3 ms·
The container process has still full access to /dev, /sys, all capabilities of root, and the ability to insmod.
by vocram 6y ago
The container process has still full access to /dev, /sys, all capabilities of root, and the ability to insmod.
- mehrdadn 6y agoI didn't notice that, thanks! Although I imagine they can't do much with /dev etc. unless they get sudo.
- cyphar 6y agoUnless you're using user namespaces (which this doesn't) then root inside a container is equal to root outside the container. You don't even need access to /dev, because the container process could just mknod(2) any device and access it with full permissions. This is only possible in this example because the container has the full capability set (including CAP_MKNOD) and the devices cgroup hasn't been configured to restrict device access. Real container runtimes always restrict device creation by default, and usually don't allow CAP_MKNOD by default.
- mehrdadn 6y agoThanks!