6 ms·

By the way, if anyone knows of a documented exploit for LXC, I would love to hear about it. People (generally advocating VMs, zones, jails, OpenVZ...) will ofte

By the way, if anyone knows of a documented exploit for LXC, I would love to hear about it. People (generally advocating VMs, zones, jails, OpenVZ...) will often say that "containers are not secure", but once you've taken some basic steps (like locking down kernel caps and device access) it becomes difficult to find an actual threat.

FooBarWidget 13y ago
Well, there's been a number of local root exploits in recent years. That's worrying.
foobarqux 13y ago
Is there a guide for these "basic steps" for the uninitiated?
contingencies 13y ago
I would love to hear about it See http://blog.zx2c4.com/749 http://blog.zx2c4.com/749 and http://bit.ly/T9CkqJ http://bit.ly/T9CkqJ
- ak217 13y ago
  Neither of these exploits works on stock Ubuntu 12.04 LTS, with LXC or otherwise (AppArmor kicks in). Like jpetazzo, I would love to see a working LXC exploit. In my case, "working" == "can get host root when given container root on Ubuntu 12.04 or later".
  - liuw 13y ago
    The fact is that by the time you know about the "working" exploit it's already been fixed. Unless you're security-related researchers / engineers you're not very likely to get hold of a 0-day exploit.
- jevinskie 13y ago
  Thank you so much for the first link! The very same "very black unix domain sockets magic" has been confounding me while reverse engineering a binary. OK, it calls recvmsg and then a wild FD appears from another process!? I had no idea...
deleted 13y ago
[deleted]
justincormack 13y ago
Any local root vulnerability will also work in a container, eg this one http://www.ubuntu.com/usn/usn-1914-1/ http://www.ubuntu.com/usn/usn-1914-1/ - note that a lot of kernel vulnerabilities are never really announced, just quietly fixed.
mjg59 13y ago
A variant on http://grsecurity.net/~spender/msr32.c http://grsecurity.net/~spender/msr32.c would have worked up until the capability check was added. Capabilities will help you, but if your business model is built on the assumption that the kernel performs capabilities checks everywhere it should then you really ought to be actively reviewing kernel entry points yourself.
liuw 13y ago
Do they count? http://lwn.net/Articles/543509/ http://lwn.net/Articles/543509/ http://lwn.net/Articles/543273/ http://lwn.net/Articles/543273/

FooBarWidget 13y ago

Well, there's been a number of local root exploits in recent years. That's worrying.

foobarqux 13y ago

Is there a guide for these "basic steps" for the uninitiated?

contingencies 13y ago

I would love to hear about it See http://blog.zx2c4.com/749 http://blog.zx2c4.com/749 and http://bit.ly/T9CkqJ http://bit.ly/T9CkqJ

ak217 13y ago
Neither of these exploits works on stock Ubuntu 12.04 LTS, with LXC or otherwise (AppArmor kicks in). Like jpetazzo, I would love to see a working LXC exploit. In my case, "working" == "can get host root when given container root on Ubuntu 12.04 or later".
- liuw 13y ago
  The fact is that by the time you know about the "working" exploit it's already been fixed. Unless you're security-related researchers / engineers you're not very likely to get hold of a 0-day exploit.
jevinskie 13y ago
Thank you so much for the first link! The very same "very black unix domain sockets magic" has been confounding me while reverse engineering a binary. OK, it calls recvmsg and then a wild FD appears from another process!? I had no idea...

deleted 13y ago

[deleted]

justincormack 13y ago

Any local root vulnerability will also work in a container, eg this one http://www.ubuntu.com/usn/usn-1914-1/ http://www.ubuntu.com/usn/usn-1914-1/ - note that a lot of kernel vulnerabilities are never really announced, just quietly fixed.

mjg59 13y ago

A variant on http://grsecurity.net/~spender/msr32.c http://grsecurity.net/~spender/msr32.c would have worked up until the capability check was added. Capabilities will help you, but if your business model is built on the assumption that the kernel performs capabilities checks everywhere it should then you really ought to be actively reviewing kernel entry points yourself.

liuw 13y ago

Do they count? http://lwn.net/Articles/543509/ http://lwn.net/Articles/543509/ http://lwn.net/Articles/543273/ http://lwn.net/Articles/543273/