30
votes
Docker: when to use apparmor vs seccomp vs --cap-drop
You can use all of them.
Each of these security features have different purposes, and there is actually little overlap. They all function to reduce the damage that a process can cause once it has been ...
- 67.3k
21
votes
Accepted
Difference between linux capabities and seccomp
I want to know exact difference between linux capabilities and seccomp.
I'll explain the exact differences below, but here's the general explanation: Capabilities involve various checks in kernel ...
- 67.3k
8
votes
Docker: when to use apparmor vs seccomp vs --cap-drop
Well answered by @forest, but I'd like to add a few suggestions that reflect my view on security frameworks and security design in general.
Enforcing security goes in hand with knowing what you are ...
- 81
4
votes
Accepted
What additional protection does seccomp provide when compared to capabilites?
Seccomp and capabilites serve different purposes, for starters. Capabilities are used to add slices of root privilege to an otherwise unprivileged process. By contrast, seccomp removes the ability to ...
- 13.2k
3
votes
Accepted
Why I am unable to execute insmod on the docker container?
The answer to this appears to be a couple of things. Firstly when you start a non-privileged container and then exec into it with privilege, the seccomp filter is still enabled. Second one is that the ...
- 62.6k
2
votes
Accepted
Syscalls are disabled with seccomp. What attacks are still possible? How to prevent them?
Depends what file descriptors the process has open, and a few other things. Here are some likely possibilities:
Denial of Service
RAM exhaustion: if RAM allocation is unrestricted, just allocate as ...
- 52.1k
1
vote
Accepted
How to blacklist parent dir and whitelist child dir in firejail
The reason that that you can't blacklist the directory (despite explicilty calling it) is because it's being overridden by the default profile
Use this command to disable default profiles, and it will ...
- 1,090
1
vote
Syscalls are disabled with seccomp. What attacks are still possible? How to prevent them?
It really depends on what the file descriptors are connected to.
If they're connected to a terminal, they could be used to modify the terminal including, depending on the configuration of the terminal,...
- 9,712
1
vote
Is it possible to use systemd seccomp filtering for running applications from command line?
I don't believe this is possible with systemd. Even if it were, it wouldn't be particularly useful because many libc (and other common library) initialization routines use syscalls that the program ...
- 67.3k
1
vote
Opt-in a security profile at runtime, without tedious setup
Not really what you want, but more closer variant is:
normal@user:$ aa-exec -p restricted_books booyah
In this scenrio you still need:
Enabling AppArmor
Writing a profile
Registering profile
But ...
- 96
Only top scored, non community-wiki answers of a minimum length are eligible