Skip to main content

Kubernetes Execution from dev shm

Event Information​

Meaning​

  • This event indicates that a process is attempting to execute a command from the shared memory (/dev/shm) within a Kubernetes pod.
  • It could potentially be a security risk as shared memory is accessible by all containers within the same node, allowing for potential privilege escalation or unauthorized access.
  • To investigate further, you can check the specific pod and container where the event occurred using the following kubectl command: kubectl describe pod <pod_name>

Remediation​

  • Create a Kubernetes Pod manifest file with a volume mount to a different directory, avoiding the use of /dev/shm:
apiVersion: v1
kind: Pod
metadata:
  name: remediation-pod
spec:
  containers:
  - name: remediation-container
    image: python
    volumeMounts:
    - mountPath: /mnt
      name: data
  volumes:
  - name: data
    emptyDir: {}
  • Apply the Pod manifest file to the cluster using kubectl apply:
kubectl apply -f pod_manifest.yaml
  • Verify that the remediation Pod is running successfully and the container is using the correct volume mount:
kubectl get pods
kubectl describe pod remediation-pod