Skip to content

Commit

Permalink
docs: add monitor creds caps usage
Browse files Browse the repository at this point in the history 
Signed-off-by: Djalal Harouni <[email protected]>
  • Loading branch information
@tixxdz
tixxdz committed Jul 12, 2023
1 parent f9700b0 commit ddaebe9
Showing 1 changed file with 234 additions and 0 deletions.
234 changes: 234 additions & 0 deletions ...ntent/en/docs/use-cases/linux-process-credentials/monitor-linux-capabilities.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,234 @@
---
title: "Monitor Linux Capabilities Usage"
weight: 5
icon: "overview"
description: "Monitor Capability checks performed by the kernel"
---

When a process perfroms a privileged operation, the kernel will carry out a permission check
on that process and issue a verdict to allow or deny that same operation according to the
process [Capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html).

Tetragon is able to monitor such [Capability](https://man7.org/linux/man-pages/man7/capabilities.7.html)
checks performed by the kernel.

This answers the questions:

> What capabilities are being triggered by a process or a container in my Kubernetes cluster?
> I want to [configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) and
restrict the [capabilities of my containers](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container), but what capabilities should I add or remove?


Before going forward, verify that all pods are up and running, ensure you deploy our Demo Application to explore the Security Observability Events:

```bash
kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.11/examples/minikube/http-sw-app.yaml
```

It might take several seconds for some pods until they satisfy all the dependencies:

```bash
kubectl get pods -A
NAMESPACE NAME READY STATUS RESTARTS AGE
default deathstar-54bb8475cc-6c6lc 1/1 Running 0 2m54s
default deathstar-54bb8475cc-zmfkr 1/1 Running 0 2m54s
default tiefighter 1/1 Running 0 2m54s
default xwing 1/1 Running 0 2m54s
kube-system tetragon-sdwv6 2/2 Running 0 27m
```

## Monitor Capability Checks

We use the [creds-capability-usage](https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml) Tracing Policy that will generate a [ProcessKprobe](https://tetragon.cilium.io/docs/reference/grpc-api/#processkprobe) event.

{{< note >}}
The capability checks are triggered on behalf of applications when they perform some privileged operations, this means that such Tracing Policies may generate a high number of events.

In order to reduce the number of events, the [creds-capability-usage](https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml) rate limit the same event to 1 minute.
{{< /note >}}

Now let's apply the [creds-capability-usage](https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml) Tracing Policy.

```bash
kubectl apply -f https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml

```

Then we start monitoring for events with `tetra` cli:
```bash
kubectl exec -it -n kube-system ds/tetragon -c tetragon -- tetra getevents
```

In another terminal, kubectl exec into the xwing pod:

```bash
kubectl exec -it xwing -- /bin/bash
```

As an example execute [dmesg](https://man7.org/linux/man-pages/man1/dmesg.1.html) to try to print the kernel ring buffer. This requires the special capability `CAP_SYSLOG`:

```bash
dmesg
dmesg: klogctl: Operation not permitted
```

The `tetra` cli will generate the following [ProcessKprobe](https://tetragon.cilium.io/docs/reference/grpc-api/#processkprobe) events:

```json
{
"process_kprobe": {
"process": {
"exec_id": "a2luZC1jb250cm9sLXBsYW5lOjEyODQyNzgzMzUwNjg0OjczODYw",
"pid": 73860,
"uid": 0,
"cwd": "/",
"binary": "/bin/dmesg",
"flags": "execve rootcwd clone",
"start_time": "2023-07-06T10:13:33.834390020Z",
"auid": 4294967295,
"pod": {
"namespace": "default",
"name": "xwing",
"container": {
"id": "containerd://cfb961400ff25811d22d139a10f6a62efef53c2ecc11af47bc911a7f9a2ac1f7",
"name": "spaceship",
"image": {
"id": "docker.io/tgraf/netperf@sha256:8e86f744bfea165fd4ce68caa05abc96500f40130b857773186401926af7e9e6",
"name": "docker.io/tgraf/netperf:latest"
},
"start_time": "2023-07-06T08:07:30Z",
"pid": 171
},
"pod_labels": {
"app.kubernetes.io/name": "xwing",
"class": "xwing",
"org": "alliance"
}
},
"docker": "cfb961400ff25811d22d139a10f6a62",
"parent_exec_id": "a2luZC1jb250cm9sLXBsYW5lOjEyODQyMTI3MTIwOTcyOjczODUw",
"refcnt": 1,
"ns": {
"uts": {
"inum": 4026534655
},
"ipc": {
"inum": 4026534656
},
"mnt": {
"inum": 4026534731
},
"pid": {
"inum": 4026534732
},
"pid_for_children": {
"inum": 4026534732
},
"net": {
"inum": 4026534512
},
"time": {
"inum": 4026531834,
"is_host": true
},
"time_for_children": {
"inum": 4026531834,
"is_host": true
},
"cgroup": {
"inum": 4026534733
},
"user": {
"inum": 4026531837,
"is_host": true
}
},
"tid": 73860
},
"parent": {
"exec_id": "a2luZC1jb250cm9sLXBsYW5lOjEyODQyMTI3MTIwOTcyOjczODUw",
"pid": 73850,
"uid": 0,
"cwd": "/",
"binary": "/bin/bash",
"flags": "execve rootcwd clone",
"start_time": "2023-07-06T10:13:33.178160018Z",
"auid": 4294967295,
"pod": {
"namespace": "default",
"name": "xwing",
"container": {
"id": "containerd://cfb961400ff25811d22d139a10f6a62efef53c2ecc11af47bc911a7f9a2ac1f7",
"name": "spaceship",
"image": {
"id": "docker.io/tgraf/netperf@sha256:8e86f744bfea165fd4ce68caa05abc96500f40130b857773186401926af7e9e6",
"name": "docker.io/tgraf/netperf:latest"
},
"start_time": "2023-07-06T08:07:30Z",
"pid": 165
},
"pod_labels": {
"app.kubernetes.io/name": "xwing",
"class": "xwing",
"org": "alliance"
}
},
"docker": "cfb961400ff25811d22d139a10f6a62",
"parent_exec_id": "a2luZC1jb250cm9sLXBsYW5lOjEyODQyMDgxNTA3MzUzOjczODQx",
"refcnt": 2,
"tid": 73850
},
"function_name": "cap_capable",
"args": [
{
"user_namespace_arg": {
"level": 0,
"uid": 0,
"gid": 0,
"ns": {
"inum": 4026531837,
"is_host": true
}
}
},
{
"capability_arg": {
"value": 34,
"name": "CAP_SYSLOG"
}
}
],
"return": {
"int_arg": -1
},
"action": "KPROBE_ACTION_POST"
},
"node_name": "kind-control-plane",
"time": "2023-07-06T10:13:33.834882128Z"
}
```

In addition to the Kubernetes Identity and process metadata from exec events, [ProcessKprobe](https://tetragon.cilium.io/docs/reference/grpc-api/#processkprobe) events contain the arguments of the observed system call. In the above case they are:

* `function_name`: that is the `cap_capable` kernel function.

* `user_namespace_arg`: is the [user namespace](https://tetragon.cilium.io/docs/reference/grpc-api/#usernamespace) where the capability is required.

* `level`: is the nested level of the user namespace. Here it is zero which indicates the initial user namespace.
* `uid`: is the user ID of the owner of the user namespace.
* `gid`: is the group ID of the owner of the user namespace.
* [ns](https://tetragon.cilium.io/docs/reference/grpc-api/#namespace): details the information about the namespace, the `is_host` indicates that the target user namespace where the capability is required is the host namespace.

* `capability_arg`: is the capability required to perform the operation. In this example reading the kernel ring buffer.

* `value`: is the integer number of the required capability.
* `name`: is the name of the required capability. Here it is the `CAP_SYSLOG`.

* `return`: indicates via the `int_arg` that is an integer value, if the capability check succeeded or failed. Here `-1` means that it failed and the operation was denied by the kernel.

To disable the [creds-capability-usage](https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml) run:

```bash
kubectl delete -f https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/process-credentials/creds-capability-usage.yaml
```

0 comments on commit ddaebe9

Please sign in to comment.