Conmachi Container-Scanner

Ist es falsch, Capabilities in einem Container aufzunehmen?

Conmachi ist ein in Golang geschriebenes Tool, das dazu dient, Informationen über eine Container-Umgebung zu sammeln und potenzielle Sicherheitsprobleme aufzulisten. Es kann statisch kompiliert werden, sodass es direkt in eine Container-Umgebung kopiert und ohne Abhängigkeiten ausgeführt werden kann.

Kompilieren

Abhängigkeiten:

sudo apt-get install libpcap-dev

Conmachi ist dafür vorgesehen, auf jeder LTS-Version von Ubuntu gebaut zu werden. In der Entwicklung wurde es mit Go Version 1.9 und höher gebaut, sollte aber mit den meisten Versionen kompilieren.

Sie können das Tool mit den folgenden Befehlen statisch bauen:

go get github.com/nccgroup/ConMachi
go get ./...
cd $GOPATH/bin

# Dynamically compile
CGO_LDFLAGS="/usr/lib/x86_64-linux-gnu/libpcap.a" go build conmachi
# OR statically compile, may cause issues with network scanning
CGO_LDFLAGS="/usr/lib/x86_64-linux-gnu/libpcap.a" go build -ldflags '-w -extldflags "-static"' conmachi

Was es prüft

$ docker run --rm --security-opt seccomp=unconfined --security-opt apparmor:unconfined --cap-add SYS_ADMIN -it example root@ffffffffffff:/example# ./conmachi Container has dangerous capabilities ------------------------------------ * Container has capabilities in the CapBnd set which could enable network attacks if a process runs with uid=0: CAP_NET_RAW * Container has capabilities in the CapEff which could enable network attacks at the current privilege level: CAP_NET_RAW * Container has dangerous capabilities in the CapBnd set which may allow for container escape if a process runs with uid=0: CAP_SYS_ADMIN * Container has dangerous capabilities in the CapEff set which may allow for container escape if a process runs at the current privilege level: CAP_SYS_ADMIN Container has non-default Docker capabilities --------------------------------------------- Container has non-default Docker capabilities: CAP_SYS_ADMIN Writeable Mounts ---------------- Some paths are mounted with write permission and may be filesystems mounted from the host. If this is the case, modifying the files at these paths may allow a contained process to modify files outside of the contained environment. The following paths were detected to be mounted with write permissions: --- Device: /dev/sda1 Path: /etc/resolv.conf Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- Device: /dev/sda1 Path: /etc/hostname Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- Device: /dev/sda1 Path: /etc/hosts Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- User Namespace Disabled ----------------------- User namespacing is not enabled. As a result, if a contained process is running with uid=0 it will be running as a privileged user if it gains access to resources outside of the container. Container Running Unconfined AppArmor Profile --------------------------------------------- Container is not enforcing an AppArmor profile on contained processes Seccomp is Disabled ------------------- Seccomp is disabled in container Processor Vulnerable to Hardware Attacks ---------------------------------------- The following processors have bugs which may be exploited. More information about each of the processors can be found by reading /proc/cpuinfo. Processor 0 (Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz) bugs: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf Processor 1 (Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz) bugs: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf Container Capabilities ---------------------- CapInh (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapPrm (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapEff (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapBnd (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapAmb (0000000000000000): Cgroup Policy Does Not Restrict CPU Usage ----------------------------------------- Processes in the conainer are capable of using excessive amounts of CPU time Cgroup Policy Allows for Excessive Memory Usage ----------------------------------------------- Processes in the conainer are capable of using excessive amounts (>8GB) of RAM Detected Container Runtime -------------------------- Container runtime: docker Kernel Version Info ------------------- Linux version 4.4.0-134-generic (buildd@lgw01-amd64-033) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.10) ) #160-Ubuntu SMP Wed Aug 15 14:58:00 UTC 2018

ConMachi

Beliebteste

Flags

Beispiel