In this lesson, you will learn how to apply specialized Mandatory Access Control (MAC) policies to secure the ephemeral execution environments of serverless functions.
The Challenge of Ephemeral Environments
Serverless functions operate on the principle of extreme ephemerality: they spin up, perform a specific task, and vanish. Because these environments often share a host kernel with other functions or system processes, a standard "all-access" policy is dangerous. If a function is compromised, an attacker could attempt to traverse the filesystem or execute arbitrary binaries.
To harden these, we apply specialized MAC profiles (such as AppArmor or SELinux) that are tailored specifically to the function's narrow requirements. Unlike standard applications, serverless functions rarely need shell access, network socket creation, or write access to anything outside of /tmp.
Applying Targeted MAC Policies
When we define a profile for a serverless execution context, we use a "deny-by-default" approach. By locking down the process to only the necessary read-only access for its runtime and specific library paths, we minimize the blast radius of a potential injection attack.
For example, an AppArmor profile for a Python-based serverless function might look like this:
profile serverless-func-01 flags=(attach_disconnected, complain) {
# Deny all by default
deny /** w,
# Allow read access to runtime
/usr/bin/python3.10 mr,
/var/task/** r,
# Limit write access to ephemeral storage only
/tmp/** rw,
# Restrict network access to egress only
deny network,
}
By binding this profile to the container or sandbox namespace before the function triggers, the kernel enforces these restrictions at the hardware and syscall level. Because serverless functions are immutable, you can pre-compile these MAC policies during your build phase, ensuring that the security posture is as ephemeral as the function itself. This creates a "tight-fit" container that prevents any drift from the intended execution logic, effectively neutralizing common techniques like lateral movement or persistent file drops.
Key Takeaway: Hardening serverless functions requires applying strict, read-only MAC profiles that restrict syscalls and filesystem access to the absolute minimum required for the function's logic to execute.