Restrict a Container’s Access to Resources with AppArmor

FEATURE STATE: Kubernetes v1.4 [beta]

AppArmor is a Linux kernel security module that supplements the standard Linux user and group based permissions to confine programs to a limited set of resources. AppArmor can be configured for any application to reduce its potential attack surface and provide greater in-depth defense. It is configured through profiles tuned to allow the access needed by a specific program or container, such as Linux capabilities, network access, file permissions, etc. Each profile can be run in either enforcing mode, which blocks access to disallowed resources, or complain mode, which only reports violations.

On Kubernetes, AppArmor can help you to run a more secure deployment by restricting what containers are allowed to do, and/or provide better auditing through system logs. However, it is important to keep in mind that AppArmor is not a silver bullet and can only do so much to protect against exploits in your application code. It is important to provide good, restrictive profiles, and harden your applications and cluster from other angles as well.

Objectives

  • See an example of how to load a profile on a Node
  • Learn how to enforce the profile on a Pod
  • Learn how to check that the profile is loaded
  • See what happens when a profile is violated
  • See what happens when a profile cannot be loaded

Before you begin

AppArmor is an optional kernel module and Kubernetes feature, so verify it is supported on your Nodes before proceeding:

  1. AppArmor kernel module is enabled — For the Linux kernel to enforce an AppArmor profile, the AppArmor kernel module must be installed and enabled. Several distributions enable the module by default, such as Ubuntu and SUSE, and many others provide optional support. To check whether the module is enabled, check the /sys/module/apparmor/parameters/enabled file:

    1. cat /sys/module/apparmor/parameters/enabled
    2. Y

    The kubelet verifies that AppArmor is enabled on the host before admitting a pod with AppArmor explicitly configured.

  2. Container runtime supports AppArmor — All common Kubernetes-supported container runtimes should support AppArmor, including containerd and CRI-O. Please refer to the corresponding runtime documentation and verify that the cluster fulfills the requirements to use AppArmor.

  3. Profile is loaded — AppArmor is applied to a Pod by specifying an AppArmor profile that each container should be run with. If any of the specified profiles are not loaded in the kernel, the kubelet will reject the Pod. You can view which profiles are loaded on a node by checking the /sys/kernel/security/apparmor/profiles file. For example:

    1. ssh gke-test-default-pool-239f5d02-gyn2 "sudo cat /sys/kernel/security/apparmor/profiles | sort"
    1. apparmor-test-deny-write (enforce)
    2. apparmor-test-audit-write (enforce)
    3. docker-default (enforce)
    4. k8s-nginx (enforce)

    For more details on loading profiles on nodes, see Setting up nodes with profiles.

Securing a Pod

Note: Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.

AppArmor profiles can be specified at the pod level or container level. The container AppArmor profile takes precedence over the pod profile.

  1. securityContext:
  2.   appArmorProfile:
  3.     type: <profile_type>

Where <profile_type> is one of:

  • RuntimeDefault to use the runtime’s default profile
  • Localhost to use a profile loaded on the host (see below)
  • Unconfined to run without AppArmor

See the API Reference for the full details on the AppArmor profile API.

To verify that the profile was applied, you can check that the container’s root process is running with the correct profile by examining its proc attr:

  1. kubectl exec <pod_name> -- cat /proc/1/attr/current

The output should look something like this:

  1. cri-containerd.apparmor.d (enforce)

Example

This example assumes you have already set up a cluster with AppArmor support.

First, load the profile you want to use onto your Nodes. This profile blocks all file write operations:

  1. #include <tunables/global>
  3. profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  4.   #include <abstractions/base>
  6.   file,
  8.   # Deny all file writes.
  9.   deny /** w,
  10. }

The profile needs to loaded onto all nodes, since you don’t know where the pod will be scheduled. For this example you can use SSH to install the profiles, but other approaches are discussed in Setting up nodes with profiles.

  1. # This example assumes that node names match host names, and are reachable via SSH.
  2. NODES=($(kubectl get nodes -o name))
  4. for NODE in ${NODES[*]}; do ssh $NODE 'sudo apparmor_parser -q <<EOF
  5. #include <tunables/global>
  7. profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  8.   #include <abstractions/base>
  10.   file,
  12.   # Deny all file writes.
  13.   deny /** w,
  14. }
  15. EOF'
  16. done

Next, run a simple “Hello AppArmor” Pod with the deny-write profile:

pods/security/hello-apparmor.yamlRestrict a Container’s Access to Resources with AppArmor - 图1

  1. apiVersion: v1
  2. kind: Pod
  3. metadata:
  4.   name: hello-apparmor
  5. spec:
  6.   securityContext:
  7.     appArmorProfile:
  8.       type: Localhost
  9.       localhostProfile: k8s-apparmor-example-deny-write
  10.   containers:
  11.   - name: hello
  12.     image: busybox:1.28
  13.     command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
  1. kubectl create -f hello-apparmor.yaml

You can verify that the container is actually running with that profile by checking /proc/1/attr/current:

  1. kubectl exec hello-apparmor -- cat /proc/1/attr/current

The output should be:

  1. k8s-apparmor-example-deny-write (enforce)

Finally, you can see what happens if you violate the profile by writing to a file:

  1. kubectl exec hello-apparmor -- touch /tmp/test
  1. touch: /tmp/test: Permission denied
  2. error: error executing remote command: command terminated with non-zero exit code: Error executing in Docker Container: 1

To wrap up, see what happens if you try to specify a profile that hasn’t been loaded:

  1. kubectl create -f /dev/stdin <<EOF
  2. apiVersion: v1
  3. kind: Pod
  4. metadata:
  5.   name: hello-apparmor-2
  6. spec:
  7.   securityContext:
  8.     appArmorProfile:
  9.       type: Localhost
  10.       localhostProfile: k8s-apparmor-example-allow-write
  11.   containers:
  12.   - name: hello
  13.     image: busybox:1.28
  14.     command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
  15. EOF
  1. pod/hello-apparmor-2 created

Although the Pod was created successfully, further examination will show that it is stuck in pending:

  1. kubectl describe pod hello-apparmor-2
  1. Name:          hello-apparmor-2
  2. Namespace:     default
  3. Node:          gke-test-default-pool-239f5d02-x1kf/10.128.0.27
  4. Start Time:    Tue, 30 Aug 2016 17:58:56 -0700
  5. Labels:        <none>
  6. Annotations:   container.apparmor.security.beta.kubernetes.io/hello=localhost/k8s-apparmor-example-allow-write
  7. Status:        Pending
  8. ... 
  9. Events:
  10.   Type     Reason     Age              From               Message
  11.   ----     ------     ----             ----               -------
  12.   Normal   Scheduled  10s              default-scheduler  Successfully assigned default/hello-apparmor to gke-test-default-pool-239f5d02-x1kf
  13.   Normal   Pulled     8s               kubelet            Successfully pulled image "busybox:1.28" in 370.157088ms (370.172701ms including waiting)
  14.   Normal   Pulling    7s (x2 over 9s)  kubelet            Pulling image "busybox:1.28"
  15.   Warning  Failed     7s (x2 over 8s)  kubelet            Error: failed to get container spec opts: failed to generate apparmor spec opts: apparmor profile not found k8s-apparmor-example-allow-write
  16.   Normal   Pulled     7s               kubelet            Successfully pulled image "busybox:1.28" in 90.980331ms (91.005869ms including waiting)

An Event provides the error message with the reason, the specific wording is runtime-dependent:

  1.   Warning  Failed     7s (x2 over 8s)  kubelet            Error: failed to get container spec opts: failed to generate apparmor spec opts: apparmor profile not found

Administration

Setting up Nodes with profiles

Kubernetes 1.30 does not provide any built-in mechanisms for loading AppArmor profiles onto Nodes. Profiles can be loaded through custom infrastructure or tools like the Kubernetes Security Profiles Operator.

The scheduler is not aware of which profiles are loaded onto which Node, so the full set of profiles must be loaded onto every Node. An alternative approach is to add a Node label for each profile (or class of profiles) on the Node, and use a node selector to ensure the Pod is run on a Node with the required profile.

Authoring Profiles

Getting AppArmor profiles specified correctly can be a tricky business. Fortunately there are some tools to help with that:

  • aa-genprof and aa-logprof generate profile rules by monitoring an application’s activity and logs, and admitting the actions it takes. Further instructions are provided by the AppArmor documentation.
  • bane is an AppArmor profile generator for Docker that uses a simplified profile language.

To debug problems with AppArmor, you can check the system logs to see what, specifically, was denied. AppArmor logs verbose messages to dmesg, and errors can usually be found in the system logs or through journalctl. More information is provided in AppArmor failures.

Specifying AppArmor confinement

Caution: Prior to Kubernetes v1.30, AppArmor was specified through annotations. Use the documentation version selector to view the documentation with this deprecated API.

AppArmor profile within security context

You can specify the appArmorProfile on either a container’s securityContext or on a Pod’s securityContext. If the profile is set at the pod level, it will be used as the default profile for all containers in the pod (including init, sidecar, and ephemeral containers). If both a pod & container AppArmor profile are set, the container’s profile will be used.

An AppArmor profile has 2 fields:

type (required) - indicates which kind of AppArmor profile will be applied. Valid options are: - Localhost - a profile pre-loaded on the node (specified by localhostProfile). - RuntimeDefault - the container runtime’s default profile. - Unconfined - no AppArmor enforcement.

localhostProfile - The name of a profile loaded on the node that should be used. The profile must be preconfigured on the node to work. This option must be provided if and only if the type is Localhost.

What’s next

Additional resources: