5 ms·

If I understand correctly, rootfull podman with --userns=auto would also prevent the privilege escalation ?

• angry_octet 5mo ago
  No it wouldn't. The exploit is not impacted by namespaces.
• cpach 5mo ago
  How?
  • grimblee 5mo ago
    --userns=auto asign a different namespace for each container, so if you escape it you get a random uid far far away from root it also protects other containers from the compromise since they each have their own namespace and uid/gid range, the drawback though is that you can't mount shared volume unless you use a pod, since you would see files from outside your uid/gid range as owned by nobody and inaccessible.
    • cpach 5mo ago
      That might make Copy Fail harder to exploit, but I still wouldn’t bet money on CF being impossible to use in that scenario.
      • grimblee 5mo ago
        Since in --userns=auto, root inside the container gets assigned to the first uid of the uid range assigned by podman, copyfail would succeed but you'd get uid 647831 and be able to do nothing with it