What have syscalls done for you lately?

DockerCon EU - Black Belt track

What are syscalls, and how can you use knowledge of syscalls to help secure your containers?

Transcript

1. What have syscalls done for you lately? Liz Rice @lizrice Aqua Security
2. Agenda • What are syscalls? • Syscalls, seccomp & containers • Shellshock exploit
3. What is a syscall?
5. When do you need syscalls? • Files • Devices • Processes • Communications • Time & date And creating containers
6. Let’s see some syscalls strace Using strace
7. How do you make a syscall? Language-specific library • C - libc • Golang - syscall package func Write(fd int, p []byte) (n int, err error)
9. ~ 330 of them Syscall codes
10. syscall() saves CPU registers before making the system call, restores the registers upon return from the system call, and stores any error code returned by the system call in errno(3) if an error occurs. Making a syscall
11. Syscall parameters x86 64 table from blog.rchapman.org
12. ENTRY (syscall) movq %rdi, %rax /* Syscall number -> rax. */ movq %rsi, %rdi /* shift arg1 - arg5. */ movq %rdx, %rsi movq %rcx, %rdx movq %r8, %r10 movq %r9, %r8 movq 8(%rsp),%r9 /* arg6 is on the stack. */ Syscall /* Do the system call. */ cmpq $-4095, %rax /* Check %rax for error. */ jae SYSCALL_ERROR_LABEL /* Jump to error handler if error. */ Ret /* Return to caller. */ PSEUDO_END (syscall) Syscall in assembler GNU C library
13. Transition to kernel • Execute in privileged mode • Look up kernel code to run ◦ syscall code from %rax
14. Portability Different CPUs, same approach
15. vDSO • Avoid expensive kernel transitions • Architecture-specific • Typical: get time, CPU strace(1) and the vDSO When tracing systems calls with strace(1), symbols (system calls) that are exported by the vDSO will not appear in the trace output.
16. Syscalls and seccomp
17. Seccomp { "defaultAction": "SCMP_ACT_ERRNO", "architectures": [ "SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], "syscalls": [ { "name": "accept", "action": "SCMP_ACT_ALLOW", "args": [] }, { "name": "accept4", "action": "SCMP_ACT_ALLOW", "args": [] Restrict the syscalls a process can use
18. Seccomp ... { "names": [ "reboot" ], "action": "SCMP_ACT_ALLOW", "args": [], "comment": "", "includes": { "caps": [ "CAP_SYS_BOOT" ] }, "excludes": {} }, ... Can I reboot the host?
19. Stracing Docker containers
20. Share PID namespace docker run -it --pid=container:<target> \ --cap-add sys_ptrace <image_w_strace> /bin/bash
21. So you’ve got your syscalls • Creating a seccomp profile • Portability? ◦ Kernel / architecture
22. AppArmor (Not specifically to do with syscalls)
23. AppArmor profiles Define what a program can do • File access (read, write, execute…) • Capabilities • Network access • ...
24. Generating AppArmor profiles • aa-autodep - blank profile • aa-complain - Generate logs • aa-logprof - Review logs • Manual edits? • Zzzzzzzzz
25. #include <tunables/global> /usr/sbin/nginx { #include <abstractions/apache2-common> #include <abstractions/base> #include <abstractions/nis> capability dac_override, capability dac_read_search, capability net_bind_service, capability setgid, capability setuid, /data/www/safe/* r, deny /data/www/unsafe/* r, /etc/group r, /etc/nginx/conf.d/ r, /etc/nginx/mime.types r, /etc/nginx/nginx.conf r, /etc/nsswitch.conf r, /etc/passwd r, /etc/ssl/openssl.cnf r, /run/nginx.pid rw, /usr/sbin/nginx mr, /var/log/nginx/access.log w, /var/log/nginx/error.log w, } Typical profile
26. Container AppArmor profiles • Generate profile on host • Or install apparmor inside container ◦ Requires --security-opt apparmor:unconfined --cap-add sys_admin
27. Runtime profiles are HARD
28. But... • Can stop unexpected behaviour • Microservice behaviour is easier to reason about Powerful with good tooling
29. Shellshock example
30. Runtime profile tools
31. Recap & more info • How syscalls work ◦ Tycho’s kernel talk • Runtime profiles ◦ Powerful in theory, hard in practice • More on strace ◦ Julia Evans strace-zine ◦ github.com/lizrice/strace-from-scratch
32. Thank you Come say hi at Booth G10 @lizrice | @aquasecteam