5 ms·
the real problem is not that. this is nothing but a way to DROP privilege! the problem is that containers require tons of hacks on the network side to just-wor
by 1oooqooq 3y ago
the real problem is not that. this is nothing but a way to DROP privilege!
the problem is that containers require tons of hacks on the network side to just-work. and docker main selling point is all the usafe hacks it does for it.
so obviously, any container solution will adopt these hacks eventually, and there is the problem.
you end up with a perfectly sane namespace functionality that removes access, but then the kernel opens the gate because network hacks are good
- GoblinSlayer 3y agoAIU the cause is Netfilter API that doesn't sanitize its input, because only root can call it, so there is no need to sanitize. Then unprivileged user namespaces open all root API to unprivileged user, so nonsanitizing Netfilter API became available to unprivileged user.
- 1oooqooq 3y agothat's my point. why from a point users didn't have access to netfiltet now gives users access to netfilter? from a command which should be adding more restraint no less. also people focus on this only being a problem now with priv escalation... but all that was always a problem before unprivileged containers... by allowing container code to exploit host kernel code, but nobody called it a privilege escalation then because you started your container as root. sigh.