---
# System prepended metadata

title: securityContext
tags: [K8S]

---

# securityContext

## 驗證 allowPrivilegeEscalation
* 它可以防止 container 內的子程序獲得比其父程序更多的權限
```
$ echo 'apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test
  name: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      securityContext:        # 這邊是全域宣告，代表這裡有多少 container 都會宣告這個設定
        runAsUser: 1000
      containers:
      - image: quay.io/cloudwalker/alp.kadm
        name: test
        tty: true
        securityContext:
          allowPrivilegeEscalation: false' | kubectl apply -f -

$ kubectl get po
NAME                    READY   STATUS             RESTARTS       AGE
test-6b77d94ff4-bd8vs   1/1     Running            0              119s

$ kubectl exec -it test-6b77d94ff4-bd8vs -- bash

$ whoami
bigred

# 不允許使用者以 sudo 身分執行任何命令
$ sudo touch /test
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

$ sudo su
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.
```

## privileged

* 先建立 `privileged: true` 權限的 pod
```
$ echo 'apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test
  name: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      securityContext:
        runAsUser: 1000
      containers:
      - image: quay.io/cloudwalker/alp.kadm
        name: test
        tty: true
        securityContext:
          privileged: true' | kubectl apply -f -
```

```
$ kubectl get po
NAME                    READY   STATUS             RESTARTS        AGE
test-7665f7bc97-j92t4   1/1     Running            0               39s

$ kubectl exec -it test-7665f7bc97-j92t4 -- bash
```

* 檢查目前有哪些能力
```
$ capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore
Ambient set =
Current IAB:
Securebits: 00/0x0/1'b0 (no-new-privs=0)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1000(bigred) euid=1000(bigred)
gid=10(wheel)
groups=10(wheel)
Guessed mode: HYBRID (4)
```
* 改改權限 `privileged: false`
```
$ echo 'apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test
  name: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      securityContext:
        runAsUser: 1000
      containers:
      - image: quay.io/cloudwalker/alp.kadm
        name: test
        tty: true
        securityContext:
          privileged: false' | kubectl apply -f -
```

```
$ kubectl get po
NAME                    READY   STATUS             RESTARTS       AGE
test-5d7886bdb6-jx858   1/1     Running            0              40s

$ kubectl exec -it test-5d7886bdb6-jx858 -- bash
```
* 此時檢查已經被拿掉非常多的 capabilities
```
# Current IAB  以下這些有有驚嘆號代表都是不可用的 capabilities
$ capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap
Ambient set =
Current IAB: !cap_dac_read_search,!cap_linux_immutable,!cap_net_broadcast,!cap_net_admin,!cap_ipc_lock,!cap_ipc_owner,!cap_sys_module,!cap_sys_rawio,!cap_sys_ptrace,!cap_sys_pacct,!cap_sys_admin,!cap_sys_boot,!cap_sys_nice,!cap_sys_resource,!cap_sys_time,!cap_sys_tty_config,!cap_lease,!cap_audit_control,!cap_mac_override,!cap_mac_admin,!cap_syslog,!cap_wake_alarm,!cap_block_suspend,!cap_audit_read,!cap_perfmon,!cap_bpf,!cap_checkpoint_restore
Securebits: 00/0x0/1'b0 (no-new-privs=0)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1000(bigred) euid=1000(bigred)
gid=10(wheel)
groups=10(wheel)
Guessed mode: HYBRID (4)
```

## 示範拿掉所有 capabilities 且無法使用 sudo 提權

```
$ echo 'apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test
  name: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      securityContext:
        runAsUser: 1000
      containers:
      - image: quay.io/cloudwalker/alp.kadm
        name: test
        tty: true
        securityContext:
          privileged: false
          allowPrivilegeEscalation: false
          capabilities:
             drop:
               - ALL' | kubectl apply -f -
```

```
$ kubectl get po
NAME                    READY   STATUS    RESTARTS   AGE
test-54b45668df-2nn97   1/1     Running   0          48s

$ kubectl exec -it test-54b45668df-2nn97 -- bash
```

```
$ capsh --print
Current: =
Bounding set =
Ambient set =
Current IAB: !cap_chown,!cap_dac_override,!cap_dac_read_search,!cap_fowner,!cap_fsetid,!cap_kill,!cap_setgid,!cap_setuid,!cap_setpcap,!cap_linux_immutable,!cap_net_bind_service,!cap_net_broadcast,!cap_net_admin,!cap_net_raw,!cap_ipc_lock,!cap_ipc_owner,!cap_sys_module,!cap_sys_rawio,!cap_sys_chroot,!cap_sys_ptrace,!cap_sys_pacct,!cap_sys_admin,!cap_sys_boot,!cap_sys_nice,!cap_sys_resource,!cap_sys_time,!cap_sys_tty_config,!cap_mknod,!cap_lease,!cap_audit_write,!cap_audit_control,!cap_setfcap,!cap_mac_override,!cap_mac_admin,!cap_syslog,!cap_wake_alarm,!cap_block_suspend,!cap_audit_read,!cap_perfmon,!cap_bpf,!cap_checkpoint_restore
Securebits: 00/0x0/1'b0 (no-new-privs=1)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1000(bigred) euid=1000(bigred)
gid=10(wheel)
groups=10(wheel)
Guessed mode: HYBRID (4)

$ sudo su
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.
```
## 參考文件

https://www.golinuxcloud.com/kubernetes-privileged-pod-examples/

