Table des matières
- 2026:
- 2025:
4 billet(s) pour septembre 2026
| Notes HTTP Strict Transport Security - HSTS | 2026/09/18 11:04 | Jean-Baptiste |
| Notes GNU Linux GPU carte graphiques | 2026/09/08 15:49 | Jean-Baptiste |
| Notes GNU Linux graphique | 2026/09/08 15:42 | Jean-Baptiste |
| Notes urlencoding - passer des mots de passe en HTTPS | 2026/09/03 17:58 | Jean-Baptiste |
Pb cgroup controllers not delegated to non-privileged users - SystemD delegate failed - cgroupControllers
Voir aussi :
$ podman info --format '{{json .}}' | jq .host.cgroupControllers [] $ cat /sys/fs/cgroup/user.slice/user-1003.slice/cgroup.controllers $ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers
/etc/systemd/system/user-0.slice
[Unit] Before=systemd-logind.service [Slice] Slice=user.slice [Install] WantedBy=multi-user.target
/etc/systemd/system/user@.service.d/delegate.conf
[Service] Delegate=cpu cpuset io memory pids
/etc/systemd/system/user-.slice.d/override.conf
[Slice] CPUAccounting=yes MemoryAccounting=yes IOAccounting=yes TasksAccounting=yes
chmod a+r /etc/systemd/system/user-0.slice chmod a+r /etc/systemd/system/user@.service.d/delegate.conf chmod a+r /etc/systemd/system/user-.slice.d/override.conf systemctl daemon-reload
systemctl --user daemon-reload
Vérif (avec le compte utilisateur)
cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers
$ cat /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers
cpuset cpu io memory pids
$ podman info --format '{{json .}}' | jq .host.cgroupControllers
[
"cpuset",
"cpu",
"io",
"memory",
"pids"
]
Autres
Pour information : /usr/lib/systemd/system/user-.slice.d/10-defaults.conf
# SPDX-License-Identifier: LGPL-2.1+ # # This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. [Unit] Description=User Slice of UID %j After=systemd-user-sessions.service StopWhenUnneeded=yes [Slice] TasksMax=80%
Trouver les fichiers dupliqués - double - doublon
find . -not -empty -type f -exec md5sum {} \; | sort | uniq -w32 -dD
Avec fdupes (voir aussi jdupes)
fdupes -rnN OpsMilori OpsMilori2
Pb encodage fichier ansible-lint yamllint
Erreurs
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 824: invalid continuation byte
iconv: illegal input sequence at position 824
ansible-lint plante lors de l'analyse d'un fichier YAML
Aucune erreur avec yamllint (parce qu'il ne fait pas les includes)
ansible-lint --offline app/plop.yml
Analyse et solution
$ strace --trace=%file ansible-lint --offline app/plop.yml
---
stat("/data/ansible/roles/app1/tasks/inventory_plugins", 0x7ffc4f077930) = -1 ENOENT (No such file or directory)
stat("/data/ansible/roles/app1/tasks/httpapi_plugins", 0x7ffc4f077930) = -1 ENOENT (No such file or directory)
stat("/data/ansible/roles/app1/tasks/become_plugins", 0x7ffc4f077930) = -1 ENOENT (No such file or directory)
getcwd("/data/ansible/playbooks", 1024) = 24
getcwd("/data/ansible/playbooks", 1024) = 24
getcwd("/data/ansible/playbooks", 1024) = 24
stat("/data/ansible/roles/plop/tasks/main.yml", {st_mode=S_IFREG|0640, st_size=1002, ...}) = 0
openat(AT_FDCWD, "/data/ansible/roles/plop/tasks/main.yml", O_RDONLY|O_CLOEXEC) = 6
Traceback (most recent call last):
File "/data/venv-ansible/lib64/python3.9/site-packages/ansible/parsing/utils/yaml.py", line 72, in from_yaml
openat(AT_FDCWD, "/data/venv-ansible/lib64/python3.9/site-packages/ansible/parsing/utils/yaml.py", O_RDONLY|O_CLOEXEC) = 6
new_data = json.loads(data, cls=AnsibleJSONDecoder)
File "/usr/lib64/python3.9/json/__init__.py", line 359, in loads
openat(AT_FDCWD, "/usr/lib64/python3.9/json/__init__.py", O_RDONLY|O_CLOEXEC) = 6
return cls(**kw).decode(s)
File "/usr/lib64/python3.9/json/decoder.py", line 337, in decode
openat(AT_FDCWD, "/usr/lib64/python3.9/json/decoder.py", O_RDONLY|O_CLOEXEC) = 6
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib64/python3.9/json/decoder.py", line 355, in raw_decode
openat(AT_FDCWD, "/usr/lib64/python3.9/json/decoder.py", O_RDONLY|O_CLOEXEC) = 6
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/data/venv-ansible/bin/ansible-lint", line 8, in <module>
openat(AT_FDCWD, "/data/venv-ansible/bin/ansible-lint", O_RDONLY|O_CLOEXEC) = 6
---
$ file /data/ansible/roles/plop/tasks/main.yml /data/ansible/roles/plop/tasks/main.yml: ISO-8859 text
$ yamllint /data/ansible/roles/plop/tasks/main.yml
Traceback (most recent call last):
File "/data/venv-ansible/bin/yamllint", line 8, in <module>
sys.exit(run())
File "/data/venv-ansible/lib64/python3.9/site-packages/yamllint/cli.py", line 227, in run
prob_level = show_problems(problems, file, args_format=args.format,
File "/data/venv-ansible/lib64/python3.9/site-packages/yamllint/cli.py", line 102, in show_problems
for problem in problems:
File "/data/venv-ansible/lib64/python3.9/site-packages/yamllint/linter.py", line 191, in _run
buffer = decoder.auto_decode(buffer)
File "/data/venv-ansible/lib64/python3.9/site-packages/yamllint/decoder.py", line 71, in auto_decode
return stream_data.decode(encoding=detect_encoding(stream_data))
UnicodeDecodeError: 'utf-8' codec can't decode byte 0xe9 in position 824: invalid continuation byte
Diffing
$ diff <(cat -A /data/ansible/roles/plop/tasks/main.yml) <(cat /data/ansible/roles/plop/tasks/main.yml | sed -e 's/$/$/')
26c26
< guest_source_file_path: 'C:\\Users\\{{ vm_app_user }}\\Desktop\\DM-imarrage CIE*'$
---
> guest_source_file_path: 'C:\\Users\\{{ vm_app_user }}\\Desktop\\Dmarrage CIE*'$
29c29
< vm_admin_password: "{{ vm_app_password }}"
\ No newline at end of file
---
> vm_admin_password: "{{ vm_app_password }}"$
$ iconv -t utf-8 /data/ansible/roles/plop/tasks/main.yml > /data/ansible/roles/plop/tasks/main.yml.new iconv: illegal input sequence at position 824
iconv -f iso-8859-15 -t utf-8 /data/ansible/roles/plop/tasks/main.yml > /data/ansible/roles/plop/tasks/main.yml.new mv /data/ansible/roles/plop/tasks/main.yml /data/ansible/roles/plop/tasks/main.yml.bad mv /data/ansible/roles/plop/tasks/main.yml.new /data/ansible/roles/plop/tasks/main.yml
$ yamllint /data/ansible/roles/plop/tasks/main.yml.new /data/ansible/roles/plop/tasks/main.yml.new 3:16 error trailing spaces (trailing-spaces) 26:81 error line too long (83 > 80 characters) (line-length) 29:47 error no new line character at the end of file (new-line-at-end-of-file)
PS : pour ansible-lint il est important que le fichier ait l’extension yml ou yaml.
CRI runtimes - Container Runtime Interface
Brouillon
Voir :
Voir Docker est mort :
CRI runtimes - Container Runtime Interface
Voir :
https://www.mirantis.com/blog/cri-dockerd-faq-blog/ dockershim and cri-dockerd
mirantis migrate nodes from dockershim
Voir l'option --cri-containerd
Docker does not implement CRI. If you're going to use Docker you need to also install cri-dockerd to translate cri API to docker API.
Plus Docker (Dockershim) support was removed since 1.24 in K8S
https://kubernetes.io/docs/setup/production-environment/container-runtimes/
Mirantis Container Runtime (MCR) is a commercially available container runtime that was formerly known as Docker Enterprise Edition.
CRI-O vs Docker https://www.suse.com/c/fr/podman-et-cri-o-le-nouveau-duo-de-la-conteneurisation/ Podman utilise CRI-O
Podman Podman is a daemonless, open source containerization tool used in lab exercises as a replacement for Docker.
Podman implements CRI-O, while Docker implements “CRI”.
Autres
Isolation MicroVM des containers :
- Kata Container
- Firecracker
https://blog.octo.com/securite-pods-isolation-runtimeclass
https://blog.stephane-robert.info/docs/conteneurs/moteurs-conteneurs/incus/
crun a container runtime written in C (by contrast, runc is written in Go.) firecracker-containerd from AWS, which implements the OCI specification as individual lightweight VMs (and it is also the same technology which powers AWS Lambda) gVisor from Google, which creates containers that have their own kernel. It implements OCI in its runtime called runsc.
https://vineetcic.medium.com/the-differences-between-docker-containerd-cri-o-and-runc-a93ae4c9fdac
Notes Kubernetes k8s - sécurite
Voir :
- Kube-bench
Containers !
Ensure Containers Do Not Run As Root
Source : https://www.fairwinds.com/blog/kubernetes-basics-tutorial-ensure-containers-do-not-run-as-root
apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsNonRoot: true runAsUser: 1000
apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: containers: - name: busybox image: busybox securityContext: runAsNonRoot: true runAsUser: 1000 # allowPrivilegeEscalation: false # privileged: false
If there are no non-root users in the Docker image, you may also need to create one in the Dockerfile, with:
RUN useradd nonroot -u 1000 --user-group # useradd is a low level utility for adding users. On Debian, administrators should usually use adduser(8) instead.
Interdire le host namespace
Comment ?
spec: hostPID: true hostIPC: true hostNetwork: true volumes: - name: host-filesystem hostPath: path: /
Autres
runAsNonRoot: true: Ensures that the container does not run as root. If the image’s default user is root, Kubernetes will refuse to start the pod.runAsUser: 1000&runAsGroup: 3000Forces the container to use a specific non-root user (UID 1000) and group (GID 3000).fsGroup: 2000Ensures that files created in shared volumes have the correct group ownership.- Container Security Settings:
Setting privileged: false,allowPrivilegeEscalation: false, and dropping all capabilities dramatically limits what processes within the container can do.
spec! runAsUser: 0
securityContext: allowPrivilegeEscalation: true
Utiliser
- ServiceAccount
- les RBAC
- mTLS pour les services
- EncryptionConfiguration resource pour les servrets (HashiCorp Vault)
- Sécuriser etcd
- Don't allow pods that run containers with root
- SecurtyPolicy (Open Policy Agent / Kyverno)
Utiliser
- Les NetworkPolicy (par défault tous les noeuds peuvent communiquer avec tous les noeuds Oou ServiceMesh (Side car)
Outils analyse sécu
Voir :
- m9sweeper
Kube bench
Step 1: Download the official job manifest
Clone the kube-bench repo or grab job.yaml from the GitHub releases page.
git clone https://github.com/aquasecurity/kube-bench.git cd kube-bench # ou kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
Step 2: Apply the job to your cluster
kubectl apply -f job.yaml
Step 3: Watch the pod until it shows as Completed
kubectl get pods -w
Step 4: Review the results
#kubectl logs -l job-name=kube-bench kubectl logs pod/kube-bench-6zgst
podman run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t docker.io/aquasec/kube-bench:latest run
kubescape
Voir :
Install
kubectl krew update
kubectl krew install kubescape
Scan
kubectl kubescape scan kubescape scan --format html --output results.html
Voir Trivy Scan de vulnérabilité pour les images de conteneurs