CKSKubernetes 1.35

Exercises

Exercise: a profile that blocks writes to /tmp

updated 2026-10-22 by seed

Host: worker (root) + controlplane · Time: 12 min · Domain: System Hardening

Task

  • Create an AppArmor profile named deny-tmp-write that denies writes below /tmp.
  • Load it on the node that runs Pod guarded (namespace prod).
  • Apply it to that Pod only.

Acceptance criteria

  • kubectl exec -n prod guarded -- cat /proc/self/attr/current shows deny-tmp-write.
  • kubectl exec -n prod guarded -- sh -c 'echo x > /tmp/f' → Permission denied.
  • Writing to /var/tmp still works.

Solution

On the worker:

sudo tee /etc/apparmor.d/deny-tmp-write >/dev/null <<'EOF'
#include <tunables/global>
profile deny-tmp-write flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  file,
  deny /tmp/** w,
}
EOF
sudo apparmor_parser -r /etc/apparmor.d/deny-tmp-write
sudo aa-status | grep deny-tmp-write

On the control plane:

spec:
  containers:
  - name: guarded
    image: nginx:1.27
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: deny-tmp-write
kubectl apply -f pod.yaml
kubectl exec -n prod guarded -- cat /proc/self/attr/current

/proc/self/attr/current is the only honest check. If it says unconfined, the
profile did not attach — usually because it is not loaded on that node.