Change seccomp default to 'docker/default' #39845

timstclair · 2017-01-13T03:26:52Z

Seccomp is currently defaulted to unconfined on docker:

kubernetes/pkg/kubelet/dockertools/docker_manager.go

Line 120 in 9a88687

defaultSeccompOpt = []dockerOpt{{"seccomp", "unconfined", ""}}

I believe this is for historical reasons, from #21790. However, we now have the ability (albeit alpha) to control seccomp profiles, so we should change the default to the more secure docker/default option. This profile is carefully curated, and should provide enhanced security without breaking the majority of users. Unfortunately "the majority" is not "everybody", so changing this default would be a breaking change, and care needs to be taken when rolling it out.

This may also need to wait for seccomp to be promoted to beta.

@vishh @pmorie @kubernetes/sig-node-misc

The text was updated successfully, but these errors were encountered:

jessfraz · 2017-02-14T22:33:58Z

fwiw when we launched it with docker i tested all the publically available dockerfiles on github and docker hub with it...

so it was not done without much testing, we also only had one issue iirc after the release which was a lot better than i expected.

vishh · 2017-02-14T22:47:37Z

+1 for attempting to roll out the default docker configuration. Ideally, we want users to use seccomp profiles that is fined tuned for each container. We might have to develop some tooling to make it easy to consume this feature in k8s. The current approach of storing profiles on node's root partition is complicated.

…

On Tue, Feb 14, 2017 at 2:34 PM, Jess Frazelle ***@***.***> wrote: fwiw when we launched it with docker i tested all the publically available dockerfiles on github and docker hub with it... so it was not done without much testing, we also only had one issue iirc after the release which was a lot better than i expected. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#39845 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AGvIKHFfYlPID8Ijgj0aF5KaJAp4fi-9ks5rcivzgaJpZM4LifTL> .

jessfs · 2017-02-14T22:52:55Z

Just want to add my +1 for making this the default.

timstclair · 2017-02-14T23:08:09Z

We might have to develop some tooling to make it easy to consume this
feature in k8s. The current approach of storing profiles on node's root
partition is complicated.

Agreed, I consider this alpha-behavior. For both seccomp & apparmor I'd like to add the ability to consume a ConfigMap (or maybe a new resource) as a profile. However, I consider this tangential to the issue discussed here.

Adjusting the default is already supported through the PodSecurityPolicy, but we still need to put some thought into how we'd go about rolling this out.

jessfraz · 2017-05-19T04:26:37Z

So there are a few ways I can imagine going about this, happy to open a proposal if you if agree with any:

defaulting to docker/default
forking the docker/default and maintaining our own default so we can edit easily in the future (i'm happy to do this since I wrote a lot of the docker default)
(2) might require making our own "seccomp profile spec" and adding as an api somewhere (idk which group) if we don't want to rely on another runtime's.
an option to set a different default maybe as a kubelet config option (also might require 3 unless we just default to another runtimes)

I am kinda in favor of 2, 3, and 4 so we have the most control.

timstclair · 2017-05-22T18:41:15Z

2,3 sound good to me. I think we can do (2) before fully implementing (3), since it's technically still an "alpha" feature. I think we should use the OCI spec, but I don't know the details on it. (4) is essentially already implemented on the PodSecurityPolicy, via an annotation (should graduate to a field before seccomp support goes to beta): "seccomp.security.alpha.kubernetes.io/defaultProfileName" (see https://github.com/kubernetes/kubernetes/blob/master/pkg/security/podsecuritypolicy/seccomp/strategy.go)

jessfraz · 2017-05-22T22:52:10Z

(4) is essentially already implemented on the PodSecurityPolicy, via an annotation

makes sense

I think we should use the OCI spec, but I don't know the details on it

Should we use theirs as a base and make our own or vendor theirs (ie what happens if they change theirs)

timstclair · 2017-05-22T22:57:10Z

Should we use theirs as a base and make our own or vendor theirs (ie what happens if they change theirs)

That's a question for @kubernetes/sig-api-machinery-misc, but my hunch is that we create our own copy (rather than vendoring), since I don't think we have any other examples of embedding a third party API in ours (unless it's opaque)

jessfraz · 2017-05-22T23:01:13Z

cool thats what i was leaning towards :)

…

On Mon, May 22, 2017 at 11:57 PM, Tim St. Clair ***@***.***> wrote: Should we use theirs as a base and make our own or vendor theirs (ie what happens if they change theirs) That's a question for @kubernetes/sig-api-machinery-misc <https://github.com/orgs/kubernetes/teams/sig-api-machinery-misc>, but my hunch is that we create our own copy (rather than vendoring), since I don't think we have any other examples of embedding a third party API in ours (unless it's opaque) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#39845 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYNbFj4EA4CEFFzUjn6YDpSLmqmJi5vks5r8hLmgaJpZM4LifTL> .

-- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

jessfraz · 2017-05-24T17:25:47Z

I'll open a proposal this afternoon :)

…

On May 22, 2017 7:01 PM, "Jess Frazelle" ***@***.***> wrote: cool thats what i was leaning towards :) On Mon, May 22, 2017 at 11:57 PM, Tim St. Clair ***@***.***> wrote: > Should we use theirs as a base and make our own or vendor theirs (ie what > happens if they change theirs) > > That's a question for @kubernetes/sig-api-machinery-misc > <https://github.com/orgs/kubernetes/teams/sig-api-machinery-misc>, but my > hunch is that we create our own copy (rather than vendoring), since I don't > think we have any other examples of embedding a third party API in ours > (unless it's opaque) > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub > <https://github.com/kubernetes/kubernetes/issues/ 39845#issuecomment-303242333>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/ ABYNbFj4EA4CEFFzUjn6YDpSLmqmJi5vks5r8hLmgaJpZM4LifTL> > . > -- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search= 0x18F3685C0022BFF3> — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#39845 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYNbBZm91alwgzF1H1jqj6uylRuWWMaks5r8hPXgaJpZM4LifTL> .

DjangoPeng · 2017-05-25T07:43:31Z

@jessfraz So can we use the default profile to set seccomp as docker/default now?

feiskyer · 2017-05-25T08:02:03Z

I think we should spec the seccomp format first, refer #39128. or else, other container runtimes couldn't know how to process docker/default.

jessfraz · 2017-05-25T10:57:45Z

For other runtimes that is why we are using the docker default as a base... not literally docker/default. but yes we can spec it out

On Thu, May 25, 2017 at 04:02 Pengfei Ni ***@***.***> wrote: I think we should spec the seccomp format first, refer #39128 <#39128>. or else, other container runtimes couldn't know how to process docker/default. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#39845 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABYNbPXPe5BC0qtVMEg1Fa61gXHlO8zHks5r9TWagaJpZM4LifTL> .

-- Jessie Frazelle 4096R / D4C4 DD60 0D66 F65A 8EFC 511E 18F3 685C 0022 BFF3 pgp.mit.edu <http://pgp.mit.edu/pks/lookup?op=get&search=0x18F3685C0022BFF3>

fejta-bot · 2017-12-25T03:41:40Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

justincormack · 2018-01-09T11:15:26Z

/remove-lifecycle stale

dims · 2018-01-09T12:34:37Z

discussion on seccomp format is here : #52827

liggitt · 2018-01-09T15:38:51Z

not sure a docker-specific seccomp name is good as a default

tallclair · 2018-04-06T01:18:05Z

/assign @wangzhen127

k8s-ci-robot · 2018-04-06T01:18:06Z

@tallclair: GitHub didn't allow me to assign the following users: wangzhen127.

Note that only kubernetes members and repo collaborators can be assigned.

In response to this:

/assign @wangzhen127

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2018-04-26T22:15:49Z

@wangzhen127: you can't re-open an issue/PR unless you authored it or you are assigned to it.

In response to this:

/reopen

There is followup work.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use 'docker/default' as default seccomp profile for unprivileged PodSecurityPolicy **What this PR does / why we need it**: This PR sets the default seccomp profile for unprivileged PodSecurityPolicy to 'docker/default'. This PR is a followup of [#62662](#62662). We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When default seccomp profile is applied later, we can remove those annotations. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes #39845 **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for unprivileged addons **What this PR does / why we need it**: This PR sets the default seccomp profile of unprivileged addons to 'docker/default'. This PR is a followup of [kubernetes#62662](kubernetes#62662) and [kubernetes#62671](kubernetes#62671). We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes kubernetes#39845 **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Automatic merge from submit-queue (batch tested with PRs 61963, 64279, 64130, 64125, 64049). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for DNS addons. **What this PR does / why we need it**: This PR sets the default seccomp profile of DNS addons to 'docker/default'. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. This is PR is part of #39845. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Automatic merge from submit-queue (batch tested with PRs 64281, 62991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for flutend-elasticsearch addons **What this PR does / why we need it**: This PR sets the default seccomp profile to 'docker/default' for: - fluentd-es daemon set. - kibana-logging deployment. The elasticsearch-logging stateful set is still unconfined because it uses gce:podsecuritypolicy:privileged. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. This is PR is part of #39845. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Use default seccomp profile for GCE manifests **What this PR does / why we need it**: This PR sets the default seccomp profile of unprivileged addons to 'docker/default' for GCE manifests. This PR is a followup of kubernetes#62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations. This is PR is part of kubernetes#39845. **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes # **Special notes for your reviewer**: **Release note**: ```release-note NONE ```

fejta-bot · 2018-09-05T23:30:48Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

RRAlex · 2018-09-18T18:24:38Z

/remove-lifecycle stale

jesseendahl · 2018-09-18T20:44:45Z

What's blocking this from happening at this point? cc @mayakacz @destijl

dims · 2018-09-19T11:26:24Z

long-term-issue (note to self)

tallclair · 2018-09-19T18:45:58Z

What's blocking this from happening at this point?

Generally, the fact that this a breaking change, and it's very hard to get breaking changes into Kubernetes these days, especially something that is hard to get visibility into.

Other issues are that this is still an "alpha" feature, but predates feature gates, so it's an alpha feature that's enabled in every cluster. Before changing the default, we probably need to promote the feature to GA, which includes:

Migrating the annotation to a pod field
Improving the profile management, so that profiles can be written as configmaps or k8s resources, and loaded by the node from there.
Create Kubernetes standard profiles, which can eventually be made the default (can be a copy of the docker default)

And possibly:

Create a tool for running seccomp in an "audit only" mode to capture any violations before potentially breaking workloads.

fejta-bot · 2018-12-18T19:48:23Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot · 2019-01-17T20:33:07Z

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot · 2019-02-16T20:51:09Z

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

k8s-ci-robot · 2019-02-16T20:51:16Z

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

timstclair added area/security sig/node Categorizes an issue or PR as relevant to SIG Node. labels Jan 13, 2017

k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label May 22, 2017

jessfraz mentioned this issue May 24, 2017

seccomp: add default profile kubernetes/community#660

Closed

tallclair mentioned this issue Sep 23, 2017

Seccomp kubernetes/enhancements#135

Open

22 tasks

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 25, 2017

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 9, 2018

tallclair removed the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Feb 23, 2018

wangzhen127 mentioned this issue Mar 22, 2018

Update seccomp design doc to enable default seccomp profile kubernetes/community#1963

Merged

This was referenced Apr 16, 2018

Change seccomp annotation from "docker/default" to "runtime/default" #62662

Merged

Use 'docker/default' as default seccomp profile for unprivileged PodSecurityPolicy #62671

Merged

This was referenced May 24, 2018

Use default seccomp profile for GCE manifests #64276

Merged

Use default seccomp profile for DNS addons. #64279

Merged

Use default seccomp profile for flutend-elasticsearch addons #64281

Merged

Use default seccomp profile for istio addons #64282

Closed

wangzhen127 mentioned this issue May 25, 2018

Add SeccompRuntimeDefault feature gate #64335

Closed

tallclair reopened this Jun 7, 2018

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 5, 2018

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Sep 18, 2018

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 18, 2018

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jan 17, 2019

k8s-ci-robot closed this as completed Feb 16, 2019

tallclair mentioned this issue Aug 12, 2019

TOB-K8S-002: Seccomp is disabled by default #81115

Closed

pjbgf mentioned this issue Sep 25, 2019

[WIP] Add KEP to create seccomp built-in profiles and add complain mode kubernetes/enhancements#1257

Closed

mikedanese mentioned this issue May 26, 2021

Add kubelet SeccompDefault alpha feature #101943

Merged

Change seccomp default to 'docker/default' #39845

Change seccomp default to 'docker/default' #39845

timstclair commented Jan 13, 2017

jessfraz commented Feb 14, 2017

vishh commented Feb 14, 2017 via email

jessfs commented Feb 14, 2017

timstclair commented Feb 14, 2017

jessfraz commented May 19, 2017

timstclair commented May 22, 2017

jessfraz commented May 22, 2017 •

edited

timstclair commented May 22, 2017

jessfraz commented May 22, 2017 via email

jessfraz commented May 24, 2017 via email

DjangoPeng commented May 25, 2017

feiskyer commented May 25, 2017

jessfraz commented May 25, 2017 via email

fejta-bot commented Dec 25, 2017

justincormack commented Jan 9, 2018

dims commented Jan 9, 2018

liggitt commented Jan 9, 2018

tallclair commented Apr 6, 2018

k8s-ci-robot commented Apr 6, 2018

k8s-ci-robot commented Apr 26, 2018

fejta-bot commented Sep 5, 2018

RRAlex commented Sep 18, 2018

jesseendahl commented Sep 18, 2018

dims commented Sep 19, 2018

tallclair commented Sep 19, 2018

fejta-bot commented Dec 18, 2018

fejta-bot commented Jan 17, 2019

fejta-bot commented Feb 16, 2019

k8s-ci-robot commented Feb 16, 2019

Change seccomp default to 'docker/default' #39845

Change seccomp default to 'docker/default' #39845

Comments

timstclair commented Jan 13, 2017

jessfraz commented Feb 14, 2017

vishh commented Feb 14, 2017 via email

jessfs commented Feb 14, 2017

timstclair commented Feb 14, 2017

jessfraz commented May 19, 2017

timstclair commented May 22, 2017

jessfraz commented May 22, 2017 • edited

timstclair commented May 22, 2017

jessfraz commented May 22, 2017 via email

jessfraz commented May 24, 2017 via email

DjangoPeng commented May 25, 2017

feiskyer commented May 25, 2017

jessfraz commented May 25, 2017 via email

fejta-bot commented Dec 25, 2017

justincormack commented Jan 9, 2018

dims commented Jan 9, 2018

liggitt commented Jan 9, 2018

tallclair commented Apr 6, 2018

k8s-ci-robot commented Apr 6, 2018

k8s-ci-robot commented Apr 26, 2018

fejta-bot commented Sep 5, 2018

RRAlex commented Sep 18, 2018

jesseendahl commented Sep 18, 2018

dims commented Sep 19, 2018

tallclair commented Sep 19, 2018

fejta-bot commented Dec 18, 2018

fejta-bot commented Jan 17, 2019

fejta-bot commented Feb 16, 2019

k8s-ci-robot commented Feb 16, 2019

jessfraz commented May 22, 2017 •

edited