Enhance Your Kubernetes Security with AppArmor: Deny Write Access to Sensitive Files

What is AppArmor?
AppArmor is a security module that restricts what applications can do on a system by enforcing security policies. In Kubernetes, it helps control container access to specific system files and directories, adding an extra layer of security.

Why Use AppArmor?
Even though containers are isolated, they might still access sensitive system files or directories. AppArmor lets you restrict access to prevent potential security risks by enforcing stricter boundaries for your containers.

Prevent Write Access to Sensitive Areas
To prevent containers from modifying sensitive files, such as those in the /etc/ directory, you can define an AppArmor profile that blocks write access.

1. Create the AppArmor Profile
   Create a profile that denies write access to /etc/**:

apparmor_parser -q <<EOF
#include <tunables/global>

profile block-etc-write flags=(attach_disconnected) { 
  #include <abstractions/base>

  file,

  # Deny all file writes.
  deny /etc/** w, 
}
EOF

In this profile:
deny /etc/** w: This rule ensures that no files within the /etc/ directory can be written to by the container.

2. Apply the Profile in Kubernetes
   Once the profile is created, apply it to your Kubernetes deployment using annotations. Here's the configuration:

apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor
  annotations:
    container.apparmor.security.beta.kubernetes.io/hello: localhost/block-etc-write
spec:
  containers:
  - name: hello
    image: busybox
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

The annotation container.apparmor.security.beta.kubernetes.io/hello: localhost/block-etc-write applies the block-etc-write AppArmor profile to the container.

The container runs a simple busybox container with a shell command that prints "Hello AppArmor!" and then sleeps for an hour.

Apply the Pod Configuration
Deploy the updated configuration:

kubectl apply -f hello-armor.yaml

Why It Matters

• Blocking write access to critical directories, like /etc/, ensures:
• Protection from accidental or malicious changes to system files.
  Increased security by reducing the risk of unauthorized modifications.

Conclusion
With AppArmor, you can easily restrict container access to sensitive areas, like /etc/, adding another layer of protection to your Kubernetes environment.