Examkin

Soru

Zorluk: OrtaVirtualization and Containerization Security

A security engineer is hardening a shared Linux host operating system that runs containerized financial processing microservices. To minimize the risk of a container escape and kernel compromise, which TWO security mechanisms should the engineer implement to restrict container privileges and limit interaction with the host kernel?

  1. Apply custom seccomp (secure computing mode) profiles to restrict the system calls that container processes can issue to the host kernel.Cevap
  2. Configure Linux user namespaces to map container root accounts to unprivileged user IDs on the underlying host operating system.Cevap
  3. C
    Rely on standard container engine runtime boundaries to guarantee hardware-level isolation between tenant workloads equivalent to a Type-1 hypervisor.
  4. D
    Deploy an external network edge firewall to inspect and block unauthorized system call requests originating within the local container runtime engine.

Cevap

Applying custom seccomp profiles to restrict host kernel system calls and configuring Linux user namespaces to map container root accounts to unprivileged host users are the correct controls.
The correct controls are applying seccomp profiles and configuring user namespaces. Seccomp profiles limit the system calls containerized processes can make directly to the host kernel, significantly reducing kernel exploit vulnerabilities. User namespaces ensure that even if an application inside a container runs as root, it is mapped to a non-privileged account on the host OS, preventing root access on the host during a breakout.

Adım Adım Çözüm

1
Identify the primary threat vector in containerized shared-host architectures.
Containers share a single host kernel, making syscall interface restriction critical to preventing host compromise.
Restricting kernel interactions decreases the surface area available for container escape exploits.
2
Evaluate privilege boundary controls.
User namespaces remap internal container UIDs (such as UID 0) to unprivileged host UIDs.
This prevents container root processes from executing privileged actions on the host OS if container isolation fails.
3
Evaluate syscall restriction controls.
Seccomp limits which system calls can be made by processes within a container to the Linux kernel.
Disabling unused kernel syscalls blocks unauthorized low-level kernel interaction.

Anahtar Kavram

Kernel surface reduction and privilege isolation in container security
Bu soruyu puanla

Konular

Virtualization and Containerization Security

Bu konudan daha fazla soru