŸ SecDevOps. ืื™ืŸ ื“ื™ ืคืืœื’ืขื ื“ืข ืคึผืึทืจืฅ ืžื™ืจ ื•ื•ืขืœืŸ ืจืขื“ืŸ ื•ื•ืขื’ืŸ ื•ื•ืึธืก ื“ืึธืก ืื™ื– ื•ื•ื™ื›ื˜ื™ืง ืื•ืŸ ื•ื•ื™ ืฆื• ืึธื˜ืึทืžื™ื™ื˜ ื“ืขื ืคึผืจืึธืฆืขืก.

ืคึผืก ืคื•ืŸ ืื™ื‘ืขืจื–ืขืฆืขืจ

ืœื™ื™ืขื ืขืŸ ืื•ื™ืš ืื•ื™ืฃ ืื•ื ื“ื–ืขืจ ื‘ืœืึธื’:

ืžืงื•ืจ: www.habr.com

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’