Examkin

Question

Difficulty: MediumVirtualization and Containerization Security

A software development team is deploying a microservice application using containerization on a shared Linux host operating system. To mitigate the risk of a compromised container issuing malicious system calls directly to the host OS kernel, the security administrator needs to restrict syscall availability for the container runtime environment. Which of the following is the most effective security control to achieve this requirement?

  1. Implementing a custom Secure Computing Mode (seccomp) profile for the container runtimeAnswer
  2. B
    Configuring control groups (cgroups) to provide hardware-level hypervisor boundary isolation
  3. C
    Establishing network perimeter firewalls to trust inter-container communications within the cluster subnet
  4. D
    Assigning role-based user access controls to verify container identity before permitting kernel execution

Answer

Implementing a custom Secure Computing Mode (seccomp) profile for the container runtime
Seccomp (Secure Computing Mode) is a security feature in the Linux kernel that allows an administrator to filter the system calls a container process can issue. By applying a restrictive seccomp profile, malicious or unnecessary syscalls are blocked before reaching the host kernel.

Step-by-Step Solution

1
Identify the primary threat vector in the scenario
A compromised process in a container invoking unauthorized host kernel system calls (syscalls).
Containers share the host operating system kernel, making kernel syscall exploitation a major privilege escalation vector.
2
Evaluate technical controls for limiting syscall access
Seccomp profiles allow administrators to define specific syscall whitelist/blacklist rules for processes.
Restricting syscalls via seccomp minimizes the attack surface against kernel-level vulnerabilities.
3
Differentiate seccomp from other container management mechanisms
cgroups limit resource allocation, namespaces isolate visibility, while seccomp restricts syscall capability.
Choosing the precise kernel restriction tool directly addresses system call privilege containment.

Key Concept

Container Hardening via System Call Filtering (Seccomp)
Estimated Time:1m 30s
Rate this question

Topics

Virtualization and Containerization Security

More questions from this topic