30 votes

Docker: when to use apparmor vs seccomp vs --cap-drop

You can use all of them. Each of these security features have different purposes, and there is actually little overlap. They all function to reduce the damage that a process can cause once it has been ...
forest's user avatar
  • 66.7k
20 votes
Accepted

Difference between linux capabities and seccomp

I want to know exact difference between linux capabilities and seccomp. I'll explain the exact differences below, but here's the general explanation: Capabilities involve various checks in kernel ...
forest's user avatar
  • 66.7k
8 votes

Docker: when to use apparmor vs seccomp vs --cap-drop

Well answered by @forest, but I'd like to add a few suggestions that reflect my view on security frameworks and security design in general. Enforcing security goes in hand with knowing what you are ...
Butshuti's user avatar
5 votes

Explanation of capabilities: CAP_NET_BIND_SERVICE

Ok I understood ... Maybe it will help someone who encounters the same situation. Privileged ports numbers are registered at system level, but configurable. In my case, all TCP ports were unprivileged:...
cactuschibre's user avatar
4 votes

Making a file immutable (against kernel exploits)

If the kernel is exploited then any software based constraints on file access can be bypassed. Using an encrypted filesystem would prevent someone from booting up from a USB key or removable media, ...
symcbean's user avatar
  • 18.6k
4 votes
Accepted

Are IPv4 more intuitively hard to track than IPv6?

An IP address does not inherently represent a geographic location. An IP address space is owned by a company and this company is using an IP address for a specific purpose which is often tied to a ...
Steffen Ullrich's user avatar
4 votes
Accepted

What additional protection does seccomp provide when compared to capabilites?

Seccomp and capabilites serve different purposes, for starters. Capabilities are used to add slices of root privilege to an otherwise unprivileged process. By contrast, seccomp removes the ability to ...
multithr3at3d's user avatar
3 votes

Privilege escalation writing /etc/passwd but without SUID permission on su

On a standard Linux host (VM or server) if you have access to /etc/passwd or /etc/shadow then you can modify or add credentials to accounts, which would obviously be a serious problem (there's details ...
Rory McCune's user avatar
  • 62.3k
2 votes
Accepted

Are Linux System Capabilities Considered Mandatory Access Controls?

Generally capabilities are a good way of implementing a Mandatory Access Control system (see Eros OS, for example). The Linux system capabilities affect objects which can be under both DAC and MAC. ...
Michael's user avatar
  • 236
2 votes
Accepted

Security implications of using SETCAP CAP_NET_RAW

Capabilities are described in the capabilities(7) manpage. To summarize and security-wise: CAP_NET_RAW: Any kind of packet can be forged, which includes faking senders, sending malformed packets, ...
WhiteWinterWolf's user avatar
2 votes

How to keep data in eBPF maps secure

Prior to Linux 5.8, eBPF access was governed using either CAP_SYS_ADMIN or uid 0 (root) permissions. Since then, access control has been fine grained into more capabilities. Current kernel versions ...
Nummer378's user avatar
  • 186
1 vote
Accepted

Capabilities DROP in container of Kubernetes pod running with specific UID

So there's a couple of things at play here. First thing is that CAP_SETUID is in the default set for Docker/Containerd environments, so generally in Kubernetes you'll have that and adding it won't ...
Rory McCune's user avatar
  • 62.3k
1 vote
Accepted

Container escape - CVE-2022-0492 - hybrid cgroups?

However, looking at the commit the vulnerable code is only related to cgroups v1. Yes. not very familiar with how hybrid cgroup v1/v2 works, nor how cgroups and capabilities work together. Check ...
PotatoChips's user avatar
1 vote

What are the security implications of capabilities in Kubernetes pods?

For this I think it's quite probably that a rogue process running with that capability would be able to affect the underlying host, if only indirectly. From this man page we can see that ...
Rory McCune's user avatar
  • 62.3k
1 vote
Accepted

Why do capability-based security systems protect against the confused deputy problem?

You are correct in a sense. The root of the problem generally speaking is that the abused subject tends to have broad authority, it's not constrained. If the subject was only permitted to act based on ...
Marinus's user avatar
  • 206
1 vote

Use of S/MIME capabilities attribute

The client usually supports more ciphers than it announces because there is a difference between both. One thing is the capabilities - maybe a better name would be preferences - being a list of those ...
not2savvy's user avatar
  • 754

Only top scored, non community-wiki answers of a minimum length are eligible