19 ms·

This post is incorrect. SELinux does not fully mitigate this issue. We recommend users update to 1.12.6. I expect Red Hat to issue a retraction shortly. We not

by bigmac 10y ago

This post is incorrect. SELinux does not fully mitigate this issue. We recommend users update to 1.12.6. I expect Red Hat to issue a retraction shortly. We notified them last night that this post was incorrect. Source: Security at Docker.

saycheese 10y ago
>> "Source: Security at Docker" In case it is not obvious, the comment above is by Nathan McCauley, who is the Director of Security for Docker. Source: https://news.ycombinator.com/user?id=bigmac https://news.ycombinator.com/user?id=bigmac
- philtar 10y ago
  I don't care if Jesus, the director of security in heaven said that. I'm going to take a look at both arguments and decide for myself. No need to name drop.
  - therein 10y ago
    Who filled in for the position of Director of Security between 0 and ~32AD?
  - ben0x539 10y ago
    The name (or title) drop might effect appropriate urgency, seems legit. Edit: Don't downvote people trying to help me improve my english. :(
    - MrF3ynmann 10y ago
      affect
      - dzamo_norton 10y ago
        effect
      - isbadawi 10y ago
        Effect is correct here.
      - chowells 10y ago
        Because the other comment didn't spell it out: effect is correct there. Effect as a verb means something like "to cause to happen". Don't pretend effect/affect is just a noun/verb split. Both words have meanings as both verbs and nouns. It's best to just learn both meanings of each instead of following some rule that's wrong a fair amount of time.
        tyre 10y ago
        Mary Norris, copy editor at the New Yorker, has a wonderful short video on this: http://www.newyorker.com/culture/culture-desk/comma-queen-affect-vs-effect http://www.newyorker.com/culture/culture-desk/comma-queen-af...
        monktastic1 10y ago
        I don't care if Jesus, director of grammar in heaven said this.... Just kidding.
      - hogrammer 10y ago
        @dang -- please remove this parent comment. It's wrong.
    - tedmiston 10y ago
      Your usage is actually correct. Which is great, considering many native English speakers get this one wrong. The heuristic we hear in school is something like "use 'affect' as a verb and 'effect' as a noun," which like many grammar heuristics is of course an oversimplification of reality. Usage of effect as a verb isn't super common in general conversation by native English speakers whereas I think most might choose to say something like "establish authority" instead in this case, but still your intention is still clear.
  - geofft 10y ago
    I have no information here, but it's certainly possible that both sides are not willing to publicly disclose the full extent of the vulnerability. I think that's less wise than usual given what Red Hat is writing and how disputed it is, but that's probably their standard practice. Some of the comments from Red Hat previously implied that they thought the vulnerability could only be exploited via ptrace, which SELinux denied by default for Docker containers. That's definitely not true; ptrace was used in the PoC because it's easy and likely to win the race condition, but you can also grab file descriptors out of /proc/$pid/fd. However, the blog post appears to show SELinux stopping attacks that don't involve ptrace, because SELinux forbids writing to an open file or an open network socket that has the wrong context. If Docker believes there are attack vectors that aren't covered by the default SELinux policies (such as writing to something that's not a regular file or network socket), they might be unwilling to disclose that too loudly until Red Hat gets around to saying "Uh, actually please patch".
  - hoorayimhelping 10y ago
    >No need to name drop. Give it a rest. This is a semi-anonymous forum where people's identities aren't tied to their usernames. This isn't name dropping, it's providing helpful context.
  - threeseed 10y ago
    What on earth is wrong with you ? This is a security incident. It's relevant and vital to know the background of people who are making statements like this. And sorry but not everyone is a kernel engineer who can navigate the truth between RedHat and Docker.
- jwildeboer 10y ago
  Why not simply state that when posting? Bad style IMHO.
  - runesoerensen 10y ago
    He stated the source, and information about his Docker affiliation is readily available. HN guidelines discourage signing comments: Please don't sign comments; they're already signed with your username. If other users want to learn more about you, they can click on it to see your profile.
    - saycheese 10y ago
      There's a huge difference between having a generic signature for every comment you post and disclosing an affiliation that adds validity to the claims made in the comment.
      - greenrd 10y ago
        It doesn't say "don't sign all your comments", it simply says "don't sign comments". Also, it should be interpreted in the light of the fact that modern netiquette on other sites like Stack Overflow which have usernames is to never sign your posts.
        gbraad 10y ago
        Here it is to disclose affiliation, which else people would forget to check due to nature of 'battle'. Also, there is an assumption that the signature contains up to date information and/or does not change over time. The latter situation would else impact historical purpose. The signature has changed and does not refer to the position/information related to the moment of writing. I agree with how both jwildeboer (Jan) and shykes (Solomon) approached this. Much appreciated in this case. But yes, in a normal situation, this is irrelevant and the username signature is sufficient.
      - runesoerensen 10y ago
        I don't know that there is a huge difference between those two. What I do know is that in this case there was no difference of any significance. The comment was signed with his username, and his Docker affiliation was disclosed under said username. That was all that was needed to add validity to the claims in the comment. All HN comments have that "generic signature". All HN users are free to disclose information about themselves on their profile, and all HN readers are free to click usernames to learn more about the the people who comment on HN. It really is that simple.
jwildeboer 10y ago
AFAICS Red Hat explicitly mentions that updates are available and the benefits of having SELinux in no way means you shouldn't update. Disclaimer: I work at Red Hat
- runesoerensen 10y ago
  > the benefits of having SELinux in no way means you shouldn't update Where is this explicitly mentioned in the post? I got the opposite impression reading this story titled "Docker 0-Day Stopped Cold by SELinux", with the closing statement "When we heard about this vulnerability we were glad to see that our customers were safe". I'm sure your customers are glad to hear that as well, but it sounds like the Docker folks have reason to believe SELinux doesn't fully mitigate this vulnerability.
  - jwildeboer 10y ago
    When a 0day hits, you first assess the impact, define your solution and start to work. FTA "Fixed packages have been prepared and shipped for RHEL as well as Fedora and Centos." So updates were made, tested and made available. Our customers typically implement these security related updates very fast. with that out of the way, the article explains how SELinux can mitigate this and similar issues. And I am 100% sure that we coordinated the update and changes with Docker because that's how Open Source works.
    - runesoerensen 10y ago
      > When a 0day hits, you first assess the impact, define your solution and start to work. That sounds like a sensible approach and very much related to why I raised concerns about the original title and closing statement earlier. Someone could easily have assessed that there was zero impact (based on the first revision* of your marketing material) if SELinux was enabled and, consequently, find no need to "define a solution and start to work" - why would you update when your OS vendor explicitly says you're safe? It would have been extremely easy to recommend your customers to install the updated packages, but you didn't do that initially - despite from such a recommendation being quite standard, and despite being notified by the people who found and fixed this vulnerability warning that customers should still update. Instead you seem to have used this as an marketing opportunity at the expense of your own customers' security. As it turns out, SELinux did in fact not fully mitigate the issue (by Red Hat's own admission in the updated blog post and CVE). --- * I'm referring to the first revision because the post and CVE have since been updated several times (as pointed out elsewhere in this discussion). A recap of some of the changes that are relevant to this exchange and the phrasing I mentioned earlier: 1. The title "Docker 0-Day Stopped Cold by SELinux" has been renamed to "SELinux Mitigates container Vulnerability" -- accurately reflecting the fact that it was not: a) a Docker (it was runc) b) 0-Day (patches were released for runc afaik) c) Stopped Cold (it was mitigated but still leaking information) 2. The closing statement "When we heard about this vulnerability we were glad to see that our customers were safe" has been changed to the slightly more long-winded, less catchy (but fortunately also less misleading): "When we heard about this vulnerability we were glad to see that our customers were safer if running containers with setenforce 1. Even with SELinux in enforcement, select information could be leaked, so it is recommended that users patch to fully remediate the issue." 3. The sentence you referred to "Fixed packages have been prepared and shipped for RHEL as well as Fedora and Centos." has been changed to "Fixed packages are being prepared and shipped for RHEL as well as Fedora and CentOS.". Honestly haven't looked into whether the packages were actually released at the time this post was published (?), but I'll assume Red Hat didn't change the wording here for no reason - there's quite a difference between updates that "are being prepared" rather than "have been prepared".
otterley 10y ago
Can you please take some time here to explain why their post was incorrect, with a brief technical explanation of why SELinux enforcement failed to stop the attack that exploits the particular vulnerability? I realize you're busy, but it would be much more helpful than a curt statement that simply claims they are wrong.
- bigmac 10y ago
  We're working with Red Hat now. Folks can expect more technical details when everyone is on the same page. That said, the solution is the same as with every other piece of software -- update to latest to get security fixes.
- krakensden 10y ago
  Especially given Docker Inc.'s history of counterproductive Red Hat hostility.
  - andrewguenther 10y ago
    This shouldn't be downvoted. Docker has been very openly history towards Red Hat in the past. To the point of openly mocking their developers at DockerCon.
    - m-p-3 10y ago
      Very openly history?
      - nanodeath 10y ago
        Guessing "hostile" was intended.
      - JadeNB 10y ago
        > Very openly history? Given krakensden's posting (https://news.ycombinator.com/item?id=13399853 https://news.ycombinator.com/item?id=13399853): > Especially given Docker Inc.'s history of counterproductive Red Hat hostility. I think that it is clear that andrewguenther meant 'hostile' instead of 'history' in (https://news.ycombinator.com/item?id=13400383 https://news.ycombinator.com/item?id=13400383): > Docker has been very openly history towards Red Hat in the past. Let he who has never typed a passing thought rather than the word he meant cast the first stone.
cyphar 10y ago
Do you have a PoC? Even if you don't, please add the information to the security@opencontainers.org thread. I'm guessing that it would involve overwriting program code before the SELinux policy is set by runC?

by bigmac 10y ago

saycheese 10y ago

>> "Source: Security at Docker" In case it is not obvious, the comment above is by Nathan McCauley, who is the Director of Security for Docker. Source: https://news.ycombinator.com/user?id=bigmac https://news.ycombinator.com/user?id=bigmac

philtar 10y ago
I don't care if Jesus, the director of security in heaven said that. I'm going to take a look at both arguments and decide for myself. No need to name drop.
- therein 10y ago
  Who filled in for the position of Director of Security between 0 and ~32AD?
- ben0x539 10y ago
  The name (or title) drop might effect appropriate urgency, seems legit. Edit: Don't downvote people trying to help me improve my english. :(
  - MrF3ynmann 10y ago
    affect
    - dzamo_norton 10y ago
      effect
    - isbadawi 10y ago
      Effect is correct here.
    - chowells 10y ago
      Because the other comment didn't spell it out: effect is correct there. Effect as a verb means something like "to cause to happen". Don't pretend effect/affect is just a noun/verb split. Both words have meanings as both verbs and nouns. It's best to just learn both meanings of each instead of following some rule that's wrong a fair amount of time.
      - tyre 10y ago
        Mary Norris, copy editor at the New Yorker, has a wonderful short video on this: http://www.newyorker.com/culture/culture-desk/comma-queen-affect-vs-effect http://www.newyorker.com/culture/culture-desk/comma-queen-af...
        monktastic1 10y ago
        I don't care if Jesus, director of grammar in heaven said this.... Just kidding.
    - hogrammer 10y ago
      @dang -- please remove this parent comment. It's wrong.
  - tedmiston 10y ago
    Your usage is actually correct. Which is great, considering many native English speakers get this one wrong. The heuristic we hear in school is something like "use 'affect' as a verb and 'effect' as a noun," which like many grammar heuristics is of course an oversimplification of reality. Usage of effect as a verb isn't super common in general conversation by native English speakers whereas I think most might choose to say something like "establish authority" instead in this case, but still your intention is still clear.
- geofft 10y ago
  I have no information here, but it's certainly possible that both sides are not willing to publicly disclose the full extent of the vulnerability. I think that's less wise than usual given what Red Hat is writing and how disputed it is, but that's probably their standard practice. Some of the comments from Red Hat previously implied that they thought the vulnerability could only be exploited via ptrace, which SELinux denied by default for Docker containers. That's definitely not true; ptrace was used in the PoC because it's easy and likely to win the race condition, but you can also grab file descriptors out of /proc/$pid/fd. However, the blog post appears to show SELinux stopping attacks that don't involve ptrace, because SELinux forbids writing to an open file or an open network socket that has the wrong context. If Docker believes there are attack vectors that aren't covered by the default SELinux policies (such as writing to something that's not a regular file or network socket), they might be unwilling to disclose that too loudly until Red Hat gets around to saying "Uh, actually please patch".
- hoorayimhelping 10y ago
  >No need to name drop. Give it a rest. This is a semi-anonymous forum where people's identities aren't tied to their usernames. This isn't name dropping, it's providing helpful context.
- threeseed 10y ago
  What on earth is wrong with you ? This is a security incident. It's relevant and vital to know the background of people who are making statements like this. And sorry but not everyone is a kernel engineer who can navigate the truth between RedHat and Docker.
jwildeboer 10y ago
Why not simply state that when posting? Bad style IMHO.
- runesoerensen 10y ago
  He stated the source, and information about his Docker affiliation is readily available. HN guidelines discourage signing comments: Please don't sign comments; they're already signed with your username. If other users want to learn more about you, they can click on it to see your profile.
  - saycheese 10y ago
    There's a huge difference between having a generic signature for every comment you post and disclosing an affiliation that adds validity to the claims made in the comment.
    - greenrd 10y ago
      It doesn't say "don't sign all your comments", it simply says "don't sign comments". Also, it should be interpreted in the light of the fact that modern netiquette on other sites like Stack Overflow which have usernames is to never sign your posts.
      - gbraad 10y ago
        Here it is to disclose affiliation, which else people would forget to check due to nature of 'battle'. Also, there is an assumption that the signature contains up to date information and/or does not change over time. The latter situation would else impact historical purpose. The signature has changed and does not refer to the position/information related to the moment of writing. I agree with how both jwildeboer (Jan) and shykes (Solomon) approached this. Much appreciated in this case. But yes, in a normal situation, this is irrelevant and the username signature is sufficient.
    - runesoerensen 10y ago
      I don't know that there is a huge difference between those two. What I do know is that in this case there was no difference of any significance. The comment was signed with his username, and his Docker affiliation was disclosed under said username. That was all that was needed to add validity to the claims in the comment. All HN comments have that "generic signature". All HN users are free to disclose information about themselves on their profile, and all HN readers are free to click usernames to learn more about the the people who comment on HN. It really is that simple.

jwildeboer 10y ago

AFAICS Red Hat explicitly mentions that updates are available and the benefits of having SELinux in no way means you shouldn't update. Disclaimer: I work at Red Hat

runesoerensen 10y ago
> the benefits of having SELinux in no way means you shouldn't update Where is this explicitly mentioned in the post? I got the opposite impression reading this story titled "Docker 0-Day Stopped Cold by SELinux", with the closing statement "When we heard about this vulnerability we were glad to see that our customers were safe". I'm sure your customers are glad to hear that as well, but it sounds like the Docker folks have reason to believe SELinux doesn't fully mitigate this vulnerability.
- jwildeboer 10y ago
  When a 0day hits, you first assess the impact, define your solution and start to work. FTA "Fixed packages have been prepared and shipped for RHEL as well as Fedora and Centos." So updates were made, tested and made available. Our customers typically implement these security related updates very fast. with that out of the way, the article explains how SELinux can mitigate this and similar issues. And I am 100% sure that we coordinated the update and changes with Docker because that's how Open Source works.
  - runesoerensen 10y ago
    > When a 0day hits, you first assess the impact, define your solution and start to work. That sounds like a sensible approach and very much related to why I raised concerns about the original title and closing statement earlier. Someone could easily have assessed that there was zero impact (based on the first revision* of your marketing material) if SELinux was enabled and, consequently, find no need to "define a solution and start to work" - why would you update when your OS vendor explicitly says you're safe? It would have been extremely easy to recommend your customers to install the updated packages, but you didn't do that initially - despite from such a recommendation being quite standard, and despite being notified by the people who found and fixed this vulnerability warning that customers should still update. Instead you seem to have used this as an marketing opportunity at the expense of your own customers' security. As it turns out, SELinux did in fact not fully mitigate the issue (by Red Hat's own admission in the updated blog post and CVE). --- * I'm referring to the first revision because the post and CVE have since been updated several times (as pointed out elsewhere in this discussion). A recap of some of the changes that are relevant to this exchange and the phrasing I mentioned earlier: 1. The title "Docker 0-Day Stopped Cold by SELinux" has been renamed to "SELinux Mitigates container Vulnerability" -- accurately reflecting the fact that it was not: a) a Docker (it was runc) b) 0-Day (patches were released for runc afaik) c) Stopped Cold (it was mitigated but still leaking information) 2. The closing statement "When we heard about this vulnerability we were glad to see that our customers were safe" has been changed to the slightly more long-winded, less catchy (but fortunately also less misleading): "When we heard about this vulnerability we were glad to see that our customers were safer if running containers with setenforce 1. Even with SELinux in enforcement, select information could be leaked, so it is recommended that users patch to fully remediate the issue." 3. The sentence you referred to "Fixed packages have been prepared and shipped for RHEL as well as Fedora and Centos." has been changed to "Fixed packages are being prepared and shipped for RHEL as well as Fedora and CentOS.". Honestly haven't looked into whether the packages were actually released at the time this post was published (?), but I'll assume Red Hat didn't change the wording here for no reason - there's quite a difference between updates that "are being prepared" rather than "have been prepared".

otterley 10y ago

Can you please take some time here to explain why their post was incorrect, with a brief technical explanation of why SELinux enforcement failed to stop the attack that exploits the particular vulnerability? I realize you're busy, but it would be much more helpful than a curt statement that simply claims they are wrong.

bigmac 10y ago
We're working with Red Hat now. Folks can expect more technical details when everyone is on the same page. That said, the solution is the same as with every other piece of software -- update to latest to get security fixes.
krakensden 10y ago
Especially given Docker Inc.'s history of counterproductive Red Hat hostility.
- andrewguenther 10y ago
  This shouldn't be downvoted. Docker has been very openly history towards Red Hat in the past. To the point of openly mocking their developers at DockerCon.
  - m-p-3 10y ago
    Very openly history?
    - nanodeath 10y ago
      Guessing "hostile" was intended.
    - JadeNB 10y ago
      > Very openly history? Given krakensden's posting (https://news.ycombinator.com/item?id=13399853 https://news.ycombinator.com/item?id=13399853): > Especially given Docker Inc.'s history of counterproductive Red Hat hostility. I think that it is clear that andrewguenther meant 'hostile' instead of 'history' in (https://news.ycombinator.com/item?id=13400383 https://news.ycombinator.com/item?id=13400383): > Docker has been very openly history towards Red Hat in the past. Let he who has never typed a passing thought rather than the word he meant cast the first stone.

cyphar 10y ago

Do you have a PoC? Even if you don't, please add the information to the security@opencontainers.org thread. I'm guessing that it would involve overwriting program code before the SELinux policy is set by runC?