Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Jun 2014 09:38:41 +0400
Subject: Re: docker VMM breakout

On 18-Jun-2014 10:05:35 -0400, Daniel J Walsh wrote:

 > CONTAINERS DO NOT CONTAIN. Root inside the container == Root
 > outside the container.

Really? :-)

 > This is true in both libvirt-sandbox/libvirt-lxc and docker.

Have you checked that for anything else?

 > We have a long way to go before we can run anything within a
 > container without this rule. User Namespace, SELinux or other
 > MAC are all required to get us near the point where Container
 > Contain.

Have you ever seen OpenVZ?

 > People who run services within a container should continue to
 > drop privs in the services and run them as UID!=0

Look at this trivial code example...

Classic kernel:

if (!uid)
	// perform privileged operation here

Containers-enabled kernel:

if ( !uid && !container_id )	// container_id: 0 for host
	// perform privileged operation here

How would you bypass this check to get privileged access to anything
outside the container?

Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.