Post

Container Security with Fine-Grained Permission Control

Posted
By Joey
3 min read

Container Security with Fine-Grained Permission Control

In the modern landscape of software development, containerization has become a pivotal technology for deploying and managing applications. Containers provide a lightweight, consistent environment for applications, but they also introduce new security challenges. One of the key aspects of container security is controlling permissions to ensure that only authorized users and processes can access the necessary resources. In this article, we will explore how to implement fine-grained permission control in containers, using Kubernetes as an example.

Understanding Permission Symbols

Linux file permissions are a crucial part of securing access to files and directories. Permissions are typically represented in both symbolic and octal formats. Here’s a breakdown of the symbolic representation:

1

-rw-r-x---

This translates to the following octal values:

  • User permissions: rw- or 6 (4 for read, 2 for write)
  • Group permissions: r-x or 5 (4 for read, 1 for execute)
  • Others permissions: --- or 0 (no permissions)

Calculating Octal Values

The octal value is calculated by adding the individual permission values together for each category (user, group, others):

1
2

-rw-rw----
110 110 0 = 432

Container Security: Separating Executors and Accessors

To enhance security, it’s important to separate the roles of executors and accessors within a containerized environment. This can be achieved by:

  1. Running processes as non-owners of the program files: This prevents the process from having more privileges than necessary, reducing the risk of unauthorized access or modification.
  2. Limiting process access to essential resources: Restricting the resources a process can use minimizes the potential impact of a security breach.
  3. Controlling access to sensitive operations: This includes network access, temporary file writing, log file writing, and more.

Implementing Security Contexts in Kubernetes

Kubernetes provides a securityContext field that allows you to specify the user and group IDs for running containers, ensuring that they have the appropriate permissions.

Example Kubernetes YAML Configuration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  containers:
  - name: web
    volumeMounts:
    - mountPath: /mnt/credentials
      name: storage-credentials
      readOnly: true
    securityContext:
      runAsUser: 1000
      runAsGroup: 1000
      runAsNonRoot: true
      fsGroup: 2000
      supplementalGroups:
      - 4000
  volumes:
  - name: storage-credentials
    secret:
      defaultMode: 432
      secretName: storage-credentials

Explanation

  • runAsUser and runAsGroup: These fields specify the user and group IDs under which the container process should run.
  • runAsNonRoot: This ensures that the container runs as a non-root user, enhancing security.
  • fsGroup: This sets the group ID for the filesystem, which is particularly useful for volume mounts.
  • supplementalGroups: This allows you to specify additional group IDs that the container process should be a part of.

Verifying Permissions

After applying the above configuration, you can verify the permissions and group memberships using the following commands:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

$ ls -l /mnt/credentials/..data/keyfile.json
-rw-rw---- 1 root 2000 2380 Sep  2 18:07 /mnt/credentials/..data/keyfile.json

$ ps -o uid,gid,rgid,supgid -p 1
  UID   GID  RGID SUPGID
 1000  1000  1000 100,1000,2000

$ id
uid=1000(app) gid=1000(app) groups=1000(app),100(users),2000

$ groups app
app : app users

$ getent group app
app:x:1000:

Conclusion

Fine-grained permission control is essential for maintaining the security of containerized applications. By understanding and implementing the appropriate security contexts and permissions, you can ensure that your containers run with the least privileges necessary, reducing the risk of unauthorized access and potential security breaches. Kubernetes provides powerful tools for managing these permissions, allowing you to create a secure and efficient containerized environment.

Reference

  • https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
  • https://www.redhat.com/sysadmin/suid-sgid-sticky-bit
  • https://www.binaryhexconverter.com/binary-to-decimal-converter
Security
container security
This post is licensed under CC BY 4.0 by the author.