Container restrictions（容器限制）¶
Palantir restricts various system calls (syscalls) from running inside our infrastructure through Secure Computing Mode (seccomp). Seccomp is a security feature in the Linux kernel that allows system call (syscall) restrictions to apply to a process or container.
Seccomp filters provide a way to allowlist the syscalls that a container can make and allows for multiple methods of handling non-allowlisted syscalls, including LOG, KILL, and ERRNO profiles:
LOGallows non-allowlisted syscalls to run but logs them to auditd/osquery for process auditing.KILLterminates any process that makes a non-allowlisted syscall.ERRNOprevents a syscall from running, but does not generate a logging event.
Seccomp allows us to reduce the attack surface of a container by preventing/logging syscalls considered to be unsafe or that can be used to escape a container. Doing so provides an additional layer of security between the container and the host as well as between containers. Below, you will find a list of the syscalls we automatically block in the Palantir platform.
:::callout{theme="danger"} If your application makes a syscall listed below, the process will be terminated and our incident response team will be notified. If your use case requires use of these syscalls, contact Palantir support for assistance. :::
| Linux call | Description |
|---|---|
| ACCT ↗ | Enables or disables Berkeley Software Distribution (BSD) style accounting. |
| ADD_KEY ↗ | Creates a key in the kernel. If a key already exists, it will be updated. |
| AFS_SYSCALL ↗ | Unimplemented |
| BPF ↗ | Performs operations on the Berkeley Packet Filters. |
| CLOCK_SETTIME ↗ | Sets the time of a specified clock (clockid). |
| CREATE_MODULE ↗ | Deprecated post 2.6; kernel creates a loadable module entry. |
| DELETE_MODULE ↗ | Attempts to remove an unused, loadable module by name. |
| FANOTIFY_INIT ↗ | Requires CAP_SYS_ADMIN; creates a fanotify group and returns a descriptor for the event queue. |
| FINIT_MODULE ↗ | Loads an ELF image into kernel space and performs sym relocation. |
| GETPMSG ↗ | Unimplemented |
| GET_KERNEL_SYMS ↗ | Deprecated post 2.6; copies kernel syms to a table. |
| GET_MEMPOLICY ↗ | Retrieves the non-uniform memory access (NUMA) policy for a thread; NUMA nodes have separate memory controller per NUMA, and crossing nodes is slow. |
| INIT_MODULE ↗ | Loads an ELF image into kernel space. |
| IOPERM ↗ | Sets port input/output perms; i386 only. |
| IOPL ↗ | Deprecated for ioperm i386 only; changes I/O privilege level. |
| KCMP ↗ | Compares two processes to determine if they share kernel resources (Virtual Memory, for example). |
| KEXEC_FILE_LOAD ↗ | Loads a new kernel that can be executed by reboot. |
| KEXEC_LOAD ↗ | Loads a new kernel that can later be executed by reboot. |
| KEYCTL ↗ | Manipulates the kernel key management facility from user space. |
| LOOKUP_DCOOKIE ↗ | Returns a directory entry path. |
| MBIND ↗ | Set a memory policy for a memory range; used with Numa nodes. |
| MIGRATE_PAGES ↗ | Moves all pages in a process to another set of nodes; requires CAP_SYS_NICE. |
| MSGRCV ↗ | System V message queue operations. |
| MOUNT ↗ | Mounts a filesystem; requires CAP_SYS_ADMIN. |
| MOVE_PAGES ↗ | Moves individual pages of a process to another node. |
| NAME_TO_HANDLE_AT ↗ | Obtains a handle for a pathname and opens file via a handle. |
| NFSSERVCTL ↗ | Deprecated as of Linux 3.1; interface to the Kernel NFS Daemon. |
| OPEN_BY_HANDLE_AT ↗ | Similar to NAME_TO_HANDLE_AT; instead of returning the handle, opens the file using the handle. |
| PERF_EVENT_OPEN ↗ | Sets up performance monitoring. |
| PIVOT_ROOT ↗ | Changes the root mount; requires CAP_SYS_ADMIN. |
| PKEY_ALLOC ↗ | Allocates or frees a protection key. |
| PKEY_FREE ↗ | Allocates or frees a protection key. |
| PKEY_MPROTECT ↗ | Sets protection on a region of memory. |
| PROCESS_VM_READV ↗ | Transfers data between process address spaces. |
| PROCESS_VM_WRITEV ↗ | Transfers data between process address spaces. |
| PUTPMSG ↗ | Unimplemented |
| QUERY_MODULE ↗ | Deprecated in 2.6; queries the kernel for various information pertaining to modules. |
| QUOTACTL ↗ | Manipulates disk quotes; requires CAP_SYS_ADMIN. |
| REBOOT ↗ | Reboots or enables the reboot keystroke (CTRL-ALT-DEL). |
| REQUEST_KEY ↗ | Requests a key form the kernel's key management facility. |
| SECURITY ↗ | Unimplemented |
| SETDOMAINNAME ↗ | Gets or sets NIS domain name; requires CAP_SYS_ADMIN. |
| SETHOSTNAME ↗ | Gets or sets the hostname; requires CAP_SYS_ADMIN. |
| SETNS ↗ | Reallocates a thread with a name space; must have CAP_SYS_ADMIN in the desired namespace. |
| SETSID ↗ | Creates a session and sets the process group ID. |
| SETTIMEOFDAY ↗ | Sets the time of day and timezone/CAP_SYS_TIME. |
| SET_MEMPOLICY ↗ | Sets default NUMA memory policy. |
| SWAPOFF ↗ | Disables swap on a file/device; requires CAP_SYS_ADMIN. |
| SWAPON ↗ | Enables swap on a file/device; requires CAP_SYS_ADMIN. |
| SYSFS ↗ | Gets filesystem type information. |
| SYSLOG ↗ | Reads and/or clears kernel message ring buffer. |
| TUXCALL ↗ | Unimplemented |
| UMOUNT2 ↗ | Umounts a filesystem; requires CAP_SYS_ADMIN. |
| UNSHARE ↗ | Disassociates parts of the process execution context; some, but not all, options require CAP_SYS_ADMIN. |
| USELIB ↗ | Deprecated; loads a shared library to be used by calling process. |
| USERFAULTFD ↗ | Creates a file descriptor for handling page faults in user space. |
| USTAT ↗ | Deprecated; gives filesystem stats. |
| VHANGUP ↗ | Virtually disconnects a terminal; requires CAP_SYS_TTY_CONFIG. |
| VSERVER ↗ | Unimplemented |
| _SYSCTL ↗ | Deprecated; reads and writes system parameters. |
中文翻译¶
容器限制¶
Palantir 通过安全计算模式(seccomp)限制各种系统调用(syscalls)在我们的基础设施内运行。Seccomp 是 Linux 内核中的一项安全特性，允许将系统调用限制应用于进程或容器。
Seccomp 过滤器提供了一种对容器可发起的系统调用进行白名单(allowlist)管理的方法，并支持多种处理非白名单系统调用的方式，包括 LOG、KILL 和 ERRNO 配置文件：
LOG允许非白名单系统调用运行，但会将其记录到 auditd/osquery 中以进行进程审计。KILL会终止任何发起非白名单系统调用的进程。ERRNO会阻止系统调用运行，但不会生成日志事件。
Seccomp 使我们能够通过阻止或记录被视为不安全或可用于容器逃逸的系统调用，来减少容器的攻击面(attack surface)。这为容器与宿主机(host)之间以及容器与容器之间提供了额外的安全层。以下是我们在 Palantir 平台中自动阻止的系统调用列表。
:::callout{theme="danger"} 如果您的应用程序发起了下列系统调用，相关进程将被终止，我们的事件响应团队(incident response team)也会收到通知。如果您的用例需要使用这些系统调用，请联系 Palantir 支持团队寻求帮助。 :::
| Linux 系统调用 | 描述 |
|---|---|
| ACCT ↗ | 启用或禁用伯克利软件套件(Berkeley Software Distribution)风格的记账功能。 |
| ADD_KEY ↗ | 在内核中创建密钥。如果密钥已存在，则对其进行更新。 |
| AFS_SYSCALL ↗ | 未实现 |
| BPF ↗ | 对伯克利包过滤器(Berkeley Packet Filters)执行操作。 |
| CLOCK_SETTIME ↗ | 设置指定时钟(clockid)的时间。 |
| CREATE_MODULE ↗ | 2.6 版本后已弃用；内核创建可加载模块(loadable module)条目。 |
| DELETE_MODULE ↗ | 尝试按名称移除未使用的可加载模块。 |
| FANOTIFY_INIT ↗ | 需要 CAP_SYS_ADMIN；创建 fanotify 组并返回事件队列的描述符。 |
| FINIT_MODULE ↗ | 将 ELF 映像(ELF image)加载到内核空间并执行符号重定位。 |
| GETPMSG ↗ | 未实现 |
| GET_KERNEL_SYMS ↗ | 2.6 版本后已弃用；将内核符号复制到表中。 |
| GET_MEMPOLICY ↗ | 检索线程的非统一内存访问(non-uniform memory access, NUMA)策略；NUMA 节点每个 NUMA 都有独立的内存控制器，跨节点访问速度较慢。 |
| INIT_MODULE ↗ | 将 ELF 映像加载到内核空间。 |
| IOPERM ↗ | 设置端口输入/输出权限；仅限 i386。 |
| IOPL ↗ | 对于 ioperm 仅限 i386 已弃用；更改 I/O 特权级。 |
| KCMP ↗ | 比较两个进程以确定它们是否共享内核资源（例如虚拟内存(Virtual Memory)）。 |
| KEXEC_FILE_LOAD ↗ | 加载可通过重启执行的新内核。 |
| KEXEC_LOAD ↗ | 加载稍后可通过重启执行的新内核。 |
| KEYCTL ↗ | 从用户空间操作内核密钥管理工具。 |
| LOOKUP_DCOOKIE ↗ | 返回目录项路径。 |
| MBIND ↗ | 为内存范围设置内存策略；与 NUMA 节点配合使用。 |
| MIGRATE_PAGES ↗ | 将进程中的所有页面移动到另一组节点；需要 CAP_SYS_NICE。 |
| MSGRCV ↗ | System V 消息队列操作。 |
| MOUNT ↗ | 挂载文件系统(filesystem)；需要 CAP_SYS_ADMIN。 |
| MOVE_PAGES ↗ | 将进程的各个页面移动到另一个节点。 |
| NAME_TO_HANDLE_AT ↗ | 获取路径名的句柄并通过句柄打开文件。 |
| NFSSERVCTL ↗ | 自 Linux 3.1 起已弃用；内核 NFS 守护进程的接口。 |
| OPEN_BY_HANDLE_AT ↗ | 类似于 NAME_TO_HANDLE_AT；但不返回句柄，而是使用句柄打开文件。 |
| PERF_EVENT_OPEN ↗ | 设置性能监控。 |
| PIVOT_ROOT ↗ | 更改根挂载点；需要 CAP_SYS_ADMIN。 |
| PKEY_ALLOC ↗ | 分配或释放保护密钥。 |
| PKEY_FREE ↗ | 分配或释放保护密钥。 |
| PKEY_MPROTECT ↗ | 设置内存区域的保护。 |
| PROCESS_VM_READV ↗ | 在进程地址空间之间传输数据。 |
| PROCESS_VM_WRITEV ↗ | 在进程地址空间之间传输数据。 |
| PUTPMSG ↗ | 未实现 |
| QUERY_MODULE ↗ | 在 2.6 中已弃用；向内核查询与模块相关的各种信息。 |
| QUOTACTL ↗ | 操作磁盘配额；需要 CAP_SYS_ADMIN。 |
| REBOOT ↗ | 重启或启用重启按键 (CTRL-ALT-DEL)。 |
| REQUEST_KEY ↗ | 从内核的密钥管理工具请求密钥。 |
| SECURITY ↗ | 未实现 |
| SETDOMAINNAME ↗ | 获取或设置 NIS 域名；需要 CAP_SYS_ADMIN。 |
| SETHOSTNAME ↗ | 获取或设置主机名；需要 CAP_SYS_ADMIN。 |
| SETNS ↗ | 使用命名空间(namespace)重新分配线程；必须在目标命名空间中具有 CAP_SYS_ADMIN。 |
| SETSID ↗ | 创建会话并设置进程组 ID。 |
| SETTIMEOFDAY ↗ | 设置时间和时区/CAP_SYS_TIME。 |
| SET_MEMPOLICY ↗ | 设置默认 NUMA 内存策略。 |
| SWAPOFF ↗ | 禁用文件/设备上的交换空间；需要 CAP_SYS_ADMIN。 |
| SWAPON ↗ | 启用文件/设备上的交换空间；需要 CAP_SYS_ADMIN。 |
| SYSFS ↗ | 获取文件系统类型信息。 |
| SYSLOG ↗ | 读取和/或清除内核消息环形缓冲区。 |
| TUXCALL ↗ | 未实现 |
| UMOUNT2 ↗ | 卸载文件系统；需要 CAP_SYS_ADMIN。 |
| UNSHARE ↗ | 解除进程执行上下文各部分的关联；部分（并非全部）选项需要 CAP_SYS_ADMIN。 |
| USELIB ↗ | 已弃用；加载供调用进程使用的共享库。 |
| USERFAULTFD ↗ | 创建用于处理用户空间缺页异常(page faults)的文件描述符。 |
| USTAT ↗ | 已弃用；提供文件系统统计信息。 |
| VHANGUP ↗ | 虚拟断开终端连接；需要 CAP_SYS_TTY_CONFIG。 |
| VSERVER ↗ | 未实现 |
| _SYSCTL ↗ | 已弃用；读写系统参数。 |