5 ms·
My understanding is that containers actually can access nftables with CLONE_NEWUSER even without CAP_NET_ADMIN. EDIT: Apparently the Docker default capabilitie
by lmns 4y ago
My understanding is that containers actually can access nftables with CLONE_NEWUSER even without CAP_NET_ADMIN.
EDIT: Apparently the Docker default capabilities don't allow CLONE_NEWUSER: https://opensource.com/business/15/3/docker-security-tuning https://opensource.com/business/15/3/docker-security-tuning
- cpuguy83 4y agoExcept the default seccomp policy is not used for Kubernetes containers. I didn't really think about this vector where you CLONE_NEWUSER in a container... definitely on systems that allow unprivileged users to do this it is a problem.