容器镜像安全

现状

最近某银行遭受供应链攻击事件传的沸沸扬扬,安全又双叒叕进入了人们的视野。安全确实是一个非常重要,但是又容易被忽略的话题。但是现在到了一个不得不人人重视安全,人人为安全负责的时代。尤其以现在非常火爆的云原生来讲,业界已经达成共识:云原生时代已经到来,如果说容器是云原生时代的核心,那么镜像应该就是云原生时代的灵魂。镜像的安全对于应用程序安全、系统安全乃至供应链安全都有着深刻的影响。然而,镜像的安全却是非常令人担忧的。根据 snyk 发布的 2020 年开源安全报告中指出,在 dockerhub 上常用的热门镜像几乎都存在安全漏洞,多的有上百个,少的也有数十个。具体数据如下图所示:

snyk-report

然而,不幸的是,很多应用程序的镜像是以上述热门镜像作为基础镜像,更不幸的是,由谁来负责安全问题,却始终争论不断,这点从报告中也可得到了印证:

snyk-report-1

其实,可以通过预防为主,防治结合的方式来提高镜像的安全性。“预防”主要指在构建镜像的过程中遵从一些镜像构建的正模式,诸如选择合适的基础镜像、不安装不需要的包、最小权限原则等等;“治”指的是做一些镜像扫描,扫描出问题就去修复。但是最不幸的是,根据Anchore 发布的 2021 软件供应链安全报告显示,做镜像扫描的占比大概在50%左右。具有非常大的上升空间。

anchore-report

镜像扫描

镜像扫描是比较容易做的,也可以很容易的集成到 CI/CD Pipeline 里面。常用的开源扫描工具有:trivyanchoreclair。扫描的原理都没有太大差别:提取镜像特征 –> 和漏洞数据库(CVE、NVD等)中的数据进行比对 –> 出具漏洞报告。当然,工具的堆砌可能会带来维护成本的增加,而极狐GitLab 提供的开箱即用的镜像扫描功能只需简单配置即可使用,而且能非常容易的集成到极狐GitLab CI/CD 里面。

极狐GitLab 镜像安全扫描

极狐GitLab 提供强大的 DevSecOps 能力,包括:容器镜像扫描、静态应用安全测试 (SAST)、动态应用安全扫描(DAST)、密钥检测、License合规、依赖项扫描以及模糊测试。镜像安全扫描是其中一项DevSecOps 能力,在 10.4 版本中引入。GitLab 默认是集成了上述的 trivy 和 grype。下面我们现简单的看一下这两款工具。

trivy

trivy 是一款扫描工具,可以对容器镜像、文件系统、Git 仓库以及配置问题进行扫描。更多内容可以查看trivy 官网。使用也是非常方便的,以 macOS 为例,先用如下命令进行安装:

$ brew install aquasecurity/trivy/trivy

查看版本来确定是否安装成功

$ trivy --version
Version: 0.19.2

接着直接用 trivy image-name 即可进行镜像扫描。

trivy

还可以使用一些参数来对结果进行过滤,在这儿就不多展开赘述了。

grype

grype 也是一款对容器镜像和文件系统进行扫描的工具。更多内容可以查看grype。使用也很简单,以 macOS 为例,先用如下命令进行安装:

$ brew tap anchore/grype
$ brew install grype

查看版本来确定是否安装成功

$ grype version
Application:          grype
Version:              0.17.0
BuildDate:            2021-08-25T21:39:11Z
GitCommit:            c6529822fabd537af8a1439fc6d1179a3632bf33
GitTreeState:         clean
Platform:             darwin/amd64
GoVersion:            go1.16.7
Compiler:             gc
Supported DB Schema:  3

接着直接用 grype image-name 即可进行镜像扫描。

grype

极狐GitLab 镜像安全扫描实践

极狐GitLab 的镜像安全扫描是通过极狐GitLab 容器镜像分析器(container-scanning analyzer)来实现的,分析器使用的镜像有多个,这个取决于环境变量 CS_ANALYZER_IMAGE 的值,可用的选项有

registry.gitlab.com/security-products/container-scanning:4
registry.gitlab.com/security-products/container-scanning/grype:4
registry.gitlab.com/security-products/container-scanning/trivy:4

可以用上面的任意一个镜像来构建分析器,从而完成镜像安全扫描。分析器可以单独使用,也可以和极狐GitLab CI/CD 做集成。先来看如何单独使用极狐GitLab 容器镜像分析器来做镜像安全扫描。

使用如下命令即可单独使用极狐GitLab 容器镜像分析器来扫描容器镜像

$ docker run -i --rm -e DOCKER_IMAGE=alpine registry.gitlab.com/security-products/container-scanning/trivy:4

参数含义:

可以看到如下结果

[INFO] [2021-10-22 03:05:10 +0000] []  ▶  Remediation is disabled; /home/gitlab/Dockerfile cannot be found. Have you set `GIT_STRATEGY` and
`DOCKERFILE_PATH`?
See https://docs.gitlab.com/ee/user/application_security/container_scanning/#solutions-for-vulnerabilities-auto-remediation

[INFO] [2021-10-22 03:05:10 +0000] []  ▶  Scanning container from registry alpine for vulnerabilities with severity level UNKNOWN or higher, with gcs 4.3.17 and Trivy Version: 0.19.2, advisories updated at 2021-10-21

[INFO] [2021-10-22 03:05:17 +0000] []  ▶  2021-10-22T03:05:17.677Z	INFO	Detected OS: alpine
2021-10-22T03:05:17.677Z	INFO	Detecting Alpine vulnerabilities...

可以看到极狐GitLab 容器扫描工具的版本:gcs 4.3.17,使用的 trivy 版本是:0.19.2。扫描的结果和前面的 trivygrype 是一样的。对于 alpine:latest 没有扫出来安全漏洞。再试一个有漏洞的镜像(alpine:3.10),再看看结果是如何展示的:

$ docker run -i --rm -e DOCKER_IMAGE=alpine:3.10 registry.gitlab.com/security-products/container-scanning/trivy:4
[INFO] [2021-10-22 03:12:20 +0000] []  ▶  Remediation is disabled; /home/gitlab/Dockerfile cannot be found. Have you set `GIT_STRATEGY` and
`DOCKERFILE_PATH`?
See https://docs.gitlab.com/ee/user/application_security/container_scanning/#solutions-for-vulnerabilities-auto-remediation

[INFO] [2021-10-22 03:12:20 +0000] []  ▶  Scanning container from registry alpine:3.10 for vulnerabilities with severity level UNKNOWN or higher, with gcs 4.3.17 and Trivy Version: 0.19.2, advisories updated at 2021-10-21

[INFO] [2021-10-22 03:12:35 +0000] []  ▶  2021-10-22T03:12:35.545Z	INFO	Detected OS: alpine
2021-10-22T03:12:35.545Z	INFO	Detecting Alpine vulnerabilities...
2021-10-22T03:12:35.545Z	WARN	This OS version is no longer supported by the distribution: alpine 3.10.9
2021-10-22T03:12:35.545Z	WARN	The vulnerability detection may be insufficient because security updates are not provided

+------------+-------------------------+--------------+-----------------+------------------------------------------------------------------------+
|   STATUS   |      CVE SEVERITY       | PACKAGE NAME | PACKAGE VERSION |                            CVE DESCRIPTION                             |
+------------+-------------------------+--------------+-----------------+------------------------------------------------------------------------+
| Unapproved | Critical CVE-2021-36159 |  apk-tools   |    2.10.6-r0    | libfetch before 2021-07-26, as used in apk-tools, xbps, and other prod |
|            |                         |              |                 | ucts, mishandles numeric strings for the FTP and HTTP protocols. The F |
|            |                         |              |                 | TP passive mode implementation allows an out-of-bounds read because st |
|            |                         |              |                 | rtol is used to parse the relevant numbers into address bytes. It does |
|            |                         |              |                 |  not check if the line ends prematurely. If it does, the for-loop cond |
|            |                         |              |                 |        ition checks for the '\0' terminator one byte too late.         |
+------------+-------------------------+--------------+-----------------+------------------------------------------------------------------------+

可以看到扫描结果会展示漏洞的严重等级(SEVERITY)、漏洞的详细内容(SEVERITY)。

可以很容易的在极狐GitLab CI 中集成镜像扫描:

variables:
  CS_ANALYZER_IMAGE: registry.gitlab.com/security-products/container-scanning/trivy:4

services:
  - docker:20.10.7-dind

stages:          
  - test

container_scanning:
  image: "$CS_ANALYZER_IMAGE"
  stage: test
  variables:
    GIT_STRATEGY: fetch
    DOCKER_IMAGE: alpine:3.10
  allow_failure: true
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
    paths: [gl-container-scanning-report.json]
  dependencies: []
  script:
    - gtcs scan

CI 语法解释:

可以在 Pipeline 的构建中看到如下构建日志

scan-result

扫描结果和单独使用极狐GitLab 镜像分析器时的结果是一样的。

当然也可以很方便的下载镜像扫描报告:

atifact

下载完毕之后,可以解析查看结果

cat gl-container-scanning-report.json | jq
{
  "version": "14.0.3",
  "vulnerabilities": [
    {
      "id": "0aa27b90612e559bb5accde4025d57ecc1932885",
      "category": "container_scanning",
      "message": "CVE-2021-36159 in apk-tools-2.10.6-r0",
      "description": "libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\0' terminator one byte too late.",
      "cve": "CVE-2021-36159",
      "severity": "Critical",
      "confidence": "Unknown",
      "solution": "Upgrade apk-tools to 2.10.7-r0",
      "scanner": {
        "id": "trivy",
        "name": "trivy"
      },
      "location": {
        "dependency": {
          "package": {
            "name": "apk-tools"
          },
          "version": "2.10.6-r0"
        },
        "operating_system": "alpine 3.10.9",
        "image": "registry.gitlab.cn/majinghe/go-demo:3.0.0"
      },
      "identifiers": [
        {
          "type": "cve",
          "name": "CVE-2021-36159",
          "value": "CVE-2021-36159",
          "url": "https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch"
        }
      ],
      "links": [
        {
          "url": "https://github.com/freebsd/freebsd-src/commits/main/lib/libfetch"
        },
        {
          "url": "https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10749"
        },
        {
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E"
        },
        {
          "url": "https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E"
        },
        {
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E"
        },
        {
          "url": "https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E"
        }
      ]
    }
  ],
  "remediations": [
    {
      "fixes": [
        {
          "cve": "CVE-2021-36159",
          "id": "0aa27b90612e559bb5accde4025d57ecc1932885"
        }
      ],
      "summary": "Upgrade apk-tools to 2.10.7-r0",
      "diff": "ZGlmZiAtLWdpdCBhL0RvY2tlcmZpbGUgYi9Eb2NrZXJmaWxlCmluZGV4IGU3ZDI5ZWMuLjI4ODNiNzcgMTAwNjQ0Ci0tLSBhL0RvY2tlcmZpbGUKKysrIGIvRG9ja2VyZmlsZQpAQCAtOCw2ICs4LDcgQEAgUlVOIGdvIGJ1aWxkIGRldm9wcy5nbwogCiAjIEZST00gYWxwaW5lOmxhdGVzdAogRlJPTSBhbHBpbmU6My4xMAorUlVOIGFwayAtLW5vLWNhY2hlIHVwZGF0ZSAmJiBhcGsgLS1uby1jYWNoZSBhZGQgYXBrLXRvb2xzPTIuMTAuNy1yMAogCiBXT1JLRElSIC91c3Ivc3JjL2FwcC8="
    }
  ],
  "scan": {
    "scanner": {
      "id": "trivy",
      "name": "Trivy",
      "url": "https://github.com/aquasecurity/trivy/",
      "vendor": {
        "name": "GitLab"
      },
      "version": "0.19.2"
    },
    "analyzer": {
      "id": "gcs",
      "name": "GitLab Container Scanning",
      "vendor": {
        "name": "GitLab"
      },
      "version": "4.3.17"
    },
    "type": "container_scanning",
    "start_time": "2021-10-22T06:38:27",
    "end_time": "2021-10-22T06:38:29",
    "status": "success"
  }
}

和极狐GitLab 镜像仓库的集成

极狐GitLab 不仅提供开箱即用的 DevSecOps 功能。也提供开箱即用的镜像仓库功能,关于镜像仓库的使用可以查看公众号文章极狐GitLab 镜像仓库使用技巧。可以直接在极狐 GitLab CI 中使用极狐GitLab 镜像仓库和镜像扫描功能,只需要简单的配置即可,.gitlab-ci.yml 的内容如下:

variables:
  CS_ANALYZER_IMAGE: registry.gitlab.com/security-products/container-scanning/trivy:4
   
services:
  - docker:20.10.7-dind

stages:          
  - build
  - test
  - deploy

build:
  image: docker:latest
  stage: build
  services:
    - docker:20.10.7-dind
  script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:3.0.0 .
    - docker push $CI_REGISTRY_IMAGE:3.0.0

container_scanning:
  image: "$CS_ANALYZER_IMAGE"
  stage: test
  variables:
    GIT_STRATEGY: fetch
    DOCKER_USER: "$CI_REGISTRY_USER"
    DOCKER_PASSWORD: "$CI_REGISTRY_PASSWORD"
    DOCKER_IMAGE: $CI_REGISTRY_IMAGE:3.0.0
  allow_failure: false
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
    paths: [gl-container-scanning-report.json]
  dependencies: []
  script:
    - gtcs scan

deploy:
  stage: deploy
  image:
    name: bitnami/kubectl:latest
    entrypoint: [""]
  script:
     - kubectl config set-cluster jihu-tke --server="$KUBE_URL" --certificate-authority="$KUBE_CA_PEM"
     - kubectl -n gitlab-k8s-demo apply -f deployment.yaml

可以在构建结果中看到 Pipeline 流水线如下

gitlab-ci-scan

以及在构建日志中看到镜像扫描日志:

pipeline

可以看到,可以用极狐GitLab 一体化 DevOps 平台来完成源码管理、镜像构建、镜像扫描以及应用程序的部署。只需要简单配置即可。

结束语

安全是一个必须要重视的话题,现在讲的 DevOps 其实就等同于 DevSecOps,真正的 DevOps 是必须要融入安全的,人人为安全负责、处处有安全意识,才能构建起软件供应链安全的护城河。

而极狐GitLab 开箱即用的 DevSecOps 功能是能够为软件开发生命周期的不同阶段提供安全保障能力。从而来保证软件供应链的安全。

30天免费试用极狐GitLab专业版

极狐GitLab不仅是源代码管理或CI/CD工具,它是一个覆盖完整软件开发生命周期和DevOps的开放式一体化平台。

免费试用
Git为Software Freedom Conservancy的注册商标,GitLab为GitLab B.V.的注册商标,我们已获授权使用“极狐GitLab”。 鄂ICP备2021008419号-1

免费试用极狐GitLab 30天

有疑问? 联系我们

Gitlab x icon svg