Improving Container Security with System Call Interception
summary
Describes using seccomp notify (Linux 5.9+) to pause a syscall, send its args to a privileged host monitor, and return the host’s response; LXD implements interception for six syscalls (mknod, setxattr, bpf, mount, sched, sysinfo). Demonstrated creating device nodes from unprivileged containers, making mounts succeed by calling mount replaced with FUSE (fuse2fs) and fixing sysinfo to show a 256 MB cgroup limit. Notes real risks: TOCTOU on pointer args, requirement of a trusted host monitor, and use of pidfd_getfd to transfer file descriptors safely.
AI-written summary · about
chapters (8)
- 0:00Improving Container Security
- 3:31Different types of containers
- 5:30Seccomp and system call interception
- 13:36Safety concerns
- 23:24mount
- 32:18sysinfo
- 40:47What's next?
- 48:06Questions?
related talks
45mMaking Containers Safer
26mExploring Container Mechanisms Through the Story of a Syscall
48mState of Linux Kernel Container Features
50mThe state of container security
38mOn the Way to Safe Containers
32mDesigning to the Worst Case Scenario - Practical System Call Filtering with Seccomp
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces
33mContainers Security Layers and How Not to Break them