19 ms·

Most containers.

by wavesquid 4y ago

Most containers.

infotogivenm 4y ago
Most containers are going to block unshare() via seccomp, no?
- raesene9 4y ago
  Therein lies an interesting detail. Docker does block unshare in default configurations, using its seccomp filter. However in Kubernetes, by default, Docker's seccomp filter is disabled. At the moment you need to re-enable it on a pod by pod basis. There is work to allow a default cluster-wide setting but that isn't at GA yet.
- dinosaurdynasty 4y ago
  Most containers run as root inside the container, which means they can access nftables in the container. One of many reasons running as root inside a container is a bad idea.
  - cpuguy83 4y ago
    Most containers would not have CAP_NET_ADMIN and not be able to access nftables.
    - lmns 4y ago
      My understanding is that containers actually can access nftables with CLONE_NEWUSER even without CAP_NET_ADMIN. EDIT: Apparently the Docker default capabilities don't allow CLONE_NEWUSER: https://opensource.com/business/15/3/docker-security-tuning https://opensource.com/business/15/3/docker-security-tuning
      - cpuguy83 4y ago
        Except the default seccomp policy is not used for Kubernetes containers. I didn't really think about this vector where you CLONE_NEWUSER in a container... definitely on systems that allow unprivileged users to do this it is a problem.
    - staticassertion 4y ago
      root@ee375d5150bc:/# pscap -a ppid pid name command capabilities 0 1 root bash chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap That's ubuntu.
  - worthless-trash 4y ago
    Who would have thought it ! Where are these admins who demand this configuration ?
  - viraptor 4y ago
    > Most containers run as root inside the container Is that actually surveyed / quantified somewhere? I can't say I see that too often in professional environments and even home stuff sees a lot of standardisation around separate users (https://docs.linuxserver.io/general/understanding-puid-and-pgid https://docs.linuxserver.io/general/understanding-puid-and-p...)

Most containers.

infotogivenm 4y ago

Most containers are going to block unshare() via seccomp, no?

raesene9 4y ago
Therein lies an interesting detail. Docker does block unshare in default configurations, using its seccomp filter. However in Kubernetes, by default, Docker's seccomp filter is disabled. At the moment you need to re-enable it on a pod by pod basis. There is work to allow a default cluster-wide setting but that isn't at GA yet.
dinosaurdynasty 4y ago
Most containers run as root inside the container, which means they can access nftables in the container. One of many reasons running as root inside a container is a bad idea.
- cpuguy83 4y ago
  Most containers would not have CAP_NET_ADMIN and not be able to access nftables.
  - lmns 4y ago
    My understanding is that containers actually can access nftables with CLONE_NEWUSER even without CAP_NET_ADMIN. EDIT: Apparently the Docker default capabilities don't allow CLONE_NEWUSER: https://opensource.com/business/15/3/docker-security-tuning https://opensource.com/business/15/3/docker-security-tuning
    - cpuguy83 4y ago
      Except the default seccomp policy is not used for Kubernetes containers. I didn't really think about this vector where you CLONE_NEWUSER in a container... definitely on systems that allow unprivileged users to do this it is a problem.
  - staticassertion 4y ago
    root@ee375d5150bc:/# pscap -a ppid pid name command capabilities 0 1 root bash chown, dac_override, fowner, fsetid, kill, setgid, setuid, setpcap, net_bind_service, net_raw, sys_chroot, mknod, audit_write, setfcap That's ubuntu.
- worthless-trash 4y ago
  Who would have thought it ! Where are these admins who demand this configuration ?
- viraptor 4y ago
  > Most containers run as root inside the container Is that actually surveyed / quantified somewhere? I can't say I see that too often in professional environments and even home stuff sees a lot of standardisation around separate users (https://docs.linuxserver.io/general/understanding-puid-and-pgid https://docs.linuxserver.io/general/understanding-puid-and-p...)