3 ms·
> to specifically want to allow escaping Not really unfortunately. A novice sysadmin granting someone's request to add some permission called SYS_MODULE may no
by cyrnel 3y ago
> to specifically want to allow escaping
Not really unfortunately. A novice sysadmin granting someone's request to add some permission called SYS_MODULE may not know that it could be equivalent to full root access. That's why posts like this are important for education.
- Karellen 3y ago> A novice sysadmin granting someone's request to [give them root in an obscure, sneaky manner] ...is a social engineering exploit, not a technical one.
- achierius 3y agoTo pose an alternative scenario: > A novice sysadmin granting someone's request to [be able to run some tool/software that says it needs this, but is in fact secretly malicious] or perhaps more common > A novice sysadmin granting someone's request to [be able to run some legitimate tool or software, then later a virus in the container taking advantage and breaking out] for a real world example, the Nvidia Nsight docs specifically direct you to add SYS_ADMIN; do you think your everyday ML engineer would know that doing so poses a security risk if they're doing this on Docker?