在没有--privileged的docker容器内使用perf [英] Use perf inside a docker container without --privileged
问题描述
我正在尝试使用Docker容器内的perf工具来记录给定命令.
kernel.perf_event_paranoid设置为1,但是当我不放置--privileged标志时,容器的行为就像在第2位一样.
我可以使用--privileged,但是我在perf上运行的代码不受信任,如果我可以允许使用perf工具承担一点安全风险,那么对容器授予特权似乎是另一种风险.
还有其他在容器内使用perf的方法吗?
~$ docker version
Client:
Version: 17.03.1-ce
API version: 1.27
Go version: go1.7.5
Git commit: 7392c3b/17.03.1-ce
Built: Tue May 30 17:59:44 2017
OS/Arch: linux/amd64
Server:
Version: 17.03.1-ce
API version: 1.27 (minimum version 1.12)
Go version: go1.7.5
Git commit: 7392c3b/17.03.1-ce
Built: Tue May 30 17:59:44 2017
OS/Arch: linux/amd64
Experimental: false
~$ cat /proc/sys/kernel/perf_event_paranoid
1
~$ perf record ./my-executable
perf_event_open(..., PERF_FLAG_FD_CLOEXEC) failed with unexpected error 1 (Operation not permitted)
perf_event_open(..., 0) failed unexpectedly with error 1 (Operation not permitted)
Error:
You may not have permission to collect stats.
Consider tweaking /proc/sys/kernel/perf_event_paranoid:
-1 - Not paranoid at all
0 - Disallow raw tracepoint access for unpriv
1 - Disallow cpu events for unpriv
2 - Disallow kernel profiling for unpriv
经过研究,问题不在于perf_event_paranoid
,而是因为perf_event_open
(syscall)已在docker中被列入黑名单:
https://docs.docker.com/engine/security/seccomp/"Docker v17.06:适用于Docker的Seccomp安全配置文件"
被默认配置文件阻止的大量系统调用
perf_event_open
跟踪/分析系统调用,这可能会泄漏主机上的许多信息.
为此,我的第一个解决方法是拥有一个脚本,该脚本可以下载官方seccomp文件 https://github.com/moby/moby/blob/master/profiles/seccomp/default.json ,并将perf_event_open
添加到白名单的系统调用列表中.>
然后我用--security-opt seccomp=my-seccomp.json
I am trying to use the perf tool inside a Docker container to record a given command.
kernel.perf_event_paranoid is set to 1, but the container behaves just as if it where 2, when I don't put the --privileged flag.
I could use --privileged, but the code I am running perf on is not trusted and if I am OK with taking a slight security risk by allowing perf tool, giving privileged rights on the container seems a different level of risk.
Is there any other way to use perf inside the container?
~$ docker version
Client:
Version: 17.03.1-ce
API version: 1.27
Go version: go1.7.5
Git commit: 7392c3b/17.03.1-ce
Built: Tue May 30 17:59:44 2017
OS/Arch: linux/amd64
Server:
Version: 17.03.1-ce
API version: 1.27 (minimum version 1.12)
Go version: go1.7.5
Git commit: 7392c3b/17.03.1-ce
Built: Tue May 30 17:59:44 2017
OS/Arch: linux/amd64
Experimental: false
~$ cat /proc/sys/kernel/perf_event_paranoid
1
~$ perf record ./my-executable
perf_event_open(..., PERF_FLAG_FD_CLOEXEC) failed with unexpected error 1 (Operation not permitted)
perf_event_open(..., 0) failed unexpectedly with error 1 (Operation not permitted)
Error:
You may not have permission to collect stats.
Consider tweaking /proc/sys/kernel/perf_event_paranoid:
-1 - Not paranoid at all
0 - Disallow raw tracepoint access for unpriv
1 - Disallow cpu events for unpriv
2 - Disallow kernel profiling for unpriv
After some research, the problem is not with the perf_event_paranoid
, but with the fact that perf_event_open
(syscall) has been blacklisted in docker:
https://docs.docker.com/engine/security/seccomp/ "Docker v17.06: Seccomp security profiles for Docker"
Significant syscalls blocked by the default profile
perf_event_open
Tracing/profiling syscall, which could leak a lot of information on the host.
My first work-around for this is to have a script that downloads the official seccomp file https://github.com/moby/moby/blob/master/profiles/seccomp/default.json, and adds perf_event_open
to the list of white-listed syscalls.
I then start docker with --security-opt seccomp=my-seccomp.json
这篇关于在没有--privileged的docker容器内使用perf的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!