suEXEC セキュリティモデルをベースにしたコンテナ起動時のバリデーションの提案 / A suEXEC-based validation in containers' startup

suEXEC セキュリティモデルをベースにしたコンテナ起動時のバリデーションの提案 / A suEXEC-based validation in containers' startup

2cf373725ded741824c50fd571eda6e1?s=128

KONDO Uchio

May 12, 2018
Tweet

Transcript

  1. 5.

    8FCαʔϏεఏڙͰͷίϯςφͷར༻ w ಥൃతΞΫηε૿ͳͲ΁ͷରॲͷͨΊɺ8FCαʔϏεͷӡ༻ऀ͸ߴ଎͔ͭॊೈͳϦιʔ ε੍ޚΛ͍ͨ͠ɻ w ٸͳϦιʔε௥Ճ΁ͷରԠɺෆཁͳ࣌͸ݮΒ͢ɺͳͲɻ w ίϯςφ͸ͦͷىಈͷߴ଎͞ͳͲͷੑ࣭͔Βɺͦͷ໨తʹ͓͋ͬͯΓීٴ͕ਐΈͭͭ ͋Δɻ w

    )BDPOJXB࿦จ Ͱ΋͜ͷલఏʹ͍ͭͯड़΂͍ͯΔ w ࠓճ͸ͦͷதͰ΋ɺϗεςΟϯά؀ڥʹ͓͍ͯߴ଎͔ͭॊೈͳϦιʔε੍ޚΛ࣮ݱ͢ ΔͨΊʹίϯςφΛར༻͢Δʹ͋ͨΓɺηΩϡϦςΟͷ໰୊Λ੔ཧ͢Δ IUUQTSBOEQFQBCPDPNQBQFSTJQTKODVE[VSBQEG
  2. 7.

    ίϯςφͷ಺෦ˠίϯςφͷϗετ w͍ΘΏΔʮ୤ࠈʯ -JOVY/BNFTQBDF DISPPU $POUBJOFST )PTU04 VODISPPUIUUQTHJTUHJUIVCDPN'JMP4PUUJMF ❌ ❓❓ ௨ৗɺίϯςφ಺෦͔Βϗετͷ৘

    ใ͸ɺ-JOVY/BNFTQBDFͳͲʹΑ Γִ཭͞ΕΞΫηεͰ͖ͳ͍ ⚠੬ऑੑɺઃఆϛεɺ࢓্༷ͷൈ͚݀ ͳͲʹΑΓ֎෦ͷ৘ใʹΞΫηεͰ͖Δ ͜ͱ͕͋Δʹʮ୤ࠈʯ
  3. 8.

    ίϯςφͷ಺෦ˠݟͤͨ͘ͳ͍֎෦ wωοτϫʔΫ্ͷଞͷϗετ΁ͷΞΫηεɺ௨৴ͷ๣ௌͳͲ B C D E ίϯςφB ͷ؀ڥΛ֎෦ʹఏڙ͢Δ৔߹ɺ B ͔Βݟ͑ͯ͸͍͚ͳ͍ϛυϧ΢ΣΞD

    ʹΞΫηεͰ͖Δɺ B ͔Β؅ཧίϯςφE ʹΞΫηεͰ͖ΔɺͳͲ B ͱE ͕ಉ͡WYMBOͷ৔߹ͳͲ΋ߟ͑ΒΕΔͩΖ͏ 0, TFDSFU "ENJODPOUBJOFST $POUBJOFSTUPQSPWJEF ❌ ⭕ ❌
  4. 9.

    ίϯςφͷ಺෦Λӽݖతʹૢ࡞Ͱ͖Δ wίϯςφ಺෦ͷಛݖΛ༩͍͑ͯͳ͍ͷʹɺϑΝΠϧΛૢ࡞Ͱ͖Δ FUDQBTTXE FUDTIBEPX FUDOHJOYOHJOYDPOG QSPDTZT  WBSSVOEPDLFS  "$POUBJOFS

    ίϯςφ಺ͷ௨ৗϢʔβʔ ·ͨ͸ݖݶ੍ݶ͞ΕͨSPPU ౰વɺෆཁͳϑΝΠϧૢ࡞͸ෆՄ ⚠੬ऑੑͳͲͷར༻Ͱ SPPUʹͳΔ ⚠ઃఆ࿙ΕͳͲͰ ෆཁͳݖݶ͕෇͍ͯݖݶୣऔ ૢ࡞ ૢ࡞ ⚠ݖݶઃఆΛޡͬͯ ෇༩Ϛ΢ϯτ͢Δ͜ͱ΋
  5. 14.

    ,FSOFM$BQBCJMJUJFT wSPPUͷ࣋ͭಛݖΛɺ෼ׂ͠ɺҰ෦Λണୣ͋Δ͍͸෇༩Ͱ͖Δ $"1@$)08/ $"1@,*-- $"1@4:4@5*.& $"1@4:4@"%.*/ $"1@/&5@3"8 $"1@/&5@#*/%@4&37*$&  5SBEJUJPOBM

    SPPU $BQBCJMJUJFT -JNJUFE SPPU VTSMPDBMCJOTFSWFSGPP Ұ෦ૢ࡞͕Ͱ͖ͳ͍
 SPPU FH࣌ؒૢ࡞͕Ͱ͖ ͳ͍ɺLJMMͰ͖ͳ͍ ҰൠϢʔβ͕ىಈͯ͠΋ ಛݖϙʔτΛϦοεϯͰ͖ΔɺͳͲ Ұ෦Λണୣ Ұ෦Λ ϑΝΠϧʹ෇༩
  6. 17.

    3PPUMFTT6OQSJWJMFHFEDPOUBJOFST w  όΠφϦࣗମΛTFUVTFSJESPPU͢Δ w  -9$ํࣜͷඇಛݖίϯςφʢ6TFS/BNFTQBDFΛར༻ʣ w  /55ਢాࢯʹΑΔ3PPUMFTTSVOD΄͔ʢػೳ੍ݶ͋Γʣ

    w ϝϦοτɾσϝϦοτ·ͱΊ όΠφϦͷTFUVJESPPU όΠφϦͷݖݶ͕େ͖͘ɺ ͞ΒͳΔ੍ޚΛ͢ΔͨΊͷରԠ͕ඞཁ -9$ํࣜͷඇಛݖίϯςφ Ұ෦όΠφϦΛTFUVJESPPU͢ΔͷͰ ίϯςφͷػೳͷมԽͰ௥ՃͳͲରԠ͕ඞཁ 3PPUMFTTSVOD ωοτϫʔΫ͕UBQͷΈͳͲ ػೳʹ੍ݶ͕͋Δ
  7. 20.

    ՝୊΁ͷରԠ ػೳ໊ ରԠՄೳͳ՝୊ 6TFS/BNFTQBDF      ,FSOFM$BQBCJMJUJFT

       TFDDPNQ    .BOEBUPSZ"DDFTT$POUSPM      4FSWJDF.FTI  ඇಛݖίϯςφ  ϋΠύʔόΠβͷར༻   
  8. 21.

    ՝୊΁ͷରԠ͸ݶఆత ػೳ໊ ରԠՄೳͳ՝୊ 6TFS/BNFTQBDF      ,FSOFM$BQBCJMJUJFT

       TFDDPNQ    .BOEBUPSZ"DDFTT$POUSPM      4FSWJDF.FTI  ඇಛݖίϯςφ  ϋΠύʔόΠβͷར༻   
  9. 24.

    TV&9&$ηΩϡϦςΟϞσϧͱ͸ w·ͣɺTV&9&$ʹ͍ͭͯ "QBDIF VTFSBQBDIF $(*QSPDFTT VTFSVTFS $(*QSPDFTT VTFSVTFS TVFYFDίϚϯυ IPTUGPPFYBNQMFKQ

    IPTUCBSFYBNQMFKQ 7JSUVBM)PTU ͝ͱͷઃఆ $(*ͳͲͷ࣮ߦ ͓ޓ͍ʹݖݶ෼཭ γεςϜྖҬ΋ݟ͑ͳ͍ "QBDIFͷઃఆ౳
  10. 25.

    TV&9&$ηΩϡϦςΟϞσϧ͕ඞཁͳཧ༝ wTFUVTFSJESPPU͞ΕͨόΠφϦΛܦ༝࣮ͯ͠ݱ͍ͯ͠ΔͨΊ "QBDIF VTFSBQBDIF $(*QSPDFTT VTFSVTFS $(*QSPDFTT VTFSVTFS TVFYFDίϚϯυ IPTUGPPFYBNQMFKQ

    IPTUCBSFYBNQMFKQ TFUVJE  ͳͲΛ࣮ߦ͢ΔͨΊɺ TVFYFDίϚϯυ͸TFUVTFSJESPPU ͞ΕͨόΠφϦͱͳ͍ͬͯΔɻ ඞཁҎ্ͷૢ࡞͕Ͱ͖ͳ͍Α͏ͳ Կ͔͠Βରࡦ͕ඞਢ "QBDIFͷઃఆ౳
  11. 27.

    ίϯςφͷલஈϓϩάϥϜͱൺֱ͢Δ wલஈΛOHY@NSVCZͱͨ͠'BTU$POUBJOFSΞʔΩςΫνϟ OHY@NSVCZ VTFSOHJOY ίϯςφ VTFSVTFS ίϯςφ VTFSVTFS IBDPOJXBίϚϯυ IPTUGPPFYBNQMFKQ

    IPTUCBSFYBNQMFKQ ίϯςφϛυϧઃఆ౳ )PTUϔομͳͲ͔Β ίϯςφͷ৘ใΛ࡞੒ TFUVJESPPU ͍ͨ͠ͷͰ ରԠ͕ඞཁ 6TFS/BNFTQBDFʹΑΓ ίϯςφ಺Ͱ͸SPPU ݖݶ෼཭ ݖݶ෼཭
  12. 37.

    ࢀߟࢿྉͳͲ w༧ߘIUUQTHJUIVCDPNVE[VSBXTBTHOEESBGUUSFFNBTUFSESBGUSFBENF  wࢀߟจݙͷ͏ͪɺεϥΠυͰϦϯΫΛࣔ͞ͳ͔ͬͨ΋ͷʢ࿦จ౳ʣ w ۙ౻͏͓ͪଞ )BDPOJXBϓϩάϥϜʹΑΔɺ૊ΈཱͯՄೳੑͱ֦ுੑΛ࣋ͭ-JOVYίϯςφ ৘ใॲཧֶձୈճ શࠃେձߨԋ࿦จू 

    w দຊ྄հଞ 'BTU$POUBJOFS8FCΞϓϦέʔγϣϯίϯςφͷঢ়ଶΛϦΞΫςΟϒʹܾఆ͢Δίϯςφ؅ཧΞʔΩς Ϋνϟ ୈճΠϯλʔωοτͱӡ༻ٕज़ݚڀձ  w দຊ྄հଞ 8FCαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟͱӡ༻ٕज़ ిࢠ৘ใ௨৴ֶձ࿦จࢽ#ͷ7PMVNF +#/P  wλΠτϧը૾͸QJYBCBZDPNΑΓɺQVCMJDEPNBJOͷ΋ͷΛར༻ͨ͠