Implementing Container Privilege Escalation Detection using eBPF for Cloud Native Security
Talkat ContainerCon @ Open Source Summit Europe 2022 · on Friday, 2022-09-16· at 10:50· Wicklow Hall 1 (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
Demonstrates an actual eBPF-based detector that hooks commit_creds via kprobe to compare current and new credentials, maintains a map that tracks lowest credential per container and checks new privileges against container-creation and parent-process baselines, generates type 1/2/3 warning events when escalation rules trigger, and prints alerts on detection. Implements prototypes with bpftrace and BCC style programs and integrates alerts into the Pixie observability pipeline for end-to-end collection and display, showing the method works in practice.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:08Container Escape!
- 6:38Privilege Escalation
- 9:22Defense Mechanisms
- 13:52Monitoring Container Privilege Changes
- 18:34eBPF Tools: tracee
- 20:26bpftrace
- 24:38Practical Monitoring: Pixie
related talks
25mProtecting Modern Workloads with eBPF superpowers
40mExploring Runtime Security and Forensic using eBPF
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
29mRuntime Security at Scale With EBPF: Hybrid Detection and Root Cause…
20mDebugging Kubernetes and Container Workloads with the Superpower of eBPF
45mThe Container Escape Room: An Exploration of Container Escapes
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals