容器安全-Namespaces

namespaces的使用情况

linux每个进程都有自己的namespaces，可以通过/proc/pid/ns来查看

# ll /proc/$$/ns
total 0
lrwxrwxrwx 1 root root 0 Jun  2 22:17 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 ipc -> 'ipc:[4026531839]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 mnt -> 'mnt:[4026531840]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 net -> 'net:[4026531992]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 pid -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 pid_for_children -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Jun  2 22:17 uts -> 'uts:[4026531838]'

容器的进程也有自己的namespaces

下载centos镜像
# docker pull centos
运行容器centos1
# docker run --name centos1  -td centos /bin/bash
查看容器的Pid
# docker inspect centos1 -f '{{.State.Pid}}'
98577
查看进程98577相关命名空间
# ll /proc/98577/ns
total 0
lrwxrwxrwx 1 root root 0 Jun  1 23:18 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 ipc -> 'ipc:[4026532960]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 mnt -> 'mnt:[4026532958]'
lrwxrwxrwx 1 root root 0 Jun  1 23:17 net -> 'net:[4026532963]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 pid -> 'pid:[4026532961]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 pid_for_children -> 'pid:[4026532961]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Jun  1 23:18 uts -> 'uts:[4026532959]'

可以看到大部分的namespace是不一样的，但是user是一样的，说明缺省docker并没有使用user namespace的隔离。

linux如何使用namespaces

查看进程1的ns

# ll /proc/1/ns/
total 0
lrwxrwxrwx 1 root root 0 Jun 14 22:21 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 ipc -> 'ipc:[4026531839]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 mnt -> 'mnt:[4026531840]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 net -> 'net:[4026531992]'
lrwxrwxrwx 1 root root 0 Jun 11 21:56 pid -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 pid_for_children -> 'pid:[4026531836]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Jun 14 22:21 uts -> 'uts:[4026531838]'

使用unshare，fork一个新的进程bash，采用新pid、mount-proc 命名空间

# unshare -f  -p --mount-proc bash
# ps -ef
UID         PID   PPID  C STIME TTY          TIME CMD
root          1      0  0 22:34 pts/0    00:00:00 bash
root         16      1  0 22:34 pts/0    00:00:00 ps -ef

新开一个终端，查看进程bash的ns,可以看到mnt和pid的ns已经发生变化

#  ll /proc/127371/ns
total 0
lrwxrwxrwx 1 root root 0 Jun 14 22:35 cgroup -> 'cgroup:[4026531835]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 ipc -> 'ipc:[4026531839]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 mnt -> 'mnt:[4026533227]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 net -> 'net:[4026531992]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 pid -> 'pid:[4026533228]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 pid_for_children -> 'pid:[4026533228]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 user -> 'user:[4026531837]'
lrwxrwxrwx 1 root root 0 Jun 14 22:35 uts -> 'uts:[4026531838]'

linux直接访问docker

docker容器是命名空间的组合，那么linux是否可以直接访问docker的命名空间呢？
以coredns为例，由于镜像的限制，没有bash或者sh，几乎无法执行任何命令.

# docker ps -a | grep coredns | head -n 1
b6826bb58785        70f311871ae1                                                    "/coredns -conf /etc…"   3 days ago          Up 3 days                                      k8s_coredns_coredns-7f9c544f75-j9bg2_kube-system_8015b244-d496-4639-821b-64d7ddeb2475_1

首先查看进程id

# docker inspect b6826bb58785 -f '{{.State.Pid}}'
4751

通过进入命名空间的方式，来查看IP

# nsenter -t 4751 -n ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
    link/ipip 0.0.0.0 brd 0.0.0.0
4: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1440 qdisc noqueue state UP group default
    link/ether 1a:72:e5:67:88:cc brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.16.137.92/32 scope global eth0
       valid_lft forever preferred_lft forever

通过进入命名空间的方式，来查看机器名

# nsenter -t 4751 -u hostname
coredns-7f9c544f75-j9bg2

由于ps是读取/proc文件系统的，需要同时进入mnt和pid命名空间，但是mnt中没有相关工具，所以无法查看。但是可以使用kill，renice等其他工具

# nsenter -t 4751 -p renice  -n -10 1
1 (process ID) old priority 0, new priority -10

#  ps -eo pid,user,args,ni | grep 4751 | grep -v grep
 52946 root     /coredns -conf /etc/coredns -10