Easier container security with entitlements [LWN.net]

Easier container security with entitlements

Posted May 24, 2018 23:12 UTC (Thu) by simcop2387 (subscriber, #101710)
Parent article: Easier container security with entitlements

For seccomp I've actually been writing my own sandbox, it's still in progress but is pretty usable (by me). It's definitely more complicated than the JSON files I've seen from Kubernetes and Docker. It's using YAML and some custom stuff to handle constant values (things like O_APPEND, etc.).

You can get a high level overview of it from https://metacpan.org/pod/App::EvalServerAdvanced::Seccomp

It ends up setting up several namespaces (PID, SHM, mount, etc.), drops all capabilities, and then sets up seccomp as a whitelist for allowed syscalls. There's still more I could do to with apparmor or selinux but they haven't seemed necessary for my particular use.

to post comments

Easier container security with entitlements

Posted May 25, 2018 12:50 UTC (Fri) by zyga (subscriber, #81533) [Link] (2 responses)

Snapd ships a complement of tools that (while tailored to snapd) should be useful as a base for other tools or as inspiration. We have a stand-alone seccomp profile compiler, support for argument filtering and loading.

Easier container security with entitlements

Posted May 25, 2018 20:31 UTC (Fri) by simcop2387 (subscriber, #101710) [Link] (1 responses)

Definitely going to look at that. I've taken some inspiration from docker and a few other places but the tools from them aren't completely applicable since with my use-case I want quick to build ephemeral containers (every command gets a new container/sandbox and they're all completely discarded after execution).

I hadn't thought to look at what snapd and such were doing, since they've got a similar use-case (though maybe not in the complete discarding of all data/records of execution).

Easier container security with entitlements

Posted May 26, 2018 6:50 UTC (Sat) by zyga (subscriber, #81533) [Link]

Have a look at github.com/snapcore/snapd, inside the most interesting aspect would be cmd/snap-confine/*.[ch]. This is the code that arranges the sandbox. It works in tandem with other tools, specifically it consumes output of cmd/snap-seccomp (a seccomp profile compiler) and of the whole interfaces/* tree where the code there creates profiles for apparmor, seccomp, and for device cgroups. One last interesting tool is cmd/snap-update-ns/* which can modify a mount namespace in-place, figuring out what needs to change vs what is there already. Let me know if you find any issues or have questions about the design.