3 ms·
If someone has enough privileges to access /proc/*/environ of another process (i.e. root or the same user or process or child process) then they should be easil
by marwis 3y ago
If someone has enough privileges to access /proc/*/environ of another process (i.e. root or the same user or process or child process) then they should be easily able to reach inside the container, no?
- lmm 3y agoOther processes running as the same user can be blocked from reading /var/run/secrets via the likes of SELinux/AppArmor whereas they can't be blocked from reading /proc/environ. It's a pretty fine distinction and I don't know how many people actually bother doing SELinux etc. in practice, but theoretically it's marginally better.
- marwis 3y agoAppArmor can restrict /proc, see example from docker: https://github.com/moby/moby/blob/master/contrib/apparmor/template.go#L41 https://github.com/moby/moby/blob/master/contrib/apparmor/te...