Tracer

Solution to capture all the syscalls generated by newly spawned containers and generate a Seccomp Profile whitelisting those captured syscalls.

Mitigation

If you have a working proof of concept you will be able to detect the syscalls that the exploit uses.

Fuzzer

Used to fuzz containers in order to increse the syscalls coverage.

Requirements:

Docker
Python3
Pip3
- Docker
- Grpcio
- Grpcio-tools
- Argparse

pip3 install -r requirements

PoCs:

PhpMail.
Nginx.
Apache.

Thesis

This project is the result of my thesis at the Information Security Master's Degree.
In case you need more information about this project, you can check out:

Thesis.