3

I have started an unprivileged docker container and trying to start the privileged exec session. It has CAP_SYS_MODULE capabilities, but still, I am getting operations not permitted in insmod.

docker start -it -d --name test ubuntu
docker exec -it --privileged test sh
...
/ # insmod shell.ko
insmod: ERROR: could not insert module reverse-shell.ko: Operation not permitted

Then I tried to start the container with seccomp unconfined and executed the same commands and it is working

docker start -it -d --security-opts seccomp=unconfined --name test2 ubuntu
docker exec -it --privileged test2 sh
...
/ # insmod shell.ko

Now coming back to the seccomp, I see it blocks the syscalls based on the default profile from moby, where I see the finit_module is allowed. So why did my kernel module didn't loaded the first time with the seccomp confined container?

Improve this question
4
  • have you run insmod under strace to see which syscall was blocked? Maybe finit_module was not the problem but some check before that?
    – amon
    Commented May 3, 2022 at 14:08
  • I found no problem until the program tried open the kernel object. openat("/root/shell.ko"....) = 3
    – tbhaxor
    Commented May 3, 2022 at 18:47
  • But openat(...) = 3 means that openat completed successfully. Which syscalls does strace tell you are actually failing and with what error code? If strace does show finit_module(...) = -1 EPERM then this means that either Docker's seccomp profile is behaving differently than expected, or that the process running with the container doesn't actually have CAP_SYS_MODULE. You can inspect current capabilities with capsh --print, or more directly here capsh --has-p=cap_sys_module; echo $? (should have exit code 0).
    – amon
    Commented May 3, 2022 at 19:25
  • it does have the privileges. docker exec -it --privileged <name> sh do add all the caps. What's confusing is that on the docker page, it says finit_module is blocked in default but in the default.json it is allowed.
    – tbhaxor
    Commented May 3, 2022 at 20:05

1 Answer 1

Reset to default
3

The answer to this appears to be a couple of things. Firstly when you start a non-privileged container and then exec into it with privilege, the seccomp filter is still enabled. Second one is that the seccomp profile does block the finit_module call.

The output below shows a re-creation of what I think you were going for in the first setup. Using amicontained it's possible to look at the blocked syscalls in the privileged exec shell and we can see (if you scroll a long way to the right :) ) that FINIT_MODULE is blocked.

❯ docker run -d --name test raesene/alpine-containertools
c5c7a7b95ea0e531450b8843c85db0f54f7997ddb8273c8f97ae9bd0376685ab

rorym in 🌐 cuilean in  ⛵ kadmin@kubeadm2node () ~
❯ docker exec -it --privileged test /bin/bash
bash-5.1# amicontained
Container Runtime: not-found
Has Namespaces:
    pid: true
    user: false
AppArmor Profile: docker-default (enforce)
Capabilities:
    BOUNDING -> chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read
Seccomp: filtering
Blocked Syscalls (59):
    SYSLOG SETSID USELIB USTAT SYSFS VHANGUP PIVOT_ROOT _SYSCTL ACCT SETTIMEOFDAY MOUNT UMOUNT2 SWAPON SWAPOFF REBOOT SETHOSTNAME SETDOMAINNAME IOPL IOPERM CREATE_MODULE INIT_MODULE DELETE_MODULE GET_KERNEL_SYMS QUERY_MODULE QUOTACTL NFSSERVCTL GETPMSG PUTPMSG AFS_SYSCALL TUXCALL SECURITY LOOKUP_DCOOKIE CLOCK_SETTIME VSERVER MBIND SET_MEMPOLICY GET_MEMPOLICY KEXEC_LOAD ADD_KEY REQUEST_KEY KEYCTL MIGRATE_PAGES UNSHARE MOVE_PAGES PERF_EVENT_OPEN FANOTIFY_INIT NAME_TO_HANDLE_AT OPEN_BY_HANDLE_AT SETNS PROCESS_VM_READV PROCESS_VM_WRITEV KCMP FINIT_MODULE KEXEC_FILE_LOAD BPF USERFAULTFD PKEY_MPROTECT PKEY_ALLOC PKEY_FREE
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .