Collaborate Disseminate
I have created a pod whose container has the SYS_PTRACE capability (and the SYS_ADMIN)
When I am attempting to attach to another process,
gdb -p 12345
Attaching to process 12345
ptrace: Permission denied.
Why is that?
Continue reading ptrace: Permission denied with SYS_PTRACE capability
I have created a kubernetes pod. The container has the SYS_ADMIN capability.
I can see all host’s processes.
However I can not cat /proc/1/environ.
Why is that?
Continue reading Unable to vew /proc/1/environ despite having SYS_ADMIN capability
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
Linux cactus-ths 5.18.0-kali5-amd64 #1 SMP … Continue reading Explanation of capabilities: CAP_NET_BIND_SERVICE
I am doing some security research on Kubernetes and I found something still mysterious to me, concerning capabilities.
Example of simple pod:
apiVersion: v1
kind: Pod
metadata:
name: my-pod-httpd
spec:
containers:
– name: my-pod-http… Continue reading Capabilities DROP in container of Kubernetes pod running with specific UID
I have read that there are some capabilities that are broken out of CAP_SYS_ADMIN specifically CAP_BPF, CAP_NET_ADMIN, CAP_PERFMON etc. I also read that data structures called maps are used to store data and that other eBPF programs can re… Continue reading How to keep data in eBPF maps secure
I saw the recent CVE-2022-0492 that can enable container escape, and I have a decent understanding of cgroups and container capabilities, but not very familiar with how hybrid cgroup v1/v2 works, nor how cgroups and capabilities work toget… Continue reading Container escape – CVE-2022-0492 – hybrid cgroups?
From this answer I understand that seccomp-bpf filters the list of syscalls a process can call.
Similarly, the capabilites mechanism will cause a syscall to fail if the caller does not have the capability necessary for that syscall.
What I… Continue reading What additional protection does seccomp provide when compared to capabilites?
I understand that it is easier for a human to intuitively figure out the alleged whereabouts of a machine if that machin’s IP address is IPv6, rather than if its IPv4:
For example, since I configured my smartphone Access Poi… Continue reading Are IPv4 more intuitively hard to track than IPv6?
Under Ubuntu 16.04 LTS, I cannot seem to debug a once-privileged process for love or money as an unprivileged user.
The file is setgid (mode 2755). It forks, and the child:
releases its capabilities
calls setgid(getgid())
Yet, gd… Continue reading attach with gdb after dropping privileges
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
securityContext:
capabilities:
a… Continue reading What are the security implications of capabilities in Kubernetes pods?