コンテナを「守る」仕組みから中身を理解しよう!!1; /how-to-be-a-container

by KONDO Uchio

Slide 1

Slide 1 text

%PDLFSɺ)BDPOJXBɺͦΕ͔Β1FSM ۙ౻͏͓ͪ(.01FQBCP *OD :"1$'VLVPLB ίϯςφΛʮकΔʯ࢓૊Έ͔Βɺ த਎Λཧղ͠Α͏

Slide 2

Slide 2 text

ΤϯδχΞ ۙ౻͏͓ͪ!VE[VSB (.0ϖύϘٕज़ج൫νʔϜ 5XJUUFS(JU)VC!VE[VSB 'BDFCPPLVDIJPLPOEP

Slide 3

Slide 3 text

!VE[VSBʹ͍ͭͯ ɾ3VCZJTUɻ೥໨ʁ ɾύʔϑΣΫτ3VCZ3P3ڞஶ ɾ'VLVPLBSC ɾ3VCZ,BJHJTQFBLFS ɾNSVCZίϯςφ)BDPOJXB

Slide 4

Slide 4 text

!VE[VSBʹ͍ͭͯ ɾ3VCZJTUɻ೥໨ʁ ɾύʔϑΣΫτ3VCZ3P3ڞஶ ɾ'VLVPLBSC ɾ3VCZ,BJHJTQFBLFS ɾNSVCZίϯςφ)BDPOJXB

Slide 5

Slide 5 text

3VCZJTU

Slide 6

Slide 6 text

෱Ԭ3VCZձٞ! IUUQSFHJPOBMSVCZLBJHJPSHGVLVPLB

Slide 7

Slide 7 text

ίϯςφ

Slide 8

Slide 8 text

TFDVSJUZ

Slide 9

Slide 9 text

6/*9 -JOVY

Slide 10

Slide 10 text

ίϯςφͱ͸ w༷ʑͳ6/*9γεςϜʹ͓͍ͯ͸ɺ༷ʑͳίϯςφ࣮૷͕͋Δ w'SFF#4%ܥͷKBJMɺ4PMBSJT$POUBJOFSɺ w-JOVYʹ͓͍ͯ͸ɺ-9$ɺ%PDLFSɺTZTUFNEOTQBXOͳͲ w-JOVYͷίϯςφ͸جຊతʹʮಛघͳϓϩηεʯͱ࣮ͯ͠૷

Slide 11

Slide 11 text

ϓϩηεͬͯʁ

Slide 12

Slide 12 text

ϓϩηεͷ࡞Γํ ਌ϓϩηε ࢠϓϩηε ৽͍͠ ϓϩάϥϜ GPSL FYFDWF XBJU

Slide 13

Slide 13 text

ϓϩηεͷ࡞Γํ ਌ϓϩηε ࢠϓϩηε ৽͍͠ ϓϩάϥϜ ϓϩηεΛ ʮෳ੡ʯ͢Δ ݹ͍ϓϩηεΛࣺͯɺ ৽͍͠ϓϩάϥϜʹʮม਎ʯ͢Δ ਌͕ࢠڙͷ ऴྃΛ؂ࢹ

Slide 14

Slide 14 text

ϓϩηεͷଐੑ wͱ͜ΖͰɺϓϩηεʹ͸༷ʑͳଐੑ͕͋Δ wQSPDͷԼ͔Β֬ೝͰ͖Δ wDXE SPPU OTGT QQJE QJE DBQBCJMJUZ DHSPVQ

Slide 15

Slide 15 text

ྫQSPD1*%TUBUVT 1*%ɺ਌ͷ1*% ࣮ߦϢʔβɺάϧʔϓ ϓϩηεάϧʔϓͳͲͷ*% ϝϞϦͷར༻ঢ়گ γάφϧͷઃఆʢϚεΫͳͲʣ $BQBCJMJUZ4FU

Slide 16

Slide 16 text

GPSL ͱFYFD ͷؒ ਌ϓϩηε ࢠϓϩηε ৽͍͠ ϓϩάϥϜ GPSL FYFDWF XBJU GPSL ͱFYFD଒ͷ࣮ߦͷؒʹɺ ϓϩηεͷଐੑΛมߋ͢Δ͜ͱ͕Ͱ͖Δ

Slide 17

Slide 17 text

GPSL ͱFYFD ͷؒ wGPSL ͢ΔͱɺϓϩάϥϜͱͯ͠͸GPSL ݩͷίϐʔͱͳΔ͕ɺͦͷ ࣌఺Ͱಠཱͨ͠ଐੑΛ࣋ͭ wಠཱ͍ͯ͠ΔͷͰɺͦͷޙͰ༷ʑͳଐੑΛมߋ͢ΔγεςϜίʔϧΛ ݺ΂Δ wͦͷଐੑͷ͏ͪଟ͘͸FYFD ͯ͠৽͍͠΋ͷΛܧঝ͢ΔͷͰɺͦͷ ৽͍͠ϓϩηε͕ίϯςφతͳଐੑΛ͍࣋ͬͯΔͱɺίϯςφͱͯ͠ ѻ͑Δ

Slide 18

Slide 18 text

Slide 19

Slide 19 text

ຊൃදͰͷ࢖͍ํ wޙड़͢ΔΑ͏ͳγεςϜίʔϧ౳Λ༻͍ͯɺԿ͔͠Βͷ04Ϧιʔεͷ ִ཭ɺػೳ੍ݶɺ·ͨݖݶ෼཭ΛߦͬͨϓϩηεΛɺ  ʮίϯςφʢ·ͨ͸ίϯςφతϓϩηεʣʯͱݺͼ·͢ɻ

Slide 20

Slide 20 text

ίϯςφͷத਎

Slide 21

Slide 21 text

%PDLFS.PCZMJCDPOUBJOFS w%PDLFSͷίϯςφϓϩηε࡞੒ͷίΞ࣮૷͸ʮ3VO$ʯͱ͍͏໊લͰ ಠཱ͍ͯ͠Δɻͦͷத਎Ͱ࢖͍ͬͯΔ΋ͷ͕MJCDPOUBJOFS wMJCDPOUBJOFSࣗମ͸ଞͷ  (Pݴޠͷ࣮૷͔Β΋ར༻Մೳ wίϯςφपΓͷ༷ʑͳ  ੜͷΦϓγϣϯΛࢦఆ IUUQTNFEJVNDPN!UJ⒎BOZGBZKEPDLFSFUQMVTFOHJOFJTOPXCVJMUPOSVODBOEDPOUBJOFSEBEEFFG

Slide 22

Slide 22 text

-9$ w-JOVYίϯςφͷϦϑΝϨϯεత࣮૷ wத਎͸ɺ$ݴޠ  γεςϜίʔϧΛඇৗʹ  ૉ௚ʹར༻ wίϯςφܥγεςϜίʔϧͷݺͼํͷษڧʹͳΔ

Slide 23

Slide 23 text

)BDPOJXB w!VE[VSBͱ͍͏ਓ͕NSVCZͰ࡞ͬͨίϯςφ࣮૷ wγεςϜίʔϧͱͷΞΫηεΛ$CJOEJOHͰɺϓϩηε࡞੒΍%4-ධ ՁͳͲͷॲཧΛNSVCZͰॻ͍͍ͯΔ w෭࢈෺ͱͯ͠ίϯςφܥγεςϜίʔϧʹ؆୯ʹΞΫηεͰ͖Δ NSVCZJSCόΠφϦ͕ೖΔʢύοέʔδΠϯετʔϧͷ৔߹ʣ

Slide 24

Slide 24 text

ͦͷଞͷ࣮૷ w1FSMͷ࣮૷KBJMJOH BRS wIUUQTHJUIVCDPNLB[VIPKBJMJOH wIUUQTHJUIVCDPNIBZBKPBRS w3VTUʹWBHHBͱ͍͏΋ͷ͕͋ΔΒ͍͠ wIUUQTHJUIVCDPNUBJMIPPLWBHHB

Slide 25

Slide 25 text

ίϯςφͷ ػೳͱ ηΩϡϦςΟ

Slide 26

Slide 26 text

ࠓ೔࿩͢͜ͱ wDISPPUQJWPU@SPPU w-JOVYOBNFTQBDF w$(SPVQ w,FSOFM$BQBCJMJUZ wTFDDPNQ w."$BQQBSNPS

Slide 27

Slide 27 text

ࠓ೔࿩͢͜ͱ wDISPPUQJWPU@SPPU w-JOVYOBNFTQBDF w$(SPVQ w,FSOFM$BQBCJMJUZ wTFDDPNQ w."$BQQBSNPS 04Ϧιʔεͷ෼཭ ݖݶɾػೳͷ੍ݶ ΞΫηείϯτϩʔϧ 04Ϧιʔεͷར༻੍ݶ

Slide 28

Slide 28 text

DISPPU

Slide 29

Slide 29 text

DISPPU ίϚϯυ wDISPPU γεςϜίʔϧͷϥούʔ w΋ͬͱ΋୯७ͳʮίϯςφʯ wผͷͱ͜Ζʹ࡞ͬͨ04ͷSPPUϑΝΠϧγεςϜͷதʹʮೖΓʯɺ  ਌ϓϩηεͱ͸ผͷ؀ڥΛ࡞Δ wDISPPUޙͷ؀ڥ͔ΒɺผͷSPPU΍ɺ਌ͷϑΝΠϧγεςϜ͸ɺ  ݪଇͱͯ͠͸ݟ͑ͳ͍

Slide 30

Slide 30 text

୯७ͳ͚ͩʹ͕݀͋Δ wDISPPU ͨ͠؀ڥ಺෦ͰɺDISPPU Մೳͩͱ؆୯ʹൈ͚ΒΕΔ # mkdir .tmp # mount --bind . .tmp # mount devtmpfs -t devtmpfs .tmp/dev # perl -e 'chroot ".tmp"; chdir "..";chdir "..";chdir ".."; chdir "..";chdir "..";chdir ".."; chroot ".";exec "/bin/sh"' # ls /vagrant ...... (਌ͷσΟϨΫτϦ͕ݟ͑Δʂ)

Slide 31

Slide 31 text

VODISPPUΛ๷͙ʹ͸ wDISPPUͰ͖ͳ͘͢Δͱ͍͏ํ๏͕Ұൠత wݖݶΛམͱ͢DBQBCJMJUZ wγεςϜίʔϧ୯ҐͰݺ΂ͳ͘͢ΔTFDDPNQ wͦͷଞɺ6TFSOBNFTQBDFΛ෼͚ͯ͠·͑͹࣮࣭୤ࠈෆՄ w͍ͣΕʹͤΑɺ΄͔ͷίϯςφػೳͱ૊Έ߹Θͤͯ҆શੑΛ֬อ͢Δ

Slide 32

Slide 32 text

DGQJWPU@SPPU wSPPUϑΝΠϧγεςϜΛʮೖΕସ͑ΔʯɻDISPPUΑΓڧྗ w04ͷϒʔτϓϩηεɺOFUCPPUͷࡍʹ࢖͍ͬͯΔ wDISPPUΑΓ͸੍ݶ͕͋Δ wlOFX@SPPUͱQVU@PME͸ݱࡏͷSPPUͱಉ͡ϑΝΠϧγεςϜʹ͋ͬͯ͸ͳ Βͳ͍zͳͲ wDISPPU΄Ͳखܰʹ͸࢖͑ͳ͍͕ɺҰํ୤ࠈͷ໰୊͸ͳ͘ͳΔ IUUQTMJOVYKNPTEOKQIUNM-%1@NBOQBHFTNBOQJWPU@SPPUIUNM

Slide 33

Slide 33 text

-JOVY OBNFTQBDF

Slide 34

Slide 34 text

-JOVYOBNFTQBDF͕ͳ͍ͱ wDISPPU͢ΔͱϑΝΠϧγεςϜ͕෼཭͞ΕΔɻ wͱ͍͏͜ͱͰɺ/procΛվΊͯϚ΢ϯτ͢Δඞཁ͕͋Δɻ wϚ΢ϯτ͢Δͱ  ݟ͑ͯ͸͍͚ͳ͍΋ͷ͕  ݟ͑ΔΑ͏ͳ

Slide 35

Slide 35 text

04ͷϦιʔε͸ଞʹ΋ʮ෼཭Ͱ͖Δʯ wϓϩηεΛ෼཭͠ͳ͍ͱɺίϯςφͷத͔Β֎ͷϓϩηεΛ͍͡ΕΔ wϗετ໊Λ෼཭͠ͳ͍ͱɺίϯςφ಺Ͱผ్ϗετ໊ΛઃఆͰ͖ͳ͍ wͦͷଞʹɺ෼཭Ͱ͖Δ΋ͷ wϚ΢ϯτϙΠϯτͷ৘ใ w*1$ϦιʔεTINHFU ͱ͔NR@PQFO తͳ΋ͷ wωοτϫʔΫɺϢʔβ*%ɺ$(SPVQ

Slide 36

Slide 36 text

Πϝʔδ wάϩʔόϧOBNFTQBDFͷ  தʹɺ͍͔ͭ͘  OBNFTQBDFΛ࡞ΕΔ IUUQTTQFBLFSEFDLDPNVE[VSBDSFBUJOHDPOUBJOFSTXJUIHPMBOH

Slide 37

Slide 37 text

Ұ෦͚ͩͷҠಈ΋Մೳ wྫip nets exec wOFUXPSLOBNFTQBDFʢʴЋʣ  ͚ͩΛ෼཭͢Δ  ίϯςφͱݴ͑Δ wҰൠతʹ͸ɺηοτͰ෼཭͢Δํ͕ศརͰ͸͋Δ $ sudo ip netns add test001 $ sudo ip netns exec test001 /bin/bash root@test-1:/home/ubuntu# ip a 1: lo: mtu 65536 qdisc noop state DOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

Slide 38

Slide 38 text

ͱ͍͏͜ͱͰɺ1*%Λ෼཭͢Δ w࣮૷ͷํ਑ w1*%͸/proc͔Βݟ͑Δ΋ͷ wͳͷͰผͷ/procΛ҆શʹϚ΢ϯτͰ͖ΔΑ͏ɺ  .PVOUOBNFTQBDF΋Ұॹʹ෼཭͢Δ wGPSLͷ୅ΘΓʹDMPOF γεςϜίʔϧΛݺͼɺ࠷ޙʹFYFD ͢Δ ৚݅Λࡉ͔͘ࢦఆͰ͖Δ GPSL ͱߟ͍͑ͯͩ͘͞

Slide 39

Slide 39 text

1FSMΛษڧͯ͠ॻ͍ͯΈ·ͨ͠ #!/usr/bin/env perl use strict; use POSIX; use Linux::Clone; my $flg = POSIX::SIGCHLD | Linux::Clone::NEWNS | Linux::Clone::NEWPID; my $pid = Linux::Clone::clone sub { system "mount --make-rslave /"; chroot "/var/lib/rootfs/yapc"; chdir "/"; exec "/bin/sh"; 127 }, 0, $flg; print "PID=", $pid, "\n"; waitpid $pid, 0 if($pid); print "Container exited\n";

Slide 40

Slide 40 text

ಈ࡞֬ೝ w͜ͷล·Ͱ͸ɺͲΜͳίϯςφͰ΋ಉ͡Α͏ʹ࣮૷͍ͯ͠Δ

Slide 41

Slide 41 text

ٳܜ

Slide 42

Slide 42 text

<13>

Slide 43

Slide 43 text

(.0ϖύϘ෱Ԭࢧࣾ͸ ΤϯδχΞΛืू͍ͯ͠·͢ ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU

Slide 44

Slide 44 text

࢓ࣄͰɺίϯςφΛ  ΨοπϦ࢖͍͍ͨʂ  ͋Δ͍͸։ൃ͍ͨ͠ํ  ੠Λֻ͓͚͍ͩ͘͞

Slide 45

Slide 45 text

SFTVNF

Slide 46

Slide 46 text

DHSPVQ

Slide 47

Slide 47 text

$POUSPM(SPVQ DHSPVQ w-JOVYʹ͸ɺϓϩηεΛάϧʔϐϯάͯ͠ɺͦͷάϧʔϓ͝ͱʹ  ϋʔυ΢ΣΞϦιʔε04ϦιʔεͳͲͷར༻ঢ়گΛ֬ೝͨ͠Γɺ  ͋Δ͍͸੍ޚΛ͢Δػೳ͕͋ΔɻͦΕ͕DHSPVQ wMJCDHSPVQͷΑ͏ͳϥΠϒϥϦ΍ɺDHSPVQGT͔ΒΞΫηεՄೳ w·ͨɺTZTUFNE͕಺෦Ͱར༻͢ΔʢϓϩηεͷάϧʔϐϯάɺϦιʔ ε੍ݶͳͲʣ wDGTZTUFNEOTQBXO TZTUFNEʹಉࠝͷίϯςφ

Slide 48

Slide 48 text

DHSPVQTVCTZTUFN w੍ޚͰ͖Δର৅͝ͱʹαϒγεςϜ͕͋Δ wαϒγεςϜ͸ͨ͘͞Μ͋Δ wDQV wNFNPSZ wCMLJP OFU@DMT GSFF[FS wͦͷதͰ΋QJETαϒγεςϜΛ঺հ

Slide 49

Slide 49 text

ίϯςφͰͷGPSLCPNC߈ܸ w౰વͰ͋Δ͕ɺ฼؋04શମͰͷϓϩηεͷ࠷େ਺͸༗ݶͰ͋Δ w͕ͨͬͯ͠ɺίϯςφ؀ڥͷத͔Β๲େͳϓϩηεΛ࡞੒͢Δͱɺ  ݁Ռతʹ฼؋04ͷϓϩηε਺ͷ্ݶʹୡ͢Δ͜ͱ͸ى͜Γ͏Δ w఻౷తʹ͸ɺSMJNJUͰϓϩηεπϦʔ͝ͱͷϓϩηε਺Λ੍ݶ wίϯςφͷ৔߹BUUBDIͳͲʹΑΓɺίϯςφ಺ͷશͯͷϓϩηε͕ɺ ಉ͡ϓϩηεπϦʔʹॴଐ͍ͯ͠ͳ͍৔߹΋͋Γ͏Δ

Slide 50

Slide 50 text

QJETTVCTZTUFN w-JOVYҎ߱Ͱಋೖ͞ΕͨαϒγεςϜ wҎԼͷ஋Λར༻Ͱ͖Δ wQJETDVSSFOUάϧʔϓ಺ͷݱࡏͷϓϩηε਺ wQJETNBYͦͷάϧʔϓͰڐՄ͢Δ࠷େϓϩηε਺ SPPUάϧʔϓͰ͸ར༻Ͱ͖ͳ͍ͷͰ஫ҙ ࢀߟʮ-9$ͰֶͿίϯςφೖ໳ʯ IUUQHJIZPKQBENJOTFSJBMMJOVY@DPOUBJOFST

Slide 51

Slide 51 text

͖ͬ͞ͷ1FSMίϯςφʹύον --- chroot2.pl 2017-06-20 10:47:02.780313607 +0900 +++ bomber.pl 2017-06-20 12:55:41.572399620 +0900 @@ -2,11 +2,19 @@ use strict; use POSIX; use Linux::Clone; +system "mkdir -p /sys/fs/cgroup/pids/yapc-fukuoka"; my $flg = POSIX::SIGCHLD | Linux::Clone::NEWNS | Linux::Clone::NEWPID; my $pid = Linux::Clone::clone sub { system "mount --make-rslave /"; chroot "/var/lib/haconiwa/rootfs/php"; chdir "/"; - exec "/bin/sh"; 127 }, 0, $flg; + exec "/bin/bash"; 127 }, 0, $flg; +open TASKS, ">> /sys/fs/cgroup/pids/yapc-fukuoka/tasks"; +print TASKS "$pid"; +close TASKS; +open MAX, ">> /sys/fs/cgroup/pids/yapc-fukuoka/pids.max"; +print MAX "32"; +close MAX; + print "PID=", $pid, "\n"; waitpid $pid, 0 if($pid); QJETDHSPVQΛ௥Ճ ίϯςφͷQJEΛॴଐͤ͞ɺ NBYΛ੍ݶ

Slide 52

Slide 52 text

GPSLCPNCΛ๷͛Δ͜ͱ͕Θ͔Δ wQJETNBY੍ݶͳͩ͠ͱ฼؋͝ͱ௜໧͠·͢

Slide 53

Slide 53 text

,FSOFM $BQBCJMJUZ

Slide 54

Slide 54 text

-JOVY,FSOFM$BQBCJMJUZ w-JOVYͰ͸ɺSPPU͕͍࣋ͬͯΔ༷ʑͳݖݶΛɺࡉ͔͘෼ׂͯ͠ɺ  Ұ෦͚ͩ෇༩ɺ·ͨ͸Ұ෦੍͚ͩݶ͢Δ͜ͱ͕Ͱ͖Δ w͜ΕΒͷݖݶͷू߹ΛέʔύϏϦςΟηοτɺҰͭҰͭΛέʔύϏϦ ςΟͱݺͿɻ wྫ͑͹ɺ࣌ؒΛઃఆ͢Δݖݶ CAP_SYS_TIME ɺLJMMΛͲΜͳϓϩηε ʹ΋ૹΔݖݶ CAP_KILL ɺ࠶ىಈ͢Δݖݶ CAP_SYS_BOOT

Slide 55

Slide 55 text

6CVOUV9FOJBM -JOVY Ͱ͸ wdͷͷ  έʔύϏϦςΟ

Slide 56

Slide 56 text

έʔύϏϦςΟͷܧঝϧʔϧ wϓϩηεϑΝΠϧͷͭͷηοτ 1FSNJUUFE*OIFSJUBCMF&⒎FDUJWF ɺ ό΢ϯσΟϯάηοτɺΞϯϏΤϯτηοτ -JOVYҎ߱ Ͱܾ·Δ wৄࡉ͸NBODBQBCJMJUJFT wྫTFUVTFSJESPPUͰɺଞ͕  σϑΥϧτͷ৔߹ɺ  ό΢ϯσΟϯάηοτͰམͱͯ͠  FYFDWF ͢Δͱ৽͍͠ϓϩάϥϜ  Ͱ͸ͦͷݖݶ͕མ͍ͪͯΔ

Slide 57

Slide 57 text

ྫҰൠϢʔβͰ൪ΛϦεϯ͍ͨ͠ wҰൠతʹɺ൪ҎԼͷϙʔτ͸ҰൠϢʔβ͸࢖͑ͳ͍ w͜͏͍͏(Pͷ)5514FSWFSΛ࡞ͬͨΒɺҰൠϢʔβ͸ىಈͰ͖ͳ͍

Slide 58

Slide 58 text

TFUDBQ ͰpMFDBQBCJMJUJFTΛ෇༩͢Δ w൪ҎԼΛϦεϯ͢Δݖݶʹ CAP_NET_BIND_SERVICE ubuntu@compute-1:~$ sudo setcap cap_net_bind_service+ep ./listen80 ubuntu@compute-1:~$ ./listen80 & [1] 5915 ubuntu@compute-1:~$ curl localhost Hello, World ubuntu@compute-1:~$ sudo getcap ./listen80 ./listen80 = cap_net_bind_service+ep VCVOUVϢʔβͰ αʔόΛىಈͰ͖Δ

Slide 59

Slide 59 text

ྫ੍ݶ෇͖ͷίϯςφ಺SPPU wίϯςφ಺෦Ͱ΋ɺSPPUΛ౉͢ͱศརͳ͜ͱ͸ଟ͍ wͱ͸ݴ͑ͳΜͰ΋͸ͤͨ͘͞ͳ͍ɻͰ͖Δ͜ͱ͚ͩ wCAP_SYS_TIMEͱCAP_SYS_CHROOTݖݶΛୣͬͯΈΔ

Slide 60

Slide 60 text

࠷ॳͷ1FSMίϯςφʹύον --- chroot2.pl 2017-06-20 10:47:02.780313607 +0900 +++ dropcap.pl 2017-06-20 14:38:31.335190235 +0900 @@ -2,10 +2,14 @@ use strict; use POSIX; use Linux::Clone; +use Linux::Prctl; + my $flg = POSIX::SIGCHLD | Linux::Clone::NEWNS | ...; my $pid = Linux::Clone::clone sub { system "mount --make-rslave /"; chroot "/var/lib/haconiwa/rootfs/php"; chdir "/"; + $Linux::Prctl::capbset{"sys_time"} = 0; + $Linux::Prctl::capbset{"sys_chroot"} = 0; exec "/bin/sh"; 127 }, 0, $flg; print "PID=", $pid, "\n"; waitpid $pid, 0 if($pid); CPVOEJOHTFU͔Β࡟আ

Slide 61

Slide 61 text

EBUFͰ೔෇ͷηοτ͕Ͱ͖ͳ͘ͳΔ w0QFSBUJPOOPUQFSNJUUFEѻ͍ʹͳΔ root@compute-1:~# perl dropcap.pl PID=5962 # date Tue Jun 20 06:34:50 UTC 2017 # date -s 00:00:00 date: cannot set date: Operation not permitted Tue Jun 20 00:00:00 UTC 2017 # date Tue Jun 20 06:34:59 UTC 2017

Slide 62

Slide 62 text

DISPPUͰίϯςφΛൈ͚ΒΕͳ͘ͳΔʂ

Slide 63

Slide 63 text

%PDLFS.PCZͰ͸ wEPDLFSNPCZSVOͷΦϓγϣϯɺDBQBEE DBQESPQ  ΦϓγϣϯͰίϯτϩʔϧՄೳ wσϑΥϧτͷ$BQBCJMJUZ͸ιʔεʹϋʔυίʔυ͞Ε͍ͯΔ wIUUQTHJUIVCDPNNPCZNPCZCMPCNBTUFSPDJ EFGBVMUTHP--

Slide 64

Slide 64 text

ͱ͜ΖͰօ͞Μ

Slide 65

Slide 65 text

QSJWJMFHFEΛ҆қʹ࢖͍ͬͯ·ͤΜ͔ʁ wจࣈͲ͓Γɺਫ਼ࠪͤͣʹɺ͢΂ͯͷ$BQBCJMJUZΛ෇༩͢ΔΦϓγϣϯ wͦͷଞͷɺTFDDPNQBQQBSNPSͳͲͷઃఆʹΑΓɺίϯςφ಺ͷ ݖݶ͸ߜΓࠐ·ΕΔɻͱ͸͍͑ wྫ͑͹ɺΧʔωϧʹΑͬͯTFDDPNQ౳͕༗ޮͰͳ͍͜ͱ΋͋Δ w TFDDPNQ BQQBSNPS౳Λແޮʹ͢ΔΦϓγϣϯ΋͋Δ w ҆શੑ͕ઈର֬อͰ͖ΔΑ͏ͳ৔໘ $*Ͱར༻ΠϝʔδΛݶఆ͢Δ౳ Ͱ͸·ͨผ͕ͩ w࠷খݖݶͷݪଇʹै͍ɺਫ਼ࠪͯ͠DBQBEEͰ໌ࣔత௥Ճ͢Δ΂͖

Slide 66

Slide 66 text

ٳܜ

Slide 67

Slide 67 text

͓ർΕͰ͠ΐ͏ͷͰ ෱Ԭͷඒຯ͍͠΋ͷͷը૾Λ ோΊ·͠ΐ͏

Slide 68

Slide 68 text

No content

Slide 69

Slide 69 text

No content

Slide 70

Slide 70 text

No content

Slide 71

Slide 71 text

SFTUPSF

Slide 72

Slide 72 text

TFDDPNQ

Slide 73

Slide 73 text

TFDDPNQ TFDDPNQCQG w-JOVYͰɺαϯυϘοΫεΛ࣮ݱ͢ΔͨΊʹɺ  ϓϩηεͷγεςϜίʔϧݺͼग़͠ΛϑΟϧλϦϯά͠ɺ  ੍ݶɾτϥοϓɾτϥοΩϯάͳͲΛ࣮ݱ͢Δػೳ wࠓճ͸ɺ-JOVYҎ߱ͷTFDDNPQNPEFͷ࿩ w#FSLFMFZ1BDLFU'JMUFS #1' Λ༻͍ͯߴ଎ʹݺͼग़͠ΛϑΟϧλϦ ϯά͢Δ

Slide 74

Slide 74 text

Կ͕Ͱ͖Δ͔ wಛఆͷγεςϜίʔϧͷڐՄ wಛఆͷγεςϜίʔϧͷېࢭ 4*(4:4ͷૹ෇ wಛఆͷγεςϜίʔϧͷݺͼग़͠Λ೚ҙͷFSSOPͰฦ͢ wಛఆͷγεςϜίʔϧΛɺQUSBDF ͰτϥοΫՄೳʹ͢Δ w࠷ॳʹσϑΥϧτͷڍಈΛࢦఆ͠ɺݸผͷγεςϜίʔϧͷ৔߹Λఆ ٛ͢Δ

Slide 75

Slide 75 text

͔͜͜ΒNSVCZ͕ग़ͯ͘Δ w1FSMྗ͕௿͘ɺ͍͢·ͤΜ ҰԠϞδϡʔϧ͸͋ΔΑ͏Ͱ͕͢ɻ wIBDPOJXBNSVCZTFDDPNQ

Slide 76

Slide 76 text

NSVCZTDSJQU #!/usr/bin/env hacorb context = Seccomp.new(default: :allow) do |rule| rule.kill :mkdir rule.kill :fchownat end pid = Process.fork do context.load puts "==== It will be jailed. Please try to mkdir/chown" exec "/bin/sh" end p(Process.waitpid2 pid)

Slide 77

Slide 77 text

࣮ߦ͢ΔͱɺαϯυϘοΫε্ཱ͕͕ͪΔ w·͝͏ࣄͳ͖SPPUͰ͋Δ͕ɺϑΝΠϧͷॴ༗ऀΛม͑ͨΓɺ  σΟϨΫτϦΛ࡞Εͳ͍ɻ͜Ε΋Ұछͷʮίϯςφʯ wʢIBDPOJXBQBDLBHFʹಉࠝ͞ΕΔIBDPSCόΠφϦΛ࢖͏ʣ 4:(4:4ͷΤϥʔϝοηʔδ

Slide 78

Slide 78 text

ৄࡉ͸ϒϩάʹॻ͖·ͨ͠ʜ wNSCHFNͷ֓ཁʮTFDDPNQΛNSVCZͰࢼ͢ʯ wIUUQVE[VSBIBUFOBCMPHKQFOUSZ wTFDDPNQʹΑΔγεςϜίʔϧτϥοΩϯά  ʮNSVCZͱTFDDPNQͱQUSBDFͰγεςϜίʔϧΛͱʹ͔͘௥͍͔͚Δʯ wIUUQVE[VSBIBUFOBCMPHKQFOUSZ ಛఆͷγεςϜίʔϧݺͼग़͠ΛϩΪϯά͢Δ γΣϧͷྫ͸ͪ͜Βͷهࣄ͔Β

Slide 79

Slide 79 text

%PDLFSͷதͰ͸ʁ wݺͼग़ͤΔγεςϜίʔϧͷʮϗϫΠτϦετʯ͕ଘࡏ͢Δ wυΩϡϝϯτʹ΋͋Δ௨Γɻ wΦϓγϣϯͰ೚ҙͷϑΟϧλʔΛద༻Ͱ͖Δͦ͏ 4FDDPNQTFDVSJUZQSPpMFTGPS%PDLFS IUUQTEPDTEPDLFSDPNFOHJOFTFDVSJUZTFDDPNQ

Slide 80

Slide 80 text

."$ "QQ"SNPS

Slide 81

Slide 81 text

ίϯςφػೳઆ໌ͱͯ͠͸ɺ ͜ΕͰ࠷ޙͳΜͰ ؤு͓ͬͯฉ͖͍ͩ͘͞

Slide 82

Slide 82 text

༤େͳେ෼ͷࣗવΛݟͯٳܜ CZ!NBUTVNPUPSZ͞Μ

Slide 83

Slide 83 text

."$ͱ͸ w͜͜Ͱ͸.BOEBUPSZ"DDFTT$POUSPMڧ੍ΞΫηε੍ޚͷ͜ͱ wҰൠతͳɺϑΝΠϧΦ΢φʔ͝ͱʹΞΫηε͢ΔݖݶΛߜΔํࣜ͸ɺ ೚ҙΞΫηε੍ޚ %JTDSFUJPOBSZ"DDFTT$POUSPM ͱݺ͹ΕΔɻ wࣄނͳͲʹΑΓݖݶΛඞཁҎ্ʹΏΔ͘Ͱ͖ͯ͠·͏  ʢσΟϨΫτϦΛύʔϛογϣϯͰެ։Ͱ͖Δ౳ʣ͜ͱ͕͋Δ

Slide 84

Slide 84 text

."$ͱ͸ w%"$ͷݖݶݕࠪΛͨ͠ޙͰɺ؅ཧऀͷઃఆͨ͠."$ͷϙϦγʔ͕ద ༻͞ΕɺϦιʔε΁ͷΞΫηε͕ڧ੍ίϯτϩʔϧ͞ΕΔ wʮࣗ෼ͷݖݶͰ͋ͬͯ΋ɺࣗ෼ͰίϯτϩʔϧͰ͖ͳ͍ʯ͜ͱ΋ wྫ͑͹ࣗ෼Ͱ࡞ͬͨϑΝΠϧʹɺࣗ෼ͰΞΫηεͰ͖ͳ͘ͳΔɺͱ͍ ͏ઃఆ΋ՄೳͰ͋Δ w·ͨɺ%"$ΑΓࡉ͔͍ΞΫηε੍ޚ΋Մೳʹ

Slide 85

Slide 85 text

"QQ"SNPSͱ͸ w."$Λ࣮ݱ͢Δϛυϧ΢ΣΞͷҰͭ wϓϩάϥϜͷύε୯Ґϓϩηε୯ҐͰϓϩϑΝΠϧͷద༻͕Ͱ͖Δ ͷ͕ಛ௃ w6CVOUVͷ$BOPOJDBMࣾʹΑΓ։ൃ͕͞Ε͍ͯΔ wFOGPSDFNPEFͱDPNQMBJONPEFʢه࿥ͷΈʣ͕͋Δ

Slide 86

Slide 86 text

%PDLFSͰͷར༻ wίϯςφ͸σϑΥϧτɺEPDLFSEFGBVMUͱ͍͏ϓϩϑΝΠϧ͕౰ͨΔ ίϯςφΛͭ࡞ͬͨͷͰɺ ͭͷϓϩηεʹద༻͞Ε͍ͯΔ -9$΋࢖ͬͯ·͢Ͷ

Slide 87

Slide 87 text

ϓϩϑΝΠϧͷྫ IUUQTEPDTEPDLFSDPNFOHJOFTFDVSJUZBQQBSNPSOHJOYFYBNQMFQSPpMF wಠࣗͷݴޠΛ༻͍ͯهड़͢Δ

Slide 88

Slide 88 text

ΧελϜϓϩϑΝΠϧΛ౰ͯΔʹ͸ wdeny /usr/bin/top mrwklxͱ͍͏ϧʔϧΛՃ͑ͨϓϩϑΝΠϧ Λ࡞੒ɺొ࿥͢Δ wEPDLFSSVOίϚϯυͰ--security-opt apparmor=exampleͷ Α͏ʹࢦఆͯ͠ىಈ wͦͷίϯςφͰ͸ɺUPQίϚϯυΛ࣮ߦ͢Δ͜ͱ͕Ͱ͖ͳ͍ɻ wBVEJUͷΈɺͳͲ΋Մೳ ৄࡉ͸ϒϩάͰ ʮ"QQ"SNPSͱ%PDLFSͱͦͷଞίϯςφతϓϩηεʹ͍ͭͯʯ IUUQVE[VSBIBUFOBCMPHKQFOUSZ

Slide 89

Slide 89 text

ΑΓৄࡉͳத਎ wMJCBQQBSNPSͱ͍͏ϥΠϒϥϦͰϓϩάϥϜ͔ΒΞΫηεͰ͖Δ wݱࡏͷϓϩηεͷϓϩϑΝΠϧΛมߋ͢ΔBB@DIBOHF@QSPpMF ͱ  FYFDWF ͷλΠϛϯάͰมߋ͢ΔBB@DIBOHF@POFYFD ͕͋Δ wʢ6CVOUVͷNBOͰηΫγϣϯ͕ͳͷͰʣ wNSVCZͷCJOEJOH࡞੒ࡁʢ͔͠͠·ͩ)BDPOJXBʹ૊ΈࠐΜͰͳ͍ʣ IUUQNBOQBHFTVCVOUVDPNNBOQBHFTYFOJBMNBOBB@DIBOHF@QSPpMFIUNM

Slide 90

Slide 90 text

͓ർΕ༷  Ͱͨ͠

Slide 91

Slide 91 text

·ͱΊ

Slide 92

Slide 92 text

ίϯςφ͸ ಛผͳϓϩηεʹա͗ͳ͍ɻ ˠͦͷϓϩηεΛ҆શʹɺಠཱͨ͠ܗͰɺ ޮ཰తʹར༻͢΂༷͘ʑͳγεςϜίʔϧ΍ػೳ͕͋Δ

Slide 93

Slide 93 text

%PDLFS͸σϑΥϧτͰ ͍Ζ͍Ζ͍͍ײ͡ʹ͍ͯ͠Δ ˠ͔͠͠ɺཧղ͕ෆे෼ͩͱൈ͚ಓΛ࡞ͬͯ͠·͏͜ͱ΋ɻ ɹQSJWJMFHFEΦϓγϣϯɺؒҧͬͨઃఆɺ ɹΧʔωϧόʔδϣϯͰ࢖͑ͳ͍ػೳͳͲ

Slide 94

Slide 94 text

ࢀߟεΠενʔζϞσϧ ˠҰͭҰͭʹ͕ۭ͍͍݀ͯͨͱͯ͠΋ɺ ɹͨ͘͞ΜॏͶΔ͜ͱͰɺશͯͷ݀Λൈ͚Δ͜ͱ͸ ɹඇৗʹ೉͘͠ͳΔ *NBHF$$IUUQTQJYBCBZDPNQ

Slide 95

Slide 95 text

͔ͬ͠Γͱத਎ʹڵຯΛ࣋ͪ ཧղͯ͠࢖͏͜ͱͰ ϋϚΓͲ͜ΖΛճආͰ͖Δ ˠIBDPSC͕ศར͔΋͠Εͳ͍ɻ ɹ1FSMͰ΋ɺίϯςφػೳͰ༡΂ΔΑʂ

Slide 96

Slide 96 text

ָ҆͘͠શʹ ίϯςφΛ࢖͓͏ʂ

Slide 97

Slide 97 text

ࢀߟࢿྉͷօ͞Μ wVE[VSBͷϒϩάʢTFDDPNQBQQBSNPSIBDPOJXBଞʣ wMYDKQ!5FO'PSXBSE͞Μͷࢿྉ w IUUQTTQFBLFSEFDLDPNUFOGPSXBSE wաڈͷ:"1$ :"1B$ ൃදͳͲ w 1FSMͰθϩ͔Β࡞Δίϯςφ w ֶͭͬͯ͘Ϳ-JOVYίϯςφͷཪଆ w%PDLFSTFDVSJUZ w IUUQTEPDTEPDLFSDPNFOHJOFTFDVSJUZTFDVSJUZ

Slide 98

Slide 98 text

4QFDJBM5IBOLT w!5FO'PSXBSE͞ΜʹຊεϥΠυͷϨϏϡʔΛ͓ئ͍͠·ͨ͠ɻ  ͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ·ͨຊொͰҿΈ·͠ΐ͏ɻ