During a security audit following an incident attempt on a containerized microservices environment, an analyst discovers that an attacker successfully gained remote code execution within a running container process. However, when the attacker attempted to modify system clock settings and mount host storage volumes, the operations failed because administrative privilege flags were restricted at the kernel level by the container runtime engine. Which security mechanism directly prevented the container process from performing these high-privilege host kernel operations?
- Linux kernel capability stripping (such as dropping CAP_SYS_ADMIN)Answer
- BType-1 bare-metal hypervisor hardware isolation
- CPerimeter network firewall microsegmentation rules
- DUser identity authentication within the access management provider
Answer
Linux kernel capability stripping (such as dropping CAP_SYS_ADMIN) restricts containerized processes from performing administrative kernel operations.
The correct option correctly identifies Linux kernel capabilities as the security control responsible for breaking root power into granular permissions. By dropping capabilities such as CAP_SYS_ADMIN from the container runtime profile, the host kernel refuses requests to mount filesystems or alter system clocks even if the process operates as root inside the container.
Step-by-Step Solution
Key Concept
Linux Kernel Capabilities and Container Privilege Restriction