Skip to content

Room 30

SECURITYCONTEXTS

The Lockdown Protocol

  • SecurityContexts control privileges at the pod and container level.
  • Run as non-root, drop capabilities, set read-only filesystems.

📜 Mission Briefing

  1. Apply locked-pod.yaml - runs as user 1000 with read-only root filesystem.
  2. Try writing to the root filesystem - it will fail.
  3. But a writable emptyDir is mounted at /tmp.
  4. Exec into the pod, verify the user ID is 1000, and check capabilities.
  5. The password is saved at /tmp/escape-key: secctx42.
Key Commands
Command Purpose
kubectl exec POD -- id Check running user
kubectl exec POD -- cat /proc/1/status Process capabilities
SecurityContext Fields
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  # Pod-level security context
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    runAsNonRoot: true
    supplementalGroups: [4000]
    seccompProfile:
      type: RuntimeDefault

  containers:
    - name: app
      image: busybox
      command: ['sh', '-c', 'echo "secctx42" > /tmp/escape-key; sleep 3600']
      # Container-level security context (overrides pod-level)
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
          add: ["NET_BIND_SERVICE"]   # Only add what's needed
        # privileged: false          # Never run privileged
        # procMount: Default
      volumeMounts:
        - name: tmp
          mountPath: /tmp
  volumes:
    - name: tmp
      emptyDir: {}

# Key SecurityContext fields:
# runAsUser:                  UID to run container process
# runAsGroup:                 GID for the container process
# fsGroup:                    GID for volume ownership
# runAsNonRoot:               Reject if running as root
# readOnlyRootFilesystem:     Mount root fs as read-only
# allowPrivilegeEscalation:   Block setuid/setgid
# capabilities:               Linux capabilities (drop/add)
# privileged:                 Full host access (DANGEROUS)
# seccompProfile:             Syscall filtering profile

# Linux Capabilities (granular root powers):
# NET_BIND_SERVICE:  Bind to ports < 1024
# SYS_TIME:          Modify system clock
# SYS_PTRACE:        Trace processes
# NET_ADMIN:         Network configuration
# SYS_ADMIN:         Broad admin operations (avoid!)

# Best practice: drop ALL, add only what's needed
Hints

Hint 1

kubectl apply -f locked-pod.yaml
kubectl exec locked-pod -- id
# uid=1000 gid=3000

Hint 2

kubectl exec locked-pod -- cat /tmp/escape-key

Hint 3

The password is secctx42.

🔓 Unlock Room 31

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_31/README             \
        -out ../room_31/README.txt        \
        -pass pass:PASSWORD
cat ../room_31/README.txt