Seccomp: a powerful security tool

Seccomp, short for Secure Computing Mode, is a built-in security feature in the Linux kernel that empowers admins and developers to limit the system calls processes can make. Introduced in Linux kernel 2.6.12 in 2005, it was designed to reduce attack surfaces and minimize damage from compromised processes. This became increasingly relevant with the rise of diverse computing environments and the need to safely execute untrusted programs.

Seccomp essentially places processes in a restricted state, allowing them to invoke only a predefined set of “safe” system calls. This set is defined in a customizable seccomp profile, specifying which calls are permitted and denied. If a process tries to use an unauthorized call, the kernel intervenes, potentially terminating the process, returning an error, or logging the event. This significantly curtails an attacker’s ability to harm the system, even if they compromise a process or container.

Growing security needs have fueled the evolution of Seccomp. Initially, it only offered an inflexible “block or allow” mode. The introduction of the “filter mode” using BPF (Berkeley Packet Filter) in Linux kernel version 3.5 enabled filtering and fine-tuning of security policies. Today, seccomp goes beyond Linux and Kubernetes. It is used in web browsers like Chrome and Firefox to sandbox their rendering engines, highlighting its importance in securing systems against malicious code.

Seccomp in Kubernetes

In Kubernetes, seccomp plays a vital role in protecting nodes against malicious code execution. It serves as an additional defense mechanism, shielding the host (node) from unauthorized code. Attackers might gain code execution within a Kubernetes workload in two ways:

1. Exploiting vulnerabilities: Attackers can find and leverage configuration flaws or vulnerabilities in applications or underlying components to gain unauthorized control remotely. Once a vulnerability is exploited, they can potentially execute malicious code, posing a threat to the host.
2. Compromised supply chain: An attacker might trick the operator or the system into running a container image infected with malicious code. This kind of attack bypasses initial security checks and infiltrates the system disguised as a legitimate image.

In both scenarios, seccomp profiles offer an additional and crucial layer of protection. If malicious code attempts to use a system call not part of its allowed set, seccomp can effectively block it. This is essential because a successful escape from the container’s sandbox could grant access to the host filesystem, exposing secrets and elevating privileges. Such access could lead to further exploitation, like accessing sensitive data or manipulating Kubernetes resources, potentially giving attackers control over the entire cluster.

Enabling Seccomp in Kubernetes 

Kubernetes integrated seccomp as a general feature in version 1.19.0. There are two ways to enable it for workloads:

Pre-made Seccomp Profiles: Kubernetes allows applying ready-made profiles through the SecurityContext of a pod or container. A common example is the RuntimeDefault profile, which uses the container runtime’s default profile. While convenient, these profiles are not tailored to specific needs. They could potentially block necessary calls or, on the other hand, not be restrictive enough.

Custom Seccomp Profiles: For greater control, Kubernetes supports creating and referencing custom profiles in the SecurityContext. These offer fine-grained security measures, allowing for inclusion or exclusion of specific system calls based on application requirements. However, creating and maintaining these profiles requires a deep understanding of the application’s system call needs. As a result, they can be more complex to create.

Conclusion

Seccomp is a valuable tool in the ongoing job of securing Kubernetes. By controlling the system calls containers can execute, it minimizes potential attack surfaces and buys time for admins and developers to identify and fix vulnerabilities. This ultimately enhances the overall security posture of the Kubernetes environment. Want to take a deeper dive into how seccomp works? Stay tuned. Our future posts will do just that.

Actionable, contextual, end-to-end
{Kubernetes-native security}

From code to cluster, helm to node, we’ve got your Kubernetes covered:

Cut the CVE noise by significantly reducing CVE-related work by over 90%

Automatic Kubernetes compliance for CIS, NSA, Mitre, SOC2, PCI, and more

Manage Kubernetes role-based-access control (RBAC) visually

The post Enhancing Kubernetes Security with Seccomp profiles appeared first on ARMO.

*** This is a Security Bloggers Network syndicated blog from ARMO authored by Ben Hirschberg. Read the original post at: https://www.armosec.io/blog/kubernetes-security-with-seccomp-profiles/