Skip to content
CKSSystem HardeningTwo nodesMedium

AppArmor: load a profile and confine a Pod

Scenario cks-sys-001 · about 8 minutes · 8 points · 5 grader checks

Load an AppArmor profile on a worker node in enforce mode and run a Pod confined by it through the securityContext field.

  • apparmor
  • kernel-hardening
  • securitycontext
  • node
  • system-hardening

What you will practise

  • Load and inspect AppArmor profiles with apparmor_parser and aa-status
  • Reference a Localhost AppArmor profile from securityContext.appArmorProfile
  • Schedule a Pod on the node that has the profile

Start this lab

With the CLI installed and signed in, this command provisions a two nodes cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-sys-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

The security team wrote an AppArmor profile for a workload that must never write to its filesystem. The profile file is on worker node exam-w1 at /etc/apparmor.d/k8s-deny-write; the profile it defines is named "k8s-deny-write". It is not loaded yet. 1. Load the profile on exam-w1 in enforce mode. 2. In namespace "apparmor" create a Pod "writer" (container "writer", image busybox:1.36, command "sleep 3600") that runs on exam-w1 and whose container is confined by that profile. Use the securityContext field, not the deprecated annotation. The Pod must be Running and a write inside the container (for example to /tmp) must be denied.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
System Hardening
Difficulty
Medium
Cluster topology
Two nodes
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More System Hardening labs

CKSSystem HardeningEasy

Node attack surface: rogue service and sudo rights

Find and disable a service listening on a worker node and remove a local user's sudo membership without breaking the node.

Two nodes · ~7 min · 8 points

  • systemd
  • attack-surface
  • least-privilege
  • linux-users
  • node

goldenkube start cks-sys-002

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.