1 of 25

Unprivileged Containers

Jess Frazelle, @jessfraz

2 of 25

How do containers help security?

Containers are not going to be the answer to preventing your application from being compromised, but they can limit the damage from a compromise.

3 of 25

How do containers help security?

The world an attacker might see from inside a very strict container with custom AppArmor/Seccomp profiles greatly differs than that without the use of containers.

4 of 25

Sandboxes Today

5 of 25

​

Chrome

  • Seccomp
  • Namespaces
  • Apparmor
  • NOT RUN AS ROOT

6 of 25

Containers today

  • Namespaces
  • Apparmor
  • Selinux
  • Capabilities Limiting
  • Cgroups
  • Run as root :(

7 of 25

How can we get to sandboxes with containers?

8 of 25

Back to the Basics

A “container” is what we have come to call a group of namespaces and control groups applied to a process.

9 of 25

Control Groups (cgroups)

Limit what the process can use. Resource metering and limiting.

Types: memory, CPU, blkio, network, device, pid..

10 of 25

PID Cgroup

11 of 25

Namespaces

Limit what the process sees.

Types: pid, net, mnt, uts, ipc, user

Created with clone() or unshare()

12 of 25

Net Namespace

13 of 25

UTS Namespace

14 of 25

IPC Namespace

15 of 25

PID Namespace

16 of 25

User Namespace

17 of 25

Makings of a Sandbox: Containers

  • Namespaces
  • Apparmor
  • Selinux
  • Capabilities Limiting
  • Cgroups

NOT RUN AS ROOT

18 of 25

POC or GTFO

19 of 25

POC or GTFO

20 of 25

What is this sorcery?

  • User namespaces can be created without root.
  • But only if the {uid,gid}_map is mapped to the current user creating the namespace.

21 of 25

Not Perfect …. yet

  • Cgroups devices cannot be created without CAP_SYS_ADMIN

22 of 25

New Hotness: Cgroup Namespace

  • In Kernels 4.6+, not yet released, on RC5 currently
  • False prophet to solve all the problems, but maybe in the future.

23 of 25

Cgroup Namespace

24 of 25

What to look forward to...

  • Containers in a multi-tenant environment not run as root.
  • Sane defaults with the ability to customize for a sandbox experience.
  • Better designed user experiences for dealing with security policies.

25 of 25

Resources

https://github.com/docker/docker/issues/17142

http://www.sysdig.org/falco/

​