Forem: Carlos García

Incrementar seguridad de Dockerfiles quitando privilegios de Root en los contenedores

Carlos García — Wed, 16 Dec 2020 00:52:37 +0000

Cuidar nuestra seguridad al momento de crear Dockerfiles es igual de importante que todas las demás acciones implementadas para fortalecer la seguridad informática de nuestras aplicaciones.

Hace un par de días me llamó la atención un artículo sobre seguridad informática enfocado a la configuración y buen uso de la herramienta de Docker. Y aunque no lo había pensado, tiene mucho sentido, muchas veces nos dejamos llevar por los ejemplos que encontramos en línea y no nos damos cuenta que están escritos con mucha simpleza por la misma naturaleza del "tutorial", pero meter este código simple a nuestros ambientes productivos resulta ser un peligro porque la mayoría de las veces pasa por alto la atención al detalle que deberíamos de tener para poder evitar código vulnerable.

Los ejemplos de la siguiente guía están pensados para proyectos de Net Core pero son perfectamente trasladables a cualquier otro tipo de proyecto.

Dockerfiles

Haciendo un poco de investigación al respecto de cómo disminuir el tamaño de las imágenes que utilizo en mis proyectos de Go, me encontré con varias páginas hablando al respecto de las buenas prácticas que debemos de tener al momento de escribir nuestros Dockerfiles.

Dentro de las practicas mencionaban asignar la menor cantidad de privilegios posibles a nuestros contenedores Docker. Resulta que, por defecto, al momento de ejecutar un proceso dentro de un contenedor, Docker ejecuta dicho proceso con el usuario root. ¿Cómo? Sí, Docker le asigna los permisos de root a todos los procesos que corran dentro de un contenedor.

Docker y el Kernel

Antes de continuar, debemos de refrescar un concepto básico de Docker: Docker gana rendimiento porque no es una máquina virtual, simplemente es una herramienta para correr procesos específicos dentro de contenedores y, así poder tener un mejor manejo de dependencias y asegurarnos de que lo que funciona en nuestro sistema local, también funcionará en nuestro servidor.

Estos contenedores comparten el Kernel con la máquina Host.

Debido a que el Kernel es el encargado de la administración de los uid y gid (User Id y Group Id) los usuarios dentro de los contenedores tendrán los mismos privilegios afuera de los mismos. Un proceso ejecutado por root dentro de un contenedor Docker hereda los mismos privilegios que un usuario root en el Host.

Esto es peligroso porque expone la información confidencial que tengamos en nuestra máquina virtual en la nube (o peor, nuestro servidor on-premise) y abre la puerta a que cualquier atacante puedan escalar a privilegios root después de haber ganado acceso a cualquier contenedor con privilegios de root. ¿Se acuerdan de la historia de terror de David Gilberson? (https://medium.com/hackernoon/im-harvesting-credit-card-numbers-and-passwords-from-your-site-here-s-how-9a8cb347c5b5) ¿Qué pasaría si incluyéramos una dependencia así en alguno de nuestros contenedores con privilegios de root?

La prueba

Si ustedes crean un contenedor (de una imagen de desarrollo en la que se use directamente el usuario root) tienen varias formas de comprobar cuales privilegios son los que tiene el proceso corriendo en el contenedor.

Lo primero que pueden hacer es entrar a la consola interactiva y preguntar por el usuario actual. Podemos hacer esto con el comando whoami o el comando id -u, la salida debería ser la siguiente:

$ docker exec -it <idContenedor> /bin/bash
$ whoami
root
$ id -u
0

También podemos ver los procesos que se están ejecutando en un contenedor en específico sin tener que entrar a la consola interactiva:

$ docker top <idContenedor>

La salida del comando anterior nos dará el id del proceso que se está ejecutando dentro del contenedor así como el nombre del usuario que lo ejecutó.

Nota: en los enlaces que puse al final del texto se usan comandos como ps, pero al intentar usarlos en la consola interactiva de la imagen de .Net nos damos cuenta que el comando no está disponible.

La solución

La solución inmediata para remediar este problema es crear un usuario y asignarlo al contenedor al momento de crearlo, esto siendo en el Dockerfile. Las siguientes lineas nos ayudaran a hacerlo:

RUN groupadd -r nombreGrupo && useradd -r -g nombreGrupo nombreUsuario
USER nombreUsuario

Los comandos para crear usuarios y grupos son distintos entre las diferentes distribuciones Linux que usemos como base en nuestro Dockerfile.

Agregando estas dos lineas en el stage final del Dockerfile, antes de ejecutar el ENTRYPOINT, nos permitirá usar este usuario en vez de root.

Kestrel y aplicaciones Non Root

Después de hacer estos cambios e intentar correr el proyecto, nos daremos cuenta el proyecto no va a poder arrancar.

El problema aquí es que aun que el puerto por default que usa Kestrel para servir nuestra api durante el desarrollo es el 5000, al momento que incluimos la imagen mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim (runtime de net core) de base en nuestro Dockerfile, seteamos inconscientemente el puerto 80 como el designado para nuestra aplicación.

Lo único que necesitamos hacer para remediar lo anterior es:

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-buster-slim AS base
WORKDIR /app
ENV ASPNETCORE_URLS=http://+:5000
EXPOSE 5000

Justo después de hacerle pull a la imagen de runtime que usamos para nuestro proyecto de Net Core.

Lo único que queda por hacer, sería routear el puerto 8080 del host con el 5000 del container, esto dentro del docker-compose.yml

version: '3.7'
services:
    api:
        ...
        ...
        ports:
            - "8080:5000"

La lección

Así como revisamos la precedencia de las dependencias que usamos en nuestros proyectos, también debemos de informarnos acerca de las imágenes que usamos como base para nuestros proyectos ya que no todas están preparadas para subirse a producción. Es por lo anterior que siempre tenemos que revisar qué es lo que hacen estas imágenes base y hacer nuestro Dockerfile multistage para poder definir bien la imagen que correrá en nuestro ambiente productivo.

Enlaces de referencia

Running a Docker container as a non-root user

Best practices for writing Dockerfiles

Kestrel web server implementation in ASP.NET Core

Processes In Containers Should Not Run As Root

Docker user best practices

Docker Tips: Running a Container With a Non Root User

Understanding how uid and gid work in Docker containers

I am a Mexican Software Developer & Senior CS student, Ask Me Anything!

Carlos García — Wed, 13 Mar 2019 22:14:25 +0000

I will be completing my Bachelors Degree in Computer Science in June (in Mex) and I am currently working and doing social service as a Software Developer.

I thought that maybe it would be interesting for you to know how is it to be a Dev/Student in Latam, so here I am.

I used to do web development in my work but now I am doing a lot of Image Processing stuff. In the social service (for the University) I am doing Machine Learning in my University's Hospital.

Learning how to learn: CS Edition

Carlos García — Tue, 09 Oct 2018 19:57:53 +0000

I never thought I would be a Software Engineer, back when I was little I used to have the firm conviction to be an Architect, but something happened... I realized that the more I grew up the more I became more interested in Computers. After my third semester of High School (I live in México, and in my state, public High School lasts 4 semesters) I came with an answer: I was decided to do a BS in Computer Science.

Lets go forward 4 months after I started university. It was the end of my first semester in school (2015, 3 years ago), just 4 months of experience coding, my first programming class was object oriented programming and the deadline of my first final project in my CS degree was 1 week away.

An ERP system to manage the students, professors, classes and schedules of a university using a MySql Database.

I wanted to cry. Like, literally. It was my first project in my CS career and I was stuck. What is a database? What is SQL? What is a non-relational database? What is a database management system? How can I connect my Java code to a database? I used to have a lot of questions like those, I had no experience and I had no idea in how to do those things.

Of course that I could have just copied code from stack overflow or pages like that, but I NEEDED to know how things work. For me, copying is just not enough. I was trying to finish the project, doing all from scratch and by my own.

I remember those nights of searching online in a lot of videos, web pages, books, everything... just to bring to my head new questions. I was totally lost. Searching the web was just doing harm to myself, Computer Science is an ocean of information and I was in the middle of that ocean with no clue of where I was, what to do or what information to search.

Our team finished the project with help of other students from higher semesters.

I still remember the feeling. The sensation that you know nothing, that even if you put all your effort in searching information, you don't understand anything, everything seems to be written in a foreign language (Actually it was, everything was in English, but you understand the point).

Even 6 months later, after a C programming class, searching how to do web programming was like... wait what the hell is a framework and why do people recommend tons of them? What is Django? Backend? Frontend? What is the difference between a framework and a library? Maybe I was too slow, but that was a lot of information for me.

So I don't know if it was just me or everyone feels this way at the beginning, but I was very lost, I had the wish to learn more, but trying that just left me with more questions.

Do I still feel the same?

No. Absolutely no. I think that at some point of my degree I learned how to learn. This is a very import skill, because as a Software Engineer, you need to be updated with new technologies and you need to have the ability to learn new tech and tools as you walk through your career.

Maybe, eventually, everyone gets to this point. The point where you can surely read any documentation online and pick a new language. The point where you can read about new tech without being completely lost. The point where you can learn whatever you want online, just with a little patience.

But maybe not, maybe some people gets so frustrated that decides to quit CS, maybe some people will convince themselves thinking: "This is not for me". If you are getting to that point of frustration let me tell you something, you are not alone, everyone in the developers community is here to help you.

Do Not Give Up.

The next tips are for you. I want to give you some of my little experience as a CS Student in how to start diving in this beautiful ocean of knowledge. Keep in mind that this tips were the little things that helped me out to be a better learner, this tips may not be useful for your situation because we are all different.

Ask for help

Maybe it sounds obvious, but it is not. Sometimes our pride doesn't let us to ask for help, even tho it is a normal and healthy thing to do.

Don't expect someone giving you all the answers. Ask for advice, ask for experiences, try to understand how they learned what they know, try to figure out what do you need to start to study to get to the level where they are. Ask for advice to know how you will start tackling all the information that is out there.

Be Social

Going to Campus Party México (A tech convention full of conferences) has been one of the best experiences of my life. I spent 8 hours traveling in a bus with a bunch of strangers across the country just to meet new people and to learn all that I could about technology.

Talking to all the devs, the hackers, the creative people and even the business people, all of that helped me to grow in an incredible way.

Having conversations with people that have more experience than you is like reading a good book. It's amazing. You get to know experiences that will help you through you journey, knowing what is going to come and how they affronted those situations is a great opportunity for you to think about how you could react to similar situations. You start to discover a lot of things that you were unaware of.

Math is fun

Not everybody thinks this way but I do.

Having a good background in math is very helpful for every programmer. Probably in you daily work you will not use derivatives and integrals BUT algebra, calculus, probability and geometry will give you an excellent sense of logic.

I am not saying that you have to be good at math to be a good dev. My point is that, in my case, I can see a relation between having more ability with math and having more understanding in how a computer works and more ease writing code.

Read Read and Read

Reading is fundamental for your development. Articles like the ones that you can find here or in any development site are very helpful.

Be a proactive student, don't be satisfied with the information that you get in the school, in the bootcamp or in the online-course.

You need to be hungry of information. Time is not an excuse, I read "Clean Code" by Robert C. Martin between my Uni classes even tho I work halftime as a Web Dev.

If I can do it, you surely can.

Make CS an important part of your life

After a few months into my degree I realized that making CS a constant topic in my life, and I am not including here my "Academic Life", was a great way to learn about short topics in a fun and fast way.

When I say "Make CS an important part of my life" I am referring to little things like, following YouTube channels about CS, following devs in Twitter, going to conferences about tech, making CS a topic of conversation with other devs/classmates instead of talking about the last-night episode of -insert favorite show- and even talking with my Uni professors about their experience in the tech industry.

I am not saying that you should leave all your hobbies to live a 100% software engineering life. I am saying that you should consider CS as another hobbie in your life.

It's okey if this is too much CS for you, some people prefer to think about this things only in their work time. But, if you are like me and you absolutely LOVE coding and learning new things about tech everyday, you should consider this advice.

Do not stress out

This point is very important. Always keep calm.

NO ONE knows everything, so keep calm. It is okey if you don't understand some topic, it is okey if you don't understand some tech and it is okey if you just don't 'feel' to learn it.

I used to stress out a lot because my skills in web development (specially front-end) are not the best out there, but after some time thinking about what I really want in my life I realized that web development Its just not my thing.

So, after all, there was no point in getting stressed because I didn't know the latest JavaScript framework or because I didn't know how to do good front end design if at the end of the day I was going to pursue the low level programming and algorithms path.

Those were some aspects of my life as student that helped me to learn more and faster. Maybe those points do not apply for you, but I feel the need to bring new ideas to the discussion, because after all, communities like this one helped me in my introduction to this industry.

Sometimes you can feel down, sometimes you can feel that your productivity levels are really low and that you are not learning anything, but let me say to you this: Eventually, everything gets better, just keep going, keep learning, keep putting effort in what you want.

"Everything in this life has a fix, except death" So enjoy your life learning what you love.

Thank you for reading ~

Understanding: Program Stack and Recursion

Carlos García — Thu, 27 Sep 2018 06:03:01 +0000

Recently, I've been doing a lot of research in "advance topics" of C++, I am very interested in things like memory management and optimization (I'm currently reading "Introduction to Algorithms" to improve my skills).

In my research, I found the topic of recursion. I studied this topic in my "Data Structures" class in university, but I wanted to understand in a deep way how the computer handles recursion and how it can be used instead loops.

In this post I will be explaining how I understood the role that the stack plays in recursion and how you can apply recursion in linear algebra to obtain the determinant of a matrix.

So... what is the Stack?

The stack is a LIFO data structure (Last in, first out). It is literally what you imagine: when you "push" data, this data will go into the stack and it will sit above the last pushed element converting itself in the new "top" element. This process will repeat each time you "push" data to the stack.

When you want to read an element from the stack, you "pop" the top element of the stack. That is why the last element pushed into the stack is the first element to get out of the stack.

Image Source

Relation between the Stack and Recursion

Well, when you are running a code (Let's say, a C++ code) the runtime of the language manages the "program-stack" this stack will be the structure used the store the variables used in your code and the calls to the different functions that you invoke in your code.

(Dynamic memory spaces created with the 'new' operator are stored in the "Heap", which is a different structure than the Program-Stack)

Keeping track of the function calls with the Stack makes possible things like passing parameters, returning values and of course: Recursion.

Every time you call a function in your code, the runtime will push a "stack frame" into the stack. The stack frame is a block of information that contains the information of the subrutine. This information includes: the parameters, a return address and the local variables of the function.

When you use recursion, you are pushing a stack frame each time your function calls itself. The Call Stack (or "Program-Stack" as mentioned before) has a finite size per program run (The size is calculated before the program execution), this can lead to a dangerous situation because you can actually surpass the quantity of information that the stack can hold: this is the famous "Stack-Overflow".

Image Source

But don't hold yourself, the runtime will not be pushing stack frames to the stack all the time. When you use the "Return" argument or when the function terminates its execution, the program will return to the "Return Address" and the stack frame will be pop out of the stack.

This is why is so important to have a base case for the recursion. The base case is the case in which the function will not call itself but return an specific value to the previous call.

The base case assure us that at some point of the recursion the functions will start to "roll back" and this will start to pop the stack frames of the recursion out of the Stack.

If you don't have a base case, you will definitely cause a Stack Overflow.

Using recursion to get the determinant of a Matrix.

So, in the next part I will try to demonstrate how to use recursion to get the determinant of a matrix. (This code is a first draft, so there is room for improvement, feel free to give suggestions about the code).

This code will be using the "Standard Method" for solving determinants, if you don't know how it works, you can find how to do it here.

Now lets see the code:


//We will pass the matrix and the size n of the matrix(nxn)
int determinant(int** matrix, int size){
    if(size == 2){
        /*This one is the base case! 
        This case will return the result for the smallest sub-matrix (2x2)*/
        return (matrix[0][0] * matrix[1][1]) - (matrix[0][1] * matrix[1][0]);
    } else {
        //This bool is used for the additions of determinants of the sub-matrices. 
        //Remember that we will add in a pattern of (+ - + - ...)
        bool isNegativeAddition = false; 
        int determinantResult = 0;

        for(int x = 0; x < size; x++){
            int i = 0;
            //This is a temporary place to store the values for the new matrix
            int *numbersForNewRecursiveCall = new int[(size - 1) * (size - 1)];

            //We fill the temp with the values of the new sub-matrix
            for(int sy = 0; sy < size; sy++){
                for(int sx = 0; sx < size; sx++){
                    if(sy != 0 && sx != x){
                        numbersForNewRecursiveCall[i] = matrix[sy][sx];
                        i++;
                    }
                }
            }

            //Then we fill an Array[][]
            i = 0;
            int **subMatrix = declareArray(size-1);
            for(int sy = 0; sy < size-1; sy++){
                for(int sx = 0; sx < size-1; sx++){
                    subMatrix[sy][sx] = numbersForNewRecursiveCall[i];
                    i++;
                }
            }

            /*This is the important part:
            The if is to determine when we will add or when we will rest 
            the determinants of the sub-matrix
            We will add the value of the previous determinant results with 
            the multiplication of the value that determines the sub-matrix and 
            the determinant of that particular sub-matrix*/
            if(isNegativeAddition == true){
                determinantResult = determinantResult + (matrix[0][x] * determinant(subMatrix, size-1) * -1);
                isNegativeAddition = false;
            } else {
                determinantResult = determinantResult + (matrix[0][x] * determinant(subMatrix, size-1));
                isNegativeAddition = true;
            }

        }
        return determinantResult;
    }
}

As we can see here, the recursion helps us to go to the smallest matrix possible in the method, get its determinant (base case) and then go up all the way to the addition of the different determinants of the n sub-matrices of the biggest (nxn) matrix.

This is literally my second post trying to give back some knowledge to the community so I will appreciate all the feedback that you guys can give to me. Also, I want to mention that the goal of this was not to code the best method for determinant solving, the goal of this was to explain the Stack and how Recursion works.

Thank you very much for reading this post ~

Gauss-Jordan in C++

Carlos García — Sat, 02 Sep 2017 18:57:14 +0000

So, a few days ago the Numerical Analysis teacher from my university left us with a proyect of coding a mathematical method of solving equations.

At first I thought of doing just a single solution for the problem, but whats the fun I that? So after thinking in funny ways to do my homework (I'm kinda nerd) I ended up doing the solution in C++ and in CUDA programming.

Notice that I really don't know how to code in CUDA, but man it's not real work so It's ok to learn from the mistakes.

This is my first time posting my code, so It would be really nice to read feedback from you guys.

So, this is my approach of the problem in C++

void jordan(double** matrix, double **answers, int matrixSize) { //Gauss-Jordan
//clock_t begin = clock();
double temp = 0;
for (int i = 0; i < matrixSize; i++) { //Recorre diagonalmente el arreglo - Goes in a diagonal way throught the matrix
    temp = matrix[i][i];
    for (int x = 0; x < matrixSize; x++) { //Hace 1 la diagonal ([i][i]) y divide al resto de la fila - Makes 1 the number in [i][i] and divides the row 
        matrix[i][x] = matrix[i][x] / temp;
    }
    answers[i][0] = answers[i][0] / temp;
    double multiplyFactor = 0;
    for (int y = 0; y < matrixSize; y++) {
        if (y != i) {
            multiplyFactor = matrix[y][i];
            for (int x = i; x < matrixSize; x++) { //Recorre la fila haciendo 0 las coordenadas en la columna de [i][i] - Makes 0 the numbers in the column of [i][i]
                matrix[y][x] = matrix[y][x] - (matrix[i][x] * multiplyFactor);
            }
            answers[y][0] = answers[y][0] - (answers[i][0] * multiplyFactor);
        }
    }
}

And this is in CUDA

__global__ void jordanGPU(long double ** matrix, long double * answer, int i)
{
    int idx = threadIdx.x;
    if (idx != i) {
            double multiplyFactor = matrix[idx][i];
            for (int x = i; x < 350; x++) { //Recorre la fila haciendo                     0 las coordenadas en la columna de [i][i]
            matrix[idx][x] = matrix[idx][x] - (matrix[i][x] *         multiplyFactor);
        }
    answer[idx] = answer[idx] - (answer[i] * multiplyFactor);
    }
}

clock_t begin = clock();
    double temp = 0;
    for (int i = 0; i < matrixSize; i++) { //Recorre diagonalmente el arreglo
        temp = matrix[i][i];
        for (int x = 0; x < matrixSize; x++) { //Hace 0 la diagonal ([i][i]) y divide al resto de la fila
            matrix[i][x] = matrix[i][x] / temp;
        }
        answers[i] = answers[i] / temp;

        cudaMemcpy(matrixGPU, matrix, matrixBytes, cudaMemcpyHostToDevice);
        cudaMemcpy(answersGPU, answers, answerBytes, cudaMemcpyHostToDevice);

        jordanGPU << <1, 350 >> >(matrixGPU, answersGPU, i);

        cudaMemcpy(matrix, matrixGPU, matrixBytes, cudaMemcpyDeviceToHost);
        cudaMemcpy(answers, answersGPU, answerBytes, cudaMemcpyDeviceToHost);

        cudaFree(matrixGPU);
        cudaFree(answersGPU);

Hope to read recommendations and suggestions about my code from you guys!
Thanks for reading!~

Forming a programming career

Carlos García — Fri, 18 Aug 2017 18:53:34 +0000

Being a computer science student is kinda hard, not because the classes, but because I'm completely lost in what I want to do with my professional live after university. And when I say lost... I REALLY mean it.

I am currently working in web. We are asked to do both front and back end. We use JavaScript, C# WebServices and SqlServer. I just love doing C# and SQL, but I really hate the JavaScript/jQuery/Angular/CSS/HTML part which is like the 70% of work that I have.

I am afraid of getting stuck in this situation. I really like programming in C, C++, Java, C++, Sql, doing Arduino proyects, learning about algorithms, AI and I currently signed up for an Assembly class in the University. I just cant imagine my future doing web programming.

I just don't know where to start to start doing what I like. What type of career should I start forming?

I would love to read personal experiences from you guys. Thanks for reading.

Recomendations in choosing a Linux distro

Carlos García — Thu, 03 Aug 2017 03:04:05 +0000

So, last semester I took a class about Bioinformatics (Python Programming) and the professor made us to use Fedora, we really didn't learn like a lot of Linux, just the basics.

Since I'm studying computer science I think that learning Linux (In a more complete way) will be very usefull for my career. So, with your experience, which distro do you recommend me to get started? (I will be very gratefull if you recommend a book or a online course to learn about it).

Thank you for your time guys, and sorry for my english, greetings from Mexico!