Docker - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Stop the Docker daemon.

sudo service docker stop

Create a file called daemon.json under the /etc/docker directory with the following content:

{
        "data-root": "<path to your Docker folder>"
  }

Copy the current data directory to the new one.

sudo rsync -aP /var/lib/docker/ <path to your Docker folder>

Rename the old docker directory.

sudo mv /var/lib/docker /var/lib/docker.bkp

After confirming that the change was successful, you can remove the backup file.

sudo rm -rf /var/lib/docker.bkp

Start the Docker daemon.

sudo service docker start

Go to CentOS Packages.

Find the latest version of container-selinux and copy the URL package.

Run the following command:

sudo yum install -y <copied container-selinux url

Install the latest version by running the following command (assuming the latest version is 2.74-1):

sudo yum install -y http://mirror.centos.org/centos/7/extras/x86_64/Packages/container-selinux-2.74-1.el7.noarch.rpm

Install Red Hat’s Docker package.

Run the following commands.

systemctl enable docker.service

systemctl restart docker.service

Change ownership of the Docker daemon socket so members of the dockerroot user group have access.

1. Edit or create the file /etc/docker/daemon.json.

2. Enable OS group dockerroot access to Docker by adding the following entry to the /etc/docker/daemon.json: "group": "dockerroot"file. For example:

   { "group": "dockerroot" }

3. Restart the Docker service by running the following command.

   systemctl restart docker.service

4. Engine Installation

5. After the engine is installed, run the following command to add the demisto os user to the dockerroot os group (Red Hat uses dockerroot group instead of docker).

   usermod -aG dockerroot demisto

6. Restart the engine.

Set the required SELinux permissions.

The Cortex Xpanse engine uses the /var/lib/demisto/temp directory (with subdirs) to copy files and receive files from running Docker containers. By default, when SELinux is in enforcing mode directories under /var/lib/ it cannot be accessed by docker containers.

1. To allow containers access to the /var/lib/demisto/temp directory, you need to set the correct SELinux policy type, by typing the following command.

   chcon -Rt svirt_sandbox_file_t /var/lib/demisto/temp

2. ( Optional) Verify that the directory has the container_file_t SELinux type attached by running the following command.

   ls -d -Z /var/lib/demisto/temp

3. Configure label confinement to allow Python and PowerShell containers to access other script folders.

   In the d1.conf file, set the following parameters:

   	Key	Value
   For Python containers	python.pass.extra.keys	--security-opt=label=level:s0:c100,c200
   For PowerShell containers	powershell.pass.extra.keys	--security-opt=label=level:s0:c100,c200

4. Open any incident and in the incident War Room CLI, run the /reset_containers command.

Sign up a free user in the Docker hub.

The pull limit is higher for a registered user (200 pulls per 6 hours).

Authenticate the user on the engine machine by running the following command.

sudo -u demisto docker login

(Optional) Instead of manually logging in to Docker to pull images, you can edit the Docker config file to use credentials from the file or from a credential store.

Edit the Engine Configuration File.

Add the following key:

"python.pass.extra.keys": "--memory=1g##--memory-swap=-1"

If you have the python.pass.extra.keys already set up with a value, add the vlaue after the ## separator.

Save the changes.

Restart the demisto service on the engine machine.

sudo systemctl start d1

(Ubuntu/DEB) sudo service d1 restart

Edit the Engine Configuration File.

Add the following keys.

"limit.docker.memory": true, "docker.memory.limit": "1g"

Save the changes.

Restart the demisto service on the engine machine.

sudo systemctl start d1

(Ubuntu/DEB) sudo service d1 restart

Go toIncident Response → Automation Scripts and create a New Script.

In the Script Name field, type Test Memory.

Add the following script:

from multiprocessing import Process
import os


def big_string(size):
    sys.stdin = os.fdopen(0, "r")
    s = 'a' * 1024
    while len(s) < size:
        s = s * 2
    print('completed creating string of length: {}'.format(len(s)))


size = 1 * 1024 * 1024 * 1024
p = Process(target=big_string, args=(size, ))
p.start()
p.join()
if p.exitcode != 0:
    return_error("Return code from sub process indicates failure: {}".format(p.exitcode))
else:
    print("Success allocating memory of size: {}".format(size))

From the SCRIPT SETTINGS dialog box, in the BASIC section, select the script to run on the Single engine and select the engine where you want to run the script.

Save the script.

To test the memory limit, type !TestMemory.

The command returns an error when it fails to allocate 1 GB of memory.

Edit the Engine Configuration File.

Add the following keys:

"limit.docker.cpu": true, "docker.cpu.limit": "<CPU Limit>" (For example, 1.0. Default is 1.0).

Save the changes.

Restart the demisto service on the engine machine.

sudo systemctl start d1

(Ubuntu/DEB) sudo service d1 restart

Edit the Engine Configuration File.

Add the following key:

"python.pass.extra.keys": "--pids-limit=256"

Save the changes.

Restart the demisto service on the engine machine.

sudo systemctl start d1

(Ubuntu/DEB) sudo service d1 restart

Edit the Engine Configuration File.

Type the following key.

"python.pass.extra.keys": "--ulimit=nofile=1024:8192"

Save the changes.

Restart the demisto service on the engine machine.

sudo systemctl start d1

(Ubuntu/DEB) sudo service d1 restart