4 ms·

https://google.com/search?q=user+namespace+vulnerability https://google.com/search?q=user+namespace+vulnerability https://lwn.net/Articles/543273/ https://lwn.

https://google.com/search?q=user+namespace+vulnerability https://google.com/search?q=user+namespace+vulnerability https://lwn.net/Articles/543273/ https://lwn.net/Articles/543273/ https://utcc.utoronto.ca/~cks/space/blog/linux/UserNamespacesWhySecurityProblems https://utcc.utoronto.ca/~cks/space/blog/linux/UserNamespace...

raesene9 9y ago
Right so each of those are specific vulns. like all code gets, and not a systemic "linux containers aren't a security boundry" as suggested by the OP, which was the point I was asking for more info. on. All code has bugs, some of those are security bugs. There's a big difference between "if you haven't patched or I have a 0-day I can compromise you" and "no matter how well patched you are this isn't a security boundry so it can be bypassed" My reading of the top comment was it was suggesting the latter with regard to Linux containers, and I'm not sure that's true.
- openasocket 9y ago
  Yes, but certain things tend to wind up with more security bugs than others, due to attack surface and the like. For instance, you tend to see browser exploits, SSL exploits, and privilege escalation attacks a lot more often than OS-level exploits, or hypervisor vulnerabilities. It's not that Docker is a gaping security hole, it's just not something I trust as much as the Linux Kernel or Xen. I probably trust it about as much as I trust a well-updated web browser. It's suitable for everyday use, but I don't click the link on the phishing or spam email just to see what happens.
  - raesene9 9y ago
    oh sure, I'm not saying Docker provides perfect security. The point I didn't agree on was the top comment which basically, to me, seemed to be saying "Docker is not a security boundry" because that's not (in my experience) true. There are a load of companies running Multi-tenant systems using Linux containers, so if they're not a security boundry, a lot of people are going to be having a bad time :)

raesene9 9y ago

Right so each of those are specific vulns. like all code gets, and not a systemic "linux containers aren't a security boundry" as suggested by the OP, which was the point I was asking for more info. on. All code has bugs, some of those are security bugs. There's a big difference between "if you haven't patched or I have a 0-day I can compromise you" and "no matter how well patched you are this isn't a security boundry so it can be bypassed" My reading of the top comment was it was suggesting the latter with regard to Linux containers, and I'm not sure that's true.

openasocket 9y ago
Yes, but certain things tend to wind up with more security bugs than others, due to attack surface and the like. For instance, you tend to see browser exploits, SSL exploits, and privilege escalation attacks a lot more often than OS-level exploits, or hypervisor vulnerabilities. It's not that Docker is a gaping security hole, it's just not something I trust as much as the Linux Kernel or Xen. I probably trust it about as much as I trust a well-updated web browser. It's suitable for everyday use, but I don't click the link on the phishing or spam email just to see what happens.
- raesene9 9y ago
  oh sure, I'm not saying Docker provides perfect security. The point I didn't agree on was the top comment which basically, to me, seemed to be saying "Docker is not a security boundry" because that's not (in my experience) true. There are a load of companies running Multi-tenant systems using Linux containers, so if they're not a security boundry, a lot of people are going to be having a bad time :)