KubeArmor : Container-aware Runtime Security Enforcement System

Introduction to KubeArmor

KubeArmor is a container-aware runtime security enforcement system that restricts the behavior (such as process execution, file access, networking operation, and resource utilization) of containers at the system level.

KubeArmor operates with Linux security modules (LSMs), meaning that it can work on top of any Linux platforms (such as Alpine, Ubuntu, and Container-optimized OS from Google) if Linux security modules (e.g., AppArmorSELinux, or KRSI) are enabled in the Linux Kernel. KubeArmor will use the appropriate LSMs to enforce the required policies.

KubeArmor is designed for Kubernetes environments; thus, operators only need to define security policies and apply them to Kubernetes. Then, KubeArmor will automatically detect the changes in security policies from Kubernetes and enforce them to the corresponding containers without any human intervention.

If there are any violations against security policies, KubeArmor immediately generates audit logs with container identities. If operators have any logging systems, it automatically sends audit logs to their systems as well.

Functionality Overview

  • Restrict the behavior of containers at the system level

Traditional container security solutions (e.g., Cilium) mostly protect containers by determining their inter-container relations (i.e., service flows) at the network level. In contrast, KubeArmor prevents malicious or unknown behaviors in containers by specifying their desired actions (e.g., a specific process should only be allowed to access a sensitive file).

For this, KubeArmor provides the ability to filter process executions, file accesses, resource utilization, and even network operations inside containers at the system level.

  • Enforce security policies to containers in runtime

In general, security policies (e.g., Seccomp and AppArmor profiles) are statically defined within pod definitions for Kubernetes, and they are applied to containers at creation time. Then, the security policies are not allowed to be updated in runtime.

To avoid this problem, KubeArmor maintains security policies separately, which means that security policies are no longer tightly coupled with containers. Then, KubeArmor directly applies the security policies into Linux security modules (LSMs) for each container according to the labels of given containers and security policies.

  • Produce container-aware audit logs

LSMs do not have any container-related information; thus, they generate audit logs only based on system metadata (e.g., User ID, Group ID, and process ID). Therefore, it is hard to figure out what containers cause policy violations.

To address this problem, KubeArmor uses an eBPF-based system monitor, which keeps track of process life cycles in containers, and converts system metadata to container identities when LSMs generate audit logs for any policy violations from containers.

  • Provide easy-to-use semantics for policy definitions

KubeArmor provides the ability to monitor the life cycles of containers’ processes and take policy decisions based on them. In general, it is much easier to deny a specific action but it is more difficult to allow only specific actions while denying all. KubeArmor manages internal complexities associated with handling such policy decisions and provides easy semantics towards policy language.

  • Support network security enforcement among containers

KubeArmor aims to protect containers themselves rather than interactions among containers. However, using KubeArmor a user can add policies that could apply policy settings at the level of network system calls (e.g., bind(), listen(), accept(), and connect()), thus somewhat controlling interactions among containers.

Getting Started

Please take a look at the following documents.

  1. Deployment Guide
  2. Security Policy Specification for Containers
  3. Security Policy Examples for Containers
  4. Security Policy Specification for Nodes (Hosts)
  5. Security Policy Examples for Nodes (Hosts)

If you want to make a contribution, please refer to the following documents too.

  1. Contribution Guide
  2. Development Guide
  3. Technical Roadmap

Community

  • SlackPlease join the KubeArmor Slack channel to communicate with KubeArmor developers and other users. We always welcome having a discussion about the problems that you face during the use of KubeArmor.
R K

Recent Posts

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

7 days ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago

How to Check if a File Exists in Bash – Simply Explained

Why Do We Check Files in Bash? When writing a Bash script, you often work…

1 week ago