CND (312-38) Network Defense Simulation
Network Scenario
Environment: Enterprise Kubernetes Cluster (Production)
Incident Context: John, a senior network security administrator, is reviewing the security posture of the company's containerized web applications. During a routine audit, he notices that a compromised web container recently attempted to execute unusual system commands, indicating an attacker was trying to map the host kernel memory and inject code into other processes.
Objective: Apply a defense-in-depth strategy by enforcing strict isolation limits. John needs to implement a control that blocks specific, unnecessary system calls (syscalls) from being requested by container binaries in the first place.
Traffic & Logs
*Note: The log shows that process 1295 attempted to use the ptrace syscall, which is heavily restricted by default security profiles in modern container runtimes to prevent container breakout.
Question
John is a senior network security administrator working at a multinational company. He wants to block specific syscalls from being used by container binaries. Which Linux kernel feature restricts actions within the container?
Think about "Secure Computing Mode"—a facility in the Linux kernel that allows a process to make a one-way transition into a restricted state where it can only make specific, allowed system calls.
Expert Analysis
1. What is happening: An attacker who compromised a web container (running as user `www-data` or UID 33) spawned a shell and attempted to execute `ptrace` (syscall 101). This is a common precursor to container escape techniques, attempting to inject shellcode into host processes.
2. Identify attack or behavior: Container Breakout / Privilege Escalation. The attacker is trying to abuse Linux system calls that the containerized application (like a standard web server) normally has no legitimate business calling.
3. Why correct answer is correct (C - Seccomp): Seccomp (Secure Computing) is a Linux kernel feature used to restrict the system calls that a process can make. In container environments like Docker or Kubernetes, seccomp profiles (using BPF filters) are applied to allow only necessary syscalls and block dangerous ones (like `ptrace`, `kcmp`, `bpf`), immediately terminating the process if a violation occurs.
4. Why others are wrong:
- A. Cgroups (Control Groups): Restrict resource usage (CPU, Memory, Disk I/O), not system calls.
- B. LSMs (Linux Security Modules): Frameworks like AppArmor or SELinux enforce Mandatory Access Control (MAC) over files and network resources, but they operate differently than explicit syscall filtering.
- D. Userns (User Namespaces): Provide isolation by mapping a privileged user ID (like root) inside the container to an unprivileged user ID on the host system.
- Namespaces: Determine what a container can see (Process IDs, Mount points, Network interfaces).
- Cgroups: Determine how much a container can use (Hardware resources).
- Seccomp: Determines what a container can ask the kernel to do (System calls).
- Capabilities: Break down the binary "root" privileges into distinct, manageable units (e.g.,
CAP_NET_BIND_SERVICE).