Table of Contents

1. Challenge

   Check Seccomp Capabilities

   grep SECCOMP /boot/config-$(uname -r)
   

   Expected output:

   CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
   CONFIG_SECCOMP_FILTER=y
   CONFIG_SECCOMP=y
   

2. Challenge

   Create Our Own Policy and Override the Default Seccomp Profile

   vim /home/cloud_user/myProfile.json
   

   {
     "defaultAction": "SCMP_ACT_ALLOW",
     "architectures": [
         "SCMP_ARCH_X86_64"
     ],
     "syscalls": [
       {
         "name": "chmod",
         "action": "SCMP_ACT_ERRNO"
       },
       {
         "name": "fchmod",
         "action": "SCMP_ACT_ERRNO"
       },
       {
         "name": "fchmodat",
         "action": "SCMP_ACT_ERRNO"
       },
       {
         "name": "mkdir",
         "action": "SCMP_ACT_ERRNO"
       }
     ]
   }
   

   ESC
   :wq
   ENTER
   

3. Challenge

   Run a Container with a Custom Seccomp Profile

   sudo docker run --rm -it --security-opt seccomp=/home/cloud_user/myProfile.json debian:jessie sh
   

4. Challenge

   Test the Restrictions within the Container

   The following should be denied.

   mkdir test 
   

   Expected output:

   mkdir: cannot create directory 'test': Operation not permitted
   

   The following should work.

   touch testFile 
   

   The following should be denied.

   chmod +x testFile 
   

   Expected output:

   chmod: changing permissions of 'testFile': Operation not permitted