Let say you want to prove to your security team that running a pod in Red Hat OpenShift is really removing capabilities from the running container. \u00a0There is not much documentation out there which explains how to find what capabilities get stripped so I will walk you through how you can make the case.<\/p>\n
Step 1<\/strong>. Choose the pod you want to inspect in OpenShift<\/p>\n Step 2<\/strong>. We see that the container runs on host100. So lets login to host100 and see if this container is running<\/p>\n We see that the sha 94b796d20631098724552427211e673a88f442faca3405c63bbe03db13ff8984<\/strong> of the container image is matching<\/p>\n Step 3<\/strong>. Now we need to get the pid of the running container process<\/p>\n Step 4<\/strong>. Lets find the CapBnd.<\/p>\n Step 5<\/strong>. We now translate that\u00a000000000a80425fb into something readable.<\/p>\n Step 6<\/strong>. So what are all capabilities?<\/p>\n Step 7<\/strong>. That means that the following capabilities were removed on launch:<\/p>\n -cap_dac_read_search Let say you want to prove to your security team that running a pod in Red Hat OpenShift is really removing capabilities from the running container. \u00a0There is not much documentation out there which explains how to find what capabilities get stripped so I will walk you through how you can make the case. Step…<\/p>\n","protected":false},"author":2,"featured_media":2025,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[76],"tags":[121,122,55,120,119],"class_list":["post-2115","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-openshift","tag-capbnd","tag-capsh","tag-openshift","tag-seccomp","tag-security"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2115"}],"version-history":[{"count":4,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2115\/revisions"}],"predecessor-version":[{"id":2463,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/2115\/revisions\/2463"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/2025"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}[root@osemaster log]# oc describe pod box-1-wkxdh\r\n\r\nName: box-1-wkxdh\r\n\r\nNamespace: box\r\n\r\nSecurity Policy: restricted\r\n\r\nNode: host100.rdu.salab.redhat.com\/10.11.164.100\r\n\r\nStart Time: Fri, 21 Jul 2017 16:09:35 -0400\r\n\r\nLabels: app=box\r\n\r\ndeployment=box-1\r\n\r\ndeploymentconfig=box\r\n\r\nStatus: Running\r\n\r\nIP: 10.129.1.29\r\n\r\nControllers: ReplicationController\/box-1\r\nContainers:\r\n\u00a0 box:\r\n\u00a0 \u00a0 Container ID: docker:\/\/0f1596822c5b73159a37c96145d96e1b966fafb4496c630b294dff8237b2925e\r\n\u00a0 \u00a0 Image: 172.30.94.61:5000\/box\/box@sha256:94b796d20631098724552427211e673a88f442faca3405c63bbe03db13ff8984\r\n\u00a0 \u00a0 Image ID: docker-pullable:\/\/172.30.94.61:5000\/box\/box@sha256:94b796d20631098724552427211e673a88f442faca3405c63bbe03db13ff8984<\/pre>\n
[root@host100 ~]# docker ps | grep 84\r\n0f1596822c5b 172.30.94.61:5000\/box\/box@sha256:94b796d20631098724552427211e673a88f442faca3405c63bbe03db13ff8984 \"container-entrypoint\" 7 weeks ago Up 7 weeks k8s_box.caa9b8b4_box-1-wkxdh_box_80b5e05d-6e50-11e7-90e0-001a4a16016f_f37a14e0\r\n<\/pre>\n
[root@host100 ~]# docker inspect a2ff442a9381 | grep -i Pid | head -1\r\n\r\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \"Pid\": 41086,<\/pre>\n
[root@host100 ~]# cat \/proc\/41086\/status | grep CapBnd\r\nCapBnd:\t00000000a80425fb<\/pre>\n
[root@host100 ~]# capsh --decode=00000000a80425fb\r\n0x00000000a80425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap<\/pre>\n
[root@host100 ~]# capsh --decode=0x0000001fffffffff\r\n0x0000001fffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,35,36<\/pre>\n
\n-cap_linux_immutable
\n-cap_net_broadcast
\n–cap_net_admin<\/strong>
\n-cap_ipc_lock
\n-cap_ipc_owner
\n-cap_sys_module
\n-cap_sys_rawio
\n-cap_sys_ptrace
\n-cap_sys_pacct
\n–cap_sys_admin<\/strong>
\n-cap_sys_boot
\n-cap_sys_nice
\n-cap_sys_resource
\n-cap_sys_time
\n-cap_sys_tty_config
\n-cap_lease
\n-cap_audit_control
\n-cap_mac_override
\n-cap_mac_admin
\n-cap_syslog
\n-cap_wake_alarm
\n-cap_block_suspend<\/p>\n","protected":false},"excerpt":{"rendered":"