Lab 01 — Exploring OS Security Layers: /proc, Kernel & User Space¶

Overview¶

The Linux kernel exposes a real-time window into running system state through /proc — a virtual pseudo-filesystem that exists only in memory. In this lab you will use /proc to examine kernel version information, security-relevant kernel parameters, process state, memory layout, and network settings. You will also observe the fundamental relationship between containers and the host kernel, and see how /proc entries are created and destroyed dynamically as processes come and go.

By the end of this lab you will understand:

• What security parameters the kernel exposes via /proc/sys
• How process state (PID, UID, memory maps) is represented in /proc
• Why containers share the host kernel and what that means for security
• How to read and interpret memory permission flags in /proc/PID/maps

Prerequisites¶

• Docker installed and running on your workstation
• Basic familiarity with Linux shell commands
• Completed the Chapter 1 reading on OS security architecture

Part 1 — Kernel Version and /proc Parameters¶

Step 1.1 — Start the Container¶

Open a terminal on your host and launch an interactive Ubuntu 22.04 container:

docker run --rm -it ubuntu:22.04 bash

You should see a root prompt such as root@<container-id>:/#. All subsequent commands in Parts 1–4 run inside this container.

Step 1.2 — Kernel Version Information¶

uname -r
uname -a
cat /proc/version

Expected output: The kernel version string (e.g., 6.x.x-generic) and a full build string including the GCC version used to compile the kernel.

Step 1.3 — Security Kernel Parameters¶

cat /proc/sys/kernel/randomize_va_space
cat /proc/sys/kernel/dmesg_restrict
cat /proc/sys/fs/protected_symlinks
cat /proc/sys/fs/protected_hardlinks

Expected output: 2, 1, 1, 1

📸 Screenshot checkpoint 01a — Capture the terminal showing all four kernel parameter values.

Step 1.4 — Explore /proc Structure¶

ls /proc | head -20
ls /proc/sys/kernel | head -15

Notice that numeric entries (e.g., 1, 7, 23) correspond to running process PIDs. The sys/ subtree exposes tuneable kernel parameters.

📸 Screenshot checkpoint 01b — Capture the /proc directory listing.

Part 2 — Process Inspection via /proc¶

Step 2.1 — Install procps and List Processes¶

apt-get update -qq && apt-get install -y -qq procps 2>/dev/null
ps aux
echo "My PID: $$"
echo "Parent PID: $PPID"

Step 2.2 — Inspect PID 1 via /proc¶

cat /proc/1/status | head -15
cat /proc/1/cmdline | tr '\0' ' ' && echo
ls -la /proc/1/fd
ls -la /proc/1/exe

Expected output:

• Name: bash — the process name
• Uid: 0 0 0 0 and Gid: 0 0 0 0 — running as root
• Three file descriptors: 0 (stdin), 1 (stdout), 2 (stderr)
• exe -> /bin/bash — the executable symlink

📸 Screenshot checkpoint 01c — Capture /proc/1/status output showing Name, Uid, and Gid fields.

Step 2.3 — Memory Map of the Current Process¶

cat /proc/$$/maps | head -10

Expected output format:

5f3b1000-5f3b2000 r-xp 00000000 fd:01 123456  /bin/bash
7f8a000000-7f8a021000 r--p 00000000 fd:01 789012  /usr/lib/x86_64-linux-gnu/libc.so.6

Column meanings:

📸 Screenshot checkpoint 01d — Capture the memory map with at least 5 lines visible, showing the permission columns.

Part 3 — Network Security Parameters¶

Step 3.1 — Read Network /proc Parameters¶

cat /proc/sys/net/ipv4/ip_forward
cat /proc/sys/net/ipv4/conf/all/accept_redirects
cat /proc/sys/net/ipv4/conf/all/send_redirects

Expected output: 0, 1, 1

📸 Screenshot checkpoint 01e — Capture all three network parameter values.

Step 3.2 — Modify a Kernel Parameter (Container-Safe)¶

cat /proc/sys/kernel/hostname
echo "lab-system" > /proc/sys/kernel/hostname
cat /proc/sys/kernel/hostname

Expected output: The hostname changes from the container ID to lab-system.

📸 Screenshot checkpoint 01f — Capture the before and after hostname values.

Part 4 — Container vs. Host Kernel Relationship¶

Step 4.1 — Observe Shared Kernel and cgroup Membership¶

cat /proc/version
uname -r
cat /proc/self/cgroup

Expected output: The kernel version shown inside the container is identical to the host kernel version. The cgroup file reveals the container's resource control group hierarchy.

📸 Screenshot checkpoint 01g — Capture /proc/version, uname -r, and the cgroup output together.

Cleanup¶

Exit the container and clean up Docker resources:

exit

docker system prune -f

Assessment¶

Screenshot Checklist¶

Submit all seven screenshots with your lab report. Label each file exactly as shown.

Kernel Parameter Analysis Table¶

Complete the following table in your lab report (20 points):

Reflection Questions¶

Answer each question in 3–5 sentences. Substantive, specific answers are required — vague answers receive no credit. (40 points — 10 points each)

Question 1

/proc/sys/kernel/randomize_va_space was set to 2 in your container. Describe what each of the three possible values (0, 1, 2) means in terms of which memory regions are randomized. Then explain specifically how full ASLR (value 2) makes a return-address-overwrite exploit harder compared to a system with ASLR disabled.

Question 2

You ran cat /proc/1/cmdline and found bash as PID 1 inside the container. On a normal Linux system (not a container), what process occupies PID 1, and what is its role? Why is this different inside a container, and what security implication arises from not having a proper init process managing child reaping?

Question 3

The output of cat /proc/version showed the same kernel version inside the container as on the host. Suppose a critical kernel privilege-escalation vulnerability (CVE) is disclosed that affects your host's kernel version. Does this vulnerability also affect all containers running on that host? Explain the technical reason why, referencing the relationship between container isolation and the kernel.

Question 4

You were able to write lab-system to /proc/sys/kernel/hostname as root inside the container. What does this demonstrate about the boundary between container-level root and the host kernel's namespace for this parameter? How does this relate to the principle of container isolation, and what does it imply about the security posture of running containers as root?

Grading Rubric¶