4 ms·
There is a section in that link titled "Specific Attack Surface of the Docker Daemon". Meanwhile they are ignoring the attack surface of the Linux kernel. There
by kentonv 11y ago
There is a section in that link titled "Specific Attack Surface of the Docker Daemon". Meanwhile they are ignoring the attack surface of the Linux kernel. There is no mention of seccomp in the whole post.
People find privilege escalation bugs in the Linux kernel often enough that you can't really claim that running arbitrary native code is "secure" unless you're doing something to mitigate these. Things like:
http://www.openwall.com/lists/oss-security/2015/07/22/7 http://www.openwall.com/lists/oss-security/2015/07/22/7
Note that SELinux won't do anything about this kind of bug. You have to use seccomp and similar to disable large swaths of the Linux kernel API, particularly exotic parts that aren't well-tested or reviewed.
- throwaway2048 11y agothere is no mention of seccomp because virtually no software can utilize it.
- geofft 11y agoAs a Chrome, systemd, and Sandstorm user, I'm a little curious what you mean.
- kentonv 11y agoSandstorm.io (disclosure: my project) applies mandatory seccomp and other attack surface reduction yet manages to run a lot of apps with only minimal modification: https://docs.sandstorm.io/en/latest/developing/security-practices/#server-sandboxing https://docs.sandstorm.io/en/latest/developing/security-prac... Admittedly, though, "only minimal modification" is probably too much modification for Docker's goals. That's fair. But I don't think that gives them a pass to pretend the problem doesn't exist.
- rwmj 11y agoqemu uses seccomp. If you run your VMs with libvirt, then seccomp can be used to protect the host from qemu easily and routinely.
- simoncion 11y agoOpenSSH and BIND use seccomp. :)