3 ms·
For those that won't open the link :) Update by Trevor Jay: "This is an extremely difficult to exploit flaw on standard RHEL and Fedora systems. I checked th
by gtirloni 10y ago
For those that won't open the link :)
Update by Trevor Jay:
"This is an extremely difficult to exploit flaw on standard RHEL and Fedora systems.
I checked the 1.10.3 and 1.12.5 builds on Brew. Both drop the `CAP_SYS_PTRACE` capability by default. 1.10.3 blacklists `ptrace` calls under the default seccomp profile. Thus, this flaw only comes into play for containers that already have elevated privileges.
Even if `ptrace` is available. The proposed exploit scenario of quickly attaching to a process joining the container space and using its file descriptors is not possible under the default SELinux configuration. The containerized PID 1 will have a type of `container_t` or similar SELinux type and thus will be blocked by standard type enforcement from accessing accessing any resources that haven't already been made available to containerized processes."
- peterwwillis 10y agoFor anyone who is annoyed by SElinux enough to drop it, which is most people, and anyone who would ever like to ptrace a process, which is most people, or anyone who doesn't use distros like these with these default protections for container processes, it's still viable.
- zokier 10y agoGotta love modern computing and defense in depth. Sometimes it actually really helps despite feeling like a hassle at times.
- lotyrin 10y agoEvery once in a while I'll say something along the lines of "Wouldn't it be nice if there was <describes SELinux>" or "wouldn't it be nice if you could <describes using strace>" etc. and get enthusiastic nods, disbelief or "if only" and have to break it to someone that they don't know what the hell they're doing and they simply overlooked a huge feature of their production platform.