Upgrade to Pro — share decks privately, control downloads, hide ads and more …

container-seccomp

 container-seccomp

2022/03/09 OCHaCafe5 #3 Kubernetes のセキュリティ
コンテナセキュリティにおける権限制御
〜Seccompとかよくわからんけどとりあえずこれくらいはやっておこう〜

セッション動画
https://ochacafe.connpass.com/event/238355/

mochizuki875

March 09, 2022
Tweet

More Decks by mochizuki875

Other Decks in Technology

Transcript

  1. ίϯςφͷִ཭ 04 ,FSOFM ίϯςφͷ࣮ଶ͸Χʔωϧ্Ͱ࣮ߦ͞ΕΔϓϩηεͰ͢ɻ ίϯςφʹ͋ͨΔϓϩηε͕Χʔωϧͷ༷࣋ͭʑͳػೳʹΑΓִ཭͞ΕΔ͜ͱͰɺίϯςφͱͯ͠ͷػೳ͕࣮ݱ͞Ε·͢ɻ 1SPDFTT SPPUGT 1SPDFTT SPPUGT 1SPDFTT

    SPPUGT ࣮ߦۭؒʢFY/BNFTQBDFɺQJWPU@SPPUʣ ɹϓϩηε͕ಈ࡞͢Δ؀ڥΛִ཭͔͋ͨ͠΋୯ମͰಈ͍͍ͯΔΑ͏ʹݟ͔͚ͤΔ Ϧιʔε࢖༻ྔʢFY$HSPVQʣ ɹϓϩηε͕࢖༻Ͱ͖ΔϦιʔεྔʢ$16 .FNPSZͳͲʣΛ੍ݶ͢Δ ݖݶʢޙड़ʣ ɹϓϩηεͷΧʔωϧʹର͢Δૢ࡞Λ੍ݶ͢Δ ίϯςφ
  2. ίϯςφʹ͓͚Δݖݶ੍ޚ ࣮ߦۭؒͷִ཭΍Ϧιʔε࢖༻ྔͷ੍ݶ͚ͩͰ͸ίϯςφϓϩηε͸04ʹର࣮ͯ͠ߦϢʔβʔ૬౰ͷݖݶΛ࣋ͭ͜ͱʹͳΓ·͢ɻ ˞ྫ͑͹ίϯςφΛಛʹҙࣝͤͣʹ࣮ߦͨ͠৔߹ɺίϯςφϓϩηε͸σϑΥϧτͷ࣮ߦϢʔβʔͰ͋ΔSPPUݖݶΛ࣋ͭ͜ͱʹͳΔ ίϯςφϓϩηε͕ա৒ͳݖݶΛ͍࣋ͬͯΔͱɺྫ͑͹ίϯςφͷִ཭؀ڥ͔Β֎෦ʹӨڹΛٴ΅͢ͱ͍ͬͨ ηΩϡϦςΟϦεΫʹܨ͕Γ·͢ɻʢFY$POUBJOFS#SFBL0VUʣ 04 ,FSOFM 1SPDFTT SPPUGT 1SPDFTT

    1SPDFTT SPPU VTFS SPPU 04ʹରͯ͠ ಛݖϢʔβʔ૬౰ͷ ͢΂ͷૢ࡞͕Մೳ 04ʹରͯ͠ ҰൠϢʔβʔ૬౰ͷ ૢ࡞͕Մೳ ʢຊ೔͸ѻΘͳ͍͚Ͳॏཁͳʣิ଍ ࣮ࡍͷͱ͜ΖίϯςφͰ͸ա౓ͳݖݶ͕ϓϩηεʹ෇༩͞ΕΔ͜ͱͷͳ͍Α͏ɺޙड़ͷ௨Γ༷ʑͳ࢓૊ΈΛ༻͍Δ͜ͱͰݖݶ੍ޚΛߦ͍ͬͯ·͢ɻ ͱ͸ݴ͑ίϯςφϓϩηε͕SPPUݖݶͰ࣮ߦ͞ΕΔ͜ͱ͸ҰൠతʹϦεΫͱΈͳ͞Ε͓ͯΓɺίϯςφ࣮ߦ࣌͸໌֬ʹඇಛݖϢʔβʔΛࢦఆ͢Δ͜ͱ͕ ϕετϓϥΫςΟεͱ͞Ε͍ͯ·͢ɻ 04ʹରͯ͠ ಛݖϢʔβʔ૬౰ͷ ͢΂ͷૢ࡞͕Մೳ ίϯςφʢݖݶ੍ޚͳ͠ʣ
  3. ίϯςφʹ͓͚Δݖݶ੍ޚ ͦ͜ͰίϯςφͰ͸-JOVYΧʔωϧͷ࣋ͭҎԼͷΑ͏ͳػೳΛ༻͍Δ͜ͱͰɺίϯςφϓϩηε͔ΒΧʔωϧʹର͢Δૢ࡞Λ੍ݶ ͢Δ࢓૊ΈΛ࠾༻͍ͯ͠·͢ɻ 3FBE0OMZ.PVOU $BQBCJMJUZ -4. "QQ"SNPS4&-JOVY 4FDDPNQ ػೳ ֓ཁ

    ಛఆͷϑΝΠϧγεςϜΛ3FBE0OMZͱ͠ ͯϚ΢ϯτ͢Δ࢓૊Έɻ SPPUϢʔβʔͷ࣋ͭݖݶʢಛݖʣΛࡉ෼ Խ͠ɺඞཁͳݖݶͷΈΛϓϩηεʹ෇༩ ͢Δ࢓૊Έɻ ϓϩηε͔ΒͷϑΝΠϧΞΫηεΛ੍ݶ͢Δ ࢓૊Έɻ ڧ੍ΞΫηε੍ޚͱݺ͹ΕDIPXO΍DINPE ʢ೚ҙΞΫηε੍ޚʣͷΑ͏ʹద༻͞Ε੍ͨ ݶΛมߋͰ͖ͳ͍ɻ ϓϩηε͔ΒΧʔωϧʹରͯ͠ൃߦͰ͖ ΔγεςϜίʔϧΛ੍ݶ͢Δ࢓૊Έɻ LTʹ͓͚Δ ద༻ঢ়گ 1PEσϓϩΠ࣌ʹಛఆͷϑΝΠϧγεςϜ ΛσϑΥϧτͰ30ͱͯ͠Ϛ΢ϯτ͢Δɻ ʢQSPD TZTGT DHSPVQʣ ˞EFWͳͲϗετͱϑΝΠϧγεςϜΛ ෼͚ͯӅṭ͢Δέʔε΋͋Δ 1PEσϓϩΠ࣌ʹίϯςφϓϩηεʹର ͯ͠σϑΥϧτͰ࠷௿ݶඞཁͳݖݶͷΈ Λ෇༩͢Δ 1PEσϓϩΠ࣌ʹσϑΥϧτͰ੍ޚ͕ద༻͞ ΕΔɻ ˞$3*΍ίϯςφϗετͷઃఆ࣍ୈͰ͸͋Δ ͕ɺ௨ৗ$3*σϑΥϧτͷ಺༰͕ద༻͞ΕΔ 1PEσϓϩΠ࣌ʹ೚ҙͷઃఆΛ౉͢͜ͱ Ͱద༻Մೳɻ σϑΥϧτͰ͸੍ޚ͕ద༻͞Εͳ͍ɻ $PO fi HVSFB4FDVSJUZ$POUFYUGPSB1PEPS$POUBJOFS IUUQTLVCFSOFUFTJPEPDTUBTLTDPO fi HVSFQPEDPOUBJOFSTFDVSJUZDPOUFYU ˞ҼΈʹ%PDLFS΍1PENBOͰίϯςφΛσϓϩΠ͢Δ৔߹͸σϑΥϧτͰ4FDDPNQ͕ద༻͞Ε·͢ ɹIUUQTEPDTEPDLFSDPNFOHJOFTFDVSJUZTFDDPNQ ɹIUUQTEPDTQPENBOJPFOMBUFTUNBSLEPXOQPENBOSVOIUNM IJHIMJHIUTFDDPNQTFDDPNQQPMJDZQPMJDZ
  4. γεςϜίʔϧ ϓϩηε͕ಈ࡞͢Δ্ͰଞͷϓϩηεΛૢ࡞ͨ͠ΓϦιʔεʹΞΫηε͢Δࡍ͸ɺ γεςϜίʔϧͱݺ͹ΕΔ໋ྩΛΧʔωϧʹରͯ͠ൃߦ͢Δ͜ͱͰͦͷૢ࡞Λ࣮ݱ͠·͢ɻ γεςϜίʔϧͱ4FDDPNQ VCVOUVVTFS!VCVOUVTFSWFSdTUSBDFDBUUFTUUYU FYFDWF VTSCJODBU <DBU UFTUUYU> Y

    ff FFF WBST   CSL /6-- YFC BSDI@QSDUM Y "3$)@   Y ff FCBDG &*/7"- *OWBMJEBSHVNFOU  BDDFTT FUDMETPQSFMPBE 3@0, &/0&/5 /PTVDI fi MFPSEJSFDUPSZ  PQFOBU "5@'%$8% FUDMETPDBDIF 0@3%0/-:c0@$-0&9&$  GTUBU  \TU@NPEF4@*'3&(c TU@TJ[F ^  NNBQ /6--  1305@3&"% ."1@13*7"5&   YGBFD ɾɾɾ SFBE  IFMMPaO   XSJUF  IFMMPaO IFMMP  SFBE     NVONBQ YGB   DMPTF   DMPTF   DMPTF   FYJU@HSPVQ    FYJUFEXJUI ʢྫʣDBUϓϩάϥϜͷ࣮ߦ͢ΔγεςϜίʔϧΛTUSBDFͰදࣔ γεςϜίʔϧͷྫ ɹFYFDWF ɿϓϩάϥϜͷ࣮ߦ ɹPQFOBU ɿϑΝΠϧͷΦʔϓϯ ɹDMPTF ɿϑΝΠϧσΟεΫϦϓλʔͷΫϩʔζ ɹNNBQ ɿϝϞϦͷ֬อ ɹNVONBQ ɿϝϞϦͷղ์ ɹSFBE ɿϑΝΠϧσΟεΫϦϓλʔ͔ΒͷಡΈࠐΈ ɹXSJUF ɿϑΝΠϧσΟεΫϦϓλʔ΁ͷॻ͖ࠐΈ 1SPDFTT 04 ,FSOFM 4:4$"-- 1SPDFTT 4:4$"--
  5. 4FDDPNQʢ4&$VS$0.1VUJOHʣ ϓϩηε͕࣮ߦՄೳͳγεςϜίʔϧΛ੍ݶ͢Δ͜ͱͰɺϓϩηεͷෆਖ਼ૢ࡞΍ҙਤͤ͵ڍಈʹର͢ΔηΩϡϦςΟ֬อΛ ࣮ݱ͢Δػೳɻ γεςϜίʔϧͱ4FDDPNQ 1SPDFTT 04 ,FSOFM TFDDPNQ 4:4$"-- 1SPDFTT

    TFDDPNQ VCVOUVVTFS!VCVOUVTFSWFSdDBUTFDDPNQ "QQMZTFDDPNQUPEFOZPQFOBU   FYFDDBUUFTUUYU PQFOBU  EFOZFSS ʢྫʣϓϩάϥϜ͔ΒPQFOBU Λېࢭͨ͠ঢ়ଶͰDBUΛ࣮ߦ ɾɾɾ FYFDWF CJOTI <TI D DBUUFTUUYU> Y ff DCCECF WBST   CSL /6-- YCBCC BSDI@QSDUM Y "3$)@   Y ff DDF &*/7"- *OWBMJEBSHVNFOU  BDDFTT FUDMETPQSFMPBE 3@0, &/0&/5 /PTVDI fi MFPSEJSFDUPSZ  PQFOBU "5@'%$8% FUDMETPDBDIF 0@3%0/-:c0@$-0&9&$   LJMMFECZ4*(4:4 DPSFEVNQFE  DBUΛ࣮ߦ͍ͯ͠ΔՕॴͷTUSBDF݁Ռ 4:4$"-- ڐՄ͞ΕͨTZTDBMM͸ ௨ৗ௨Γ࣮ߦ ېࢭ͞ΕͨTZTDBMM͸ ࣮ߦ͠ͳ͍ TFDDPNQʹΑΓPQFOBU ͕ڋ൱͞Εͨ ୈճίϯςφٕज़ͷ৘ใަ׵ձ!ΦϯϥΠϯʙTFDDPNQʙ IUUQTXXXZPVUVCFDPNXBUDI W((@$0PLCEX
  6. DBUTFDDPNQD γεςϜίʔϧͱ4FDDPNQ JODMVEFTUEJPI JODMVEFVOJTUEI JODMVEFTZTUZQFTI JODMVEFTUEMJCI JODMVEFFSSOPI JODMVEFTUEEFGI JODMVEFMJOVYBVEJUI JODMVEFMJOVY

    fi MUFSI JODMVEFMJOVYTFDDPNQI JODMVEFTZTQSDUMI JODMVEFTZTTZTDBMMI JGOEFGTFDDPNQ JOUTFDDPNQ VOTJHOFEJOUPQ VOTJHOFEJOU fl BHT WPJE BSHT  \ FSSOP SFUVSOTZTDBMM @@/3@TFDDPNQ PQ  fl BHT BSHT  ^ FOEJG #1'ͰTFDDPNQϧʔϧΛఆٛʢTZTDBMMͷڐՄېࢭΛఆٛʣ TUSVDUTPDL@ fi MUFS fi MUFS<>\ #1'@45.5 #1'@-%c#1'@8c#1'@"#4  P ff TFUPG TUSVDUTFDDPNQ@EBUB BSDI  #1'@+6.1 #1'@+.1c#1'@+&2c#1'@, "6%*5@"3$)@9@    #1'@45.5 #1'@-%c#1'@8c#1'@"#4  P ff TFUPG TUSVDUTFDDPNQ@EBUB OS  #1'@+6.1 #1'@+.1c#1'@+&2c#1'@, @@/3@PQFOBU   ϑΟϧλʔ͢ΔTZTDBMMʹPQFOBU  Λࢦఆ #1'@45.5 #1'@3&5c#1'@, 4&$$0.1@3&5@,*--  #1'@45.5 #1'@3&5c#1'@, 4&$$0.1@3&5@"--08  ^ TUSVDUTPDL@GQSPHQSPH\ MFO VOTJHOFETIPSU  TJ[FPG fi MUFS TJ[FPG fi MUFS<>   fi MUFS fi MUFS  ^ JOUNBJO WPJE \ JOUFSS JG QSDUM 13@4&5@/0@/&8@13*74     \ QFSSPS QSDUM  FYJU &9*5@'"*-63&  ^ TFDDPNQద༻ PQFOBU  Λېࢭ͢ΔϑΟϧλʔΛઃఆ  QSJOUG TaO "QQMZTFDDPNQUPEFOZPQFOBU    JG TFDDPNQ 4&$$0.1@4&[email protected]%&@'*-5&3  QSPH \ QFSSPS TFDDPNQ  ^ TFDDPNQద༻ޙʹDBUΛ࣮ߦ QSJOUG TaO FYFDDBUUFTUUYU  JG FSSTZTUFN DBUUFTUUYU \ QSJOUG PQFOBU  EFOZFSSEaO FSS  SFUVSO ^ SFUVSO ^ ʢࢀߟʣPQFOBU Λېࢭͨ͠ঢ়ଶͰDBUΛ࣮ߦ͢ΔϓϩάϥϜ
  7. ,VCFSOFUFTʹ͓͚Δ4FDDPNQ ,VCFSOFUFTͰ͸ίϯςφϓϩηεʹରͯ͠ڐՄېࢭ͢ΔγεςϜίʔϧΛ4FDDPNQϓϩϑΝΠϧͱͯ͠ఆٛͰ͖·͢ɻ ίϯςφʢ1PEʣΛσϓϩΠ͢Δࡍʹಛఆͷ4FDDPNQϓϩϑΝΠϧΛࢦఆ͢Δ͜ͱͰ ίϯςφϓϩηεʹର͢ΔγεςϜίʔϧͷ੍ݶ͕ՄೳͰ͢ɻ 1PEʹ4FDDPNQΛద༻͢Δ͜ͱ͸,VCFSOFUFTެࣜͷϓϥΫςΟεͰ΋ਪ঑͞ΕΔࣄ߲ͱͳ͍ͬͯ·͢ɻ 04 ,FSOFM 1SPDFTT 1SPDFTT 1SPDFTT

    TFDDPNQ QSP fi MF" TFDDPNQ QSP fi MF# TFDDPNQ TFDDPNQ QSP fi MF"Ͱ ڐՄ͞ΕͨTZTDBMMͷΈ શͯͷTZTDBMM QSP fi MF#Ͱ ڐՄ͞ΕͨTZTDBMMͷΈ $BQBCJMJUZͳͲଞͷݖݶ੍ޚͰ੍ݶ͞Εͨ΋ͷ͸আ͘ ɾ1PEʹର͢Δ4FDDPNQͷద༻͸,VCFSOFUFTWʹ͓͍ͯTUBCMFͱͳͬͨൺֱత৽͍͠ػೳ ɾ,VCFSOFUFTWݱࡏͰ͸1PEσϓϩΠ࣌ʹ໌ࣔ͠ͳ͍ݶΓద༻͞Εͳ͍ ɾ4FDDPNQͱ͸ผʹ$BQBCJMJUZͰ΋ίϯςφϓϩηεʹର͢Δݖݶ੍ޚ͕͞Ε͍ͯΔ 1PE4FDVSJUZ4UBOEFSE IUUQTLVCFSOFUFTJPEPDTDPODFQUTTFDVSJUZQPETFDVSJUZTUBOEBSET
  8. ,VCFSOFUFTʹ͓͚Δ4FDDPNQᶃ$3*ϥϯλΠϜσϑΥϧτϓϩϑΝΠϧΛద༻ $3*ϥϯλΠϜσϑΥϧτϓϩϑΝΠϧΛద༻ ɹDPOUBJOFSE΍DSJP͸$3*ϥϯλΠϜͱͯ͠σϑΥϧτͷ4FDDPNQQSP fi MFΛ͍࣋ͬͯ·͢ɻ ɹ͜ΕΛ1PEσϓϩΠ࣌ʹద༻͢Δ͜ͱͰɺίϯςφϓϩηε͔Β࣮ߦՄೳͳγεςϜίʔϧ੍͕ݶ͞ΕΔΑ͏ʹͳΓ·͢ɻ ɹಛผཁ͕݅ͳ͍ݶΓ͸ͪ͜ΒΛద༻͓ͯ͘͜͠ͱͰϥϯλΠϜͷఆٛ͢Δ࠷௿ݶͷηΩϡϦςΟ͸֬อͰ͖Δ͜ͱʹͳΓ·͢ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB

    MBCFMT SVOTFDDPNQQPE OBNFTFDDPNQQPE TQFD TFDVSJUZ$POUFYU TFDDPNQ1SP fi MF UZQF3VOUJNF%FGBVMU DPOUBJOFST JNBHFVCVOUV OBNFVCVOUV DPNNBOE<CJOTI D XIJMFEPTMFFQEPOF> TFDDPNQQPEZNM <$3*ϥϯλΠϜσϑΥϧτͷ4FDDPNQϓϩϑΝΠϧ> DPOUBJOFSE IUUQTHJUIVCDPNDPOUBJOFSEDPOUBJOFSECMPCBFGDDGBBBDEEDPOUSJCTFDDPNQ TFDDPNQ@EFGBVMUHP- DSJP IUUQTHJUIVCDPNDSJPDSJPCMPCGFEWFOEPSHJUIVCDPNDPOUBJOFSTDPNNPOQLHTFDDPNQEFGBVMU@MJOVYHP- $3*ϥϯλΠϜσϑΥϧτͷ TFDDPNQϓϩϑΝΠϧΛద༻ $SFBUF1PEUIBUVTFTUIFDPOUBJOFSSVOUJNFEFGBVMUTFDDPNQQSP fi MF IUUQTLVCFSOFUFTJPEPDTUVUPSJBMTTFDVSJUZTFDDPNQDSFBUFQPEUIBUVTFTUIFDPOUBJOFSSVOUJNFEFGBVMUTFDDPNQQSP fi MF
  9. ,VCFSOFUFTʹ͓͚Δ4FDDPNQᶄಠࣗͷ4FDDPNQϓϩϑΝΠϧΛద༻ ಠࣗͷ4FDDPNQϓϩϑΝΠϧΛద༻ ɹ$3*σϑΥϧτΑΓ΋ηΩϡϦςΟΛߴΊ͍ͨɺಠࣗͷϫʔΫϩʔυʹରԠ͍ͤͨ͞ͱ͍͏৔߹͸ ɹڐՄېࢭ͢ΔγεςϜίʔϧΛهࡌͨ͠4FDDPNQϓϩϑΝΠϧΛίϯςφϗετʹ഑ஔ͠1PEσϓϩΠ࣌ʹద༻͢Δ͜ͱͰɺ ɹίϯςφϓϩηεʹಠࣗͷ4FDDPNQ͕ద༻͞Εҙਤͨ͠γεςϜίʔϧͷ࣮ߦͷΈ͕ڐՄ͞ΕΔΑ͏ʹͳΓ·͢ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT SVOTFDDPNQQPE

    OBNFTFDDPNQQPE TQFD TFDVSJUZ$POUFYU TFDDPNQ1SP fi MF UZQF-PDBMIPTU MPDBMIPTU1SP fi MFQSP fi MFTTBNQMFTFDDPNQKTPO DPOUBJOFST JNBHFVCVOUV OBNFVCVOUV DPNNBOE<CJOTI D XIJMFEPTMFFQEPOF> TFDDPNQQPEZNM \ EFGBVMU"DUJPO4$.1@"$5@&33/0  BSDIJUFDUVSFT< 4$.1@"3$)@9@  4$.1@"3$)@9  4$.1@"3$)@9 >  TZTDBMMT< \ OBNFT< NNBQ  SFBE  XSJUF  DMPTF  ɾɾɾ >  BDUJPO4$.1@"$5@"--08 ^ > ^ TBNQMFTFDDPNQKTPO ಠࣗͷTFDDPNQϓϩϑΝΠϧΛద༻ ڐՄ͢ΔTZTDBMMΛఆٛ ˞4FDDPNQϓϩϑΝΠϧΛ֤/PEFͷWBSMJCLVCFMFUTFDDPNQQSP fi MFTʹ഑ஔ͢Δ
  10. ,VCFSOFUFTʹ͓͚Δ4FDDPNQᶄಠࣗͷ4FDDPNQϓϩϑΝΠϧΛద༻ ʢࢀߟʣTFDVSJUZQSP fi MFTPQFSBUPS ɹ,VCFSOFUFTʹ͓͍ͯಠࣗͷ4FDDPNQϓϩϑΝΠϧΛѻ͏ͷ͸ҎԼͷ؍఺͔Β݁ߏେมͰ͢ɻ ɹɹɾඞཁͳγεςϜίʔϧͷચ͍ग़͠ ɹɹɾ4FDDPNQϓϩϑΝΠϧͷ࡞੒ ɹɹɾ֤ίϯςφϗετ΁ͷ4FDDPNQϓϩϑΝΠϧ഑ஔ ɹͦ͜Ͱ4FDDPNQϓϩϑΝΠϧͷࣗಈੜ੒΍$3ԽʹΑΓ,VCFSOFUFT্Ͱͷ4FDDPNQͷѻ͍ΛϥΫʹͯ͘͠ΕΔ ɹTFDVSJUZQSP

    fi MFTPQFSBUPSͱ͍͏0QFSBUPS͕։ൃ͞Ε͍ͯ·͢ɻ ɹLVCFSOFUFTTJHTTFDVSJUZQSP fi MFTPQFSBUPS ɹIUUQTHJUIVCDPNLVCFSOFUFTTJHTTFDVSJUZQSP fi MFTPQFSBUPS ɹ4FDVSFZPVS,VCFSOFUFTEFQMPZNFOUTXJUIF#1' ɹIUUQTEFWFMPQFSTSFEIBUDPNBSUJDMFTTFDVSFZPVSLVCFSOFUFTEFQMPZNFOUTFCQG ɹTFDVSJUZQSP fi MFTPQFSBUPSΛ͞ΘͬͯΈͨ ɹIUUQTTQFBLFSEFDLDPNPLFQZUSZTFDVSJUZQSP fi MFTPQFSBUPS