Create symlink over sensitive files

​

Event Information

​

Meaning

• The Create Symlink Over Sensitive Files event in a Kubernetes cluster indicates that a process or container attempted to create a symbolic link (symlink) pointing to a sensitive file or directory.
• This event could potentially be a security risk as it may allow unauthorized access or modification of sensitive data or system files.
• It is important to investigate this event further to identify the source of the symlink creation and take appropriate actions to mitigate the risk, such as removing the symlink and securing the sensitive files or directories.

1. Identify the pod or container involved in the event by checking the relevant logs or using the Kubernetes audit logs.
   • Use the following command to retrieve the logs of a specific pod:
     Copy

     Ask AI

     kubectl logs <pod_name> -n <namespace>
     

   • Check the Kubernetes audit logs to find relevant events:
     Copy

     Ask AI

     kubectl get events --field-selector=type=Normal -n <namespace>
     

2. Inspect the container or pod configuration to ensure that it does not have unnecessary privileges or access to sensitive files.
   • Use the following command to describe a pod and check its configuration:
     Copy

     Ask AI

     kubectl describe pod <pod_name> -n <namespace>
     

3. Review the security policies and RBAC (Role-Based Access Control) settings in the cluster to ensure that only authorized processes or containers have access to sensitive files or directories.
   • Use the following command to view RBAC roles and bindings:
     Copy

     Ask AI

     kubectl get roles,rolebindings -n <namespace>
     

   • Update RBAC settings as necessary to restrict access to sensitive files or directories.

​

Remediation

1. Identify the sensitive files that are being symlinked:
   • Use the kubectl exec command to access the affected container within the pod: kubectl exec -it <pod-name> -c <container-name> -- /bin/bash
   • List the sensitive files in the container: ls -l /path/to/sensitive/files
2. Remove the symlinked file and restore the original file:
   • Use the Python Kubernetes API to delete the pod:
     Copy

     Ask AI

     from kubernetes import client, config
     
     config.load_kube_config()
     v1 = client.CoreV1Api()
     
     v1.delete_namespaced_pod(name="<pod-name>", namespace="<namespace>")
     

   • Alternatively, you can use the kubectl delete command: kubectl delete pod <pod-name> -n <namespace>
3. Investigate and fix the root cause of the symlink creation:
   • Review the pod’s YAML manifest file to identify any volume mounts or hostPath configurations that allow write access to sensitive files.
   • Update the pod’s manifest file to remove or restrict the write access to sensitive files.
   • Apply the updated manifest file using the Python Kubernetes API or the kubectl apply command.