detecting-container-escape-attempts

检测容器逃逸尝试

概述

容器逃逸是一种关键的攻击技术，攻击者借此突破容器隔离，访问宿主机系统或其他容器。检测涉及监控逃逸指标，例如命名空间操纵、能力滥用、内核漏洞利用、挂载敏感路径，以及使用 Falco、Sysdig 和自定义 seccomp/audit 规则等运行时安全工具检测异常系统调用模式。

何时使用

• 当调查需要检测容器逃逸尝试的安全事件时
• 当为该领域构建检测规则或威胁狩猎查询时
• 当 SOC 分析师需要针对此类分析的结构化流程时
• 当验证相关攻击技术的安全监控覆盖范围时

前置条件

• 内核为 5.10+ 的 Linux 宿主机（eBPF 支持）
• 已安装 Falco 0.37+（内核模块或 eBPF 探针）
• Docker Engine 或 containerd 运行时
• 已配置 auditd
• 加载 eBPF/内核模块所需的 root 访问权限

核心概念

常见容器逃逸向量

向量	技术	MITRE ID
特权容器	挂载宿主机文件系统，加载内核模块	T1611
Docker socket 挂载	从内部创建特权容器	T1610
内核漏洞利用	CVE-2022-0185（fsconfig）、Dirty Pipe、runc CVE	T1068
能力滥用	CAP_SYS_ADMIN、CAP_SYS_PTRACE、CAP_NET_ADMIN	T1548
敏感挂载	/proc/sysrq-trigger、/proc/kcore、cgroup release_agent	T1611
命名空间逃逸	nsenter、unshare 到宿主机命名空间	T1611
符号链接/绑定挂载	通过 /proc/self/root 逃逸	T1611

检测层

1. 系统调用监控 - eBPF/内核模块实时捕获系统调用
2. 文件完整性 - 检测启用逃逸的路径是否被修改
3. 进程监控 - 跟踪进程创建、命名空间变更
4. 网络监控 - 检测容器到宿主机的连接
5. 审计日志 - 用于能力和挂载操作的 Linux auditd

工作流

步骤 1：部署 Falco 进行运行时检测

# falco-values.yaml for Helm deployment
falco:
  driver:
    kind: ebpf   # or modern_ebpf for kernel 5.8+
  rules_files:
    - /etc/falco/falco_rules.yaml
    - /etc/falco/falco_rules.local.yaml
    - /etc/falco/rules.d
  json_output: true
  json_include_output_property: true
  http_output:
    enabled: true
    url: "http://falcosidekick:2801"
  grpc:
    enabled: true
  priority: warning

# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco-system --create-namespace \
  -f falco-values.yaml

步骤 2：用于逃逸检测的自定义 Falco 规则

# /etc/falco/rules.d/container_escape.yaml

# Detect container escape via privileged container
- rule: Container Escape via Privileged Mode
  desc: Detect attempts to escape container using privileged capabilities
  condition: >
    spawned_process and container and
    (proc.name in (nsenter, unshare, mount, umount, modprobe, insmod) or
     (proc.name = chroot and proc.args contains "/host"))
  output: >
    Container escape attempt via privileged operation
    (user=%user.name container=%container.name image=%container.image.repository
     command=%proc.cmdline pid=%proc.pid %container.info)
  priority: CRITICAL
  tags: [container, escape, T1611]

# Detect Docker socket access from container
- rule: Container Access to Docker Socket
  desc: Detect container reading/writing to Docker socket
  condition: >
    (open_read or open_write) and container and
    fd.name = /var/run/docker.sock
  output: >
    Docker socket accessed from container
    (user=%user.name container=%container.name image=%container.image.repository
     fd=%fd.name command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, docker_socket]

# Detect sensitive proc filesystem access
- rule: Container Access to Sensitive Proc Paths
  desc: Detect container accessing host-sensitive proc paths
  condition: >
    open_read and container and
    (fd.name startswith /proc/sysrq-trigger or
     fd.name startswith /proc/kcore or
     fd.name startswith /proc/kmsg or
     fd.name startswith /proc/kallsyms or
     fd.name startswith /sys/kernel)
  output: >
    Sensitive proc/sys access from container
    (user=%user.name container=%container.name path=%fd.name
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, proc_access]

# Detect cgroup escape technique
- rule: Container Cgroup Escape Attempt
  desc: Detect writing to cgroup release_agent (escape technique)
  condition: >
    open_write and container and
    (fd.name contains release_agent or
     fd.name contains notify_on_release)
  output: >
    Cgroup escape attempt detected
    (user=%user.name container=%container.name path=%fd.name
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, cgroup]

# Detect kernel module loading from container
- rule: Container Loading Kernel Module
  desc: Detect container attempting to load kernel modules
  condition: >
    spawned_process and container and
    (proc.name in (modprobe, insmod, rmmod) or
     (evt.type = init_module or evt.type = finit_module))
  output: >
    Kernel module load attempt from container
    (user=%user.name container=%container.name command=%proc.cmdline
     %container.info)
  priority: CRITICAL
  tags: [container, escape, kernel_module]

# Detect namespace manipulation
- rule: Container Namespace Manipulation
  desc: Detect setns/unshare syscalls from container
  condition: >
    container and (evt.type = setns or evt.type = unshare) and
    not proc.name in (containerd-shim, runc)
  output: >
    Namespace manipulation from container
    (user=%user.name container=%container.name syscall=%evt.type
     command=%proc.cmdline %container.info)
  priority: CRITICAL
  tags: [container, escape, namespace]

# Detect mount operations from container
- rule: Container Mount Sensitive Filesystem
  desc: Detect container mounting host filesystems
  condition: >
    spawned_process and container and proc.name = mount and
    (proc.args contains "/dev/" or proc.args contains "proc" or
     proc.args contains "sysfs")
  output: >
    Sensitive mount operation from container
    (user=%user.name container=%container.name command=%proc.cmdline
     %container.info)
  priority: HIGH
  tags: [container, escape, mount]

步骤 3：配置 Seccomp 配置文件以阻止逃逸

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "archMap": [
    { "architecture": "SCMP_ARCH_X86_64", "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"] }
  ],
  "syscalls": [
    {
      "names": [
        "read", "write", "open", "close", "stat", "fstat", "lstat",
        "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
        "rt_sigaction", "rt_sigprocmask", "ioctl", "access",
        "pipe", "select", "sched_yield", "dup", "dup2",
        "nanosleep", "getpid", "socket", "connect", "accept",
        "sendto", "recvfrom", "bind", "listen", "getsockname",
        "getpeername", "socketpair", "setsockopt", "getsockopt",
        "clone", "fork", "vfork", "execve", "exit", "wait4",
        "kill", "getuid", "getgid", "geteuid", "getegid",
        "epoll_create", "epoll_wait", "epoll_ctl", "epoll_create1",
        "futex", "set_tid_address", "set_robust_list",
        "openat", "newfstatat", "readlinkat", "fchownat",
        "clock_gettime", "clock_getres", "clock_nanosleep",
        "getrandom", "memfd_create", "statx", "rseq"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": ["unshare", "setns", "mount", "umount2", "pivot_root",
                "init_module", "finit_module", "delete_module",
                "kexec_load", "kexec_file_load", "ptrace",
                "reboot", "swapon", "swapoff", "sethostname",
                "setdomainname", "keyctl", "bpf"],
      "action": "SCMP_ACT_LOG",
      "comment": "Log escape-relevant syscalls for detection"
    }
  ]
}

步骤 4：针对容器逃逸的审计规则

# /etc/audit/rules.d/container-escape.rules

# Monitor namespace operations
-a always,exit -F arch=b64 -S setns -S unshare -k container_escape
-a always,exit -F arch=b64 -S mount -S umount2 -k container_mount
-a always,exit -F arch=b64 -S init_module -S finit_module -S delete_module -k kernel_module
-a always,exit -F arch=b64 -S ptrace -k process_trace

# Monitor sensitive paths
-w /var/run/docker.sock -p rwxa -k docker_socket
-w /proc/sysrq-trigger -p w -k sysrq
-w /proc/kcore -p r -k kcore_read

# Monitor container runtime
-w /usr/bin/runc -p x -k container_runtime
-w /usr/bin/containerd -p x -k container_runtime
-w /usr/bin/docker -p x -k container_runtime

步骤 5：实时告警流水线

# Falcosidekick configuration for alert routing
config:
  slack:
    webhookurl: "https://hooks.slack.com/services/xxx"
    minimumpriority: "critical"
    messageformat: |
      *Container Escape Alert*
      Rule: {{ .Rule }}
      Priority: {{ .Priority }}
      Output: {{ .Output }}

  elasticsearch:
    hostport: "https://elasticsearch:9200"
    index: "falco-alerts"
    minimumpriority: "warning"

  pagerduty:
    routingkey: "xxxx"
    minimumpriority: "critical"

验证命令

# Test Falco rules with event generator
kubectl run falco-event-generator \
  --image=falcosecurity/event-generator \
  --restart=Never \
  -- run syscall --action PtraceAttachContainer

# Check Falco alerts
kubectl logs -n falco-system -l app.kubernetes.io/name=falco --tail=50

# Verify seccomp profile is loaded
docker inspect --format '{{.HostConfig.SecurityOpt}}' <container-id>

# Check audit logs for escape-related events
ausearch -k container_escape --interpret

参考资料

• Falco Runtime Security
• Container Escape Techniques - HackTricks
• MITRE ATT&CK T1611 - Escape to Host
• Sysdig Container Security