An organization is modernizing its deployment architecture by hosting multiple containerized microservices on a shared host operating system. During a technical audit, a security analyst discovers that microservices run with standard system privileges, exposing the host operating system kernel to potential privilege escalation via unauthorized system calls if a container is compromised. Which of the following controls should the security team implement on the container host to restrict the specific system calls available to container processes?
- Apply custom Secure Computing Mode (seccomp) profiles to filter syscall access for container processes.Cevap
- BRely on default container runtime namespaces, as container engines automatically instantiate independent kernel instances for each container.
- CDeploy an inline perimeter web application firewall to inspect and block unauthorized kernel system call invocations.
- DEnforce Role-Based Access Control policies in the container image registry to restrict user authentication during build pipelines.
Cevap
Apply custom Secure Computing Mode (seccomp) profiles to filter syscall access for container processes.
Applying Secure Computing Mode (seccomp) profiles allows administrators to define explicit whitelist filters for system calls (syscalls). Since containers share the underlying host kernel, restricting unneeded syscalls effectively mitigates kernel privilege escalation and container escape attacks.
Adım Adım Çözüm
Anahtar Kavram
Kernel System Call Filtering (Seccomp) in Container Security