Сканер контейнеров Conmachi

Плохо ли подбирать capabilities в контейнере?

Conmachi — это инструмент, написанный на Golang и предназначенный для сбора информации об окружении контейнера и выявления потенциальных проблем безопасности. Его можно статически скомпилировать, чтобы затем поместить в контейнер и запустить без каких-либо зависимостей.

Сборка

Зависимости:

sudo apt-get install libpcap-dev

Conmachi предназначен для сборки на любой LTS-версии Ubuntu. При разработке он собирался с Go версии 1.9 и выше, но должен компилироваться и с большинством других версий.

Вы можете выполнить статическую сборку инструмента следующими командами:

go get github.com/nccgroup/ConMachi
go get ./...
cd $GOPATH/bin

# Dynamically compile
CGO_LDFLAGS="/usr/lib/x86_64-linux-gnu/libpcap.a" go build conmachi
# OR statically compile, may cause issues with network scanning
CGO_LDFLAGS="/usr/lib/x86_64-linux-gnu/libpcap.a" go build -ldflags '-w -extldflags "-static"' conmachi

Что он проверяет

$ docker run --rm --security-opt seccomp=unconfined --security-opt apparmor:unconfined --cap-add SYS_ADMIN -it example root@ffffffffffff:/example# ./conmachi Container has dangerous capabilities ------------------------------------ * Container has capabilities in the CapBnd set which could enable network attacks if a process runs with uid=0: CAP_NET_RAW * Container has capabilities in the CapEff which could enable network attacks at the current privilege level: CAP_NET_RAW * Container has dangerous capabilities in the CapBnd set which may allow for container escape if a process runs with uid=0: CAP_SYS_ADMIN * Container has dangerous capabilities in the CapEff set which may allow for container escape if a process runs at the current privilege level: CAP_SYS_ADMIN Container has non-default Docker capabilities --------------------------------------------- Container has non-default Docker capabilities: CAP_SYS_ADMIN Writeable Mounts ---------------- Some paths are mounted with write permission and may be filesystems mounted from the host. If this is the case, modifying the files at these paths may allow a contained process to modify files outside of the contained environment. The following paths were detected to be mounted with write permissions: --- Device: /dev/sda1 Path: /etc/resolv.conf Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- Device: /dev/sda1 Path: /etc/hostname Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- Device: /dev/sda1 Path: /etc/hosts Type: ext4 Opts: [rw relatime data=ordered] Freq: 0 Pass: 0 --- User Namespace Disabled ----------------------- User namespacing is not enabled. As a result, if a contained process is running with uid=0 it will be running as a privileged user if it gains access to resources outside of the container. Container Running Unconfined AppArmor Profile --------------------------------------------- Container is not enforcing an AppArmor profile on contained processes Seccomp is Disabled ------------------- Seccomp is disabled in container Processor Vulnerable to Hardware Attacks ---------------------------------------- The following processors have bugs which may be exploited. More information about each of the processors can be found by reading /proc/cpuinfo. Processor 0 (Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz) bugs: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf Processor 1 (Intel(R) Core(TM) i7-5557U CPU @ 3.10GHz) bugs: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf Container Capabilities ---------------------- CapInh (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapPrm (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapEff (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapBnd (00000000a82425fb): CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_FSETID, CAP_KILL, CAP_SETGID, CAP_SETUID, CAP_SETPCAP, CAP_NET_BIND_SERVICE, CAP_NET_RAW, CAP_SYS_CHROOT, CAP_SYS_ADMIN, CAP_MKNOD, CAP_AUDIT_WRITE, CAP_SETFCAP, CAP_MAC_OVERRIDE, CAP_MAC_ADMIN, CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, CAP_AUDIT_READ CapAmb (0000000000000000): Cgroup Policy Does Not Restrict CPU Usage ----------------------------------------- Processes in the conainer are capable of using excessive amounts of CPU time Cgroup Policy Allows for Excessive Memory Usage ----------------------------------------------- Processes in the conainer are capable of using excessive amounts (>8GB) of RAM Detected Container Runtime -------------------------- Container runtime: docker Kernel Version Info ------------------- Linux version 4.4.0-134-generic (buildd@lgw01-amd64-033) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.10) ) #160-Ubuntu SMP Wed Aug 15 14:58:00 UTC 2018

ConMachi

Популярное

Флаги

Пример