11–20 of 102 posts
Yikes that's a big patch! Just on a meta-level, security vulnerabilities fixed with big patches are usually the least fun. Also, I would bet that freshly written C code has about 1 RCE bug every 100 LoC. This patch has 236 LoCs so probably about 2.36 RCE's.
It's a drop-in replacement for runc. With KataContainers it runs docker containers in a lightweight VM so you get all the security benefits of a VM. The downside is slightly slower container start up times and might not work in nested virtualized environments.
The best fix is to upgrade to 18.09.2. For those that can't do that immediately, backported versions of runc for Docker releases going back to 1.12.6 are available from Rancher at https://github.com/rancher/runc-cve . But please only do that as a temporary workaround until you can properly upgrade to 18.09.2. Please patch if you don't 100% trust all users on your host.
If you are using SELinux, verify your containers are running as container_t. If not, verify you are using user namespaces that don't map host root into the container user's namespace. These should mitigate the issue.
(as far as trust goes, just don't trust any local users. there's too many ways to privesc on Linux, and SELinux is the only thing that stops most of them)
Is this something that non-privileged containers mitigates? Curious what the big barriers are to this. I know they exist, but aren't used widely...I assume because some functionality doesn't work.
In my experience unprivileged containers work for most tasks, but there is breakage in some areas. Usually the issues are simple to resolve, like disabling OOM adjustments in systemd or changing the idmap range in winbind to be within the namespace allotment.
[1] https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb8...
Yikes that's a big patch! Just on a meta-level, security vulnerabilities fixed with big patches are usually the least fun. Also, I would bet that freshly written C code has about 1 RCE bug every 100 LoC. This patch has 236 LoCs so probably about 2.36 RCE's.
For better isolation check out KataContainers: https://github.com/kata-containers/runtime It's a drop-in replacement for runc. With KataContainers it runs docker containers in a lightweight VM so you get all the security benefits of a VM. The downside is slightly slower container start up times and might not work in nested virtualized environments.
Some more info: https://www.freebsd.org/doc/handbook/jails.html
And for quick start: https://github.com/iocage/iocage
For better isolation check out KataContainers: https://github.com/kata-containers/runtime It's a drop-in replacement for runc. With KataContainers it runs docker containers in a lightweight VM so you get all the security benefits of a VM. The downside is slightly slower container start up times and might not work in nested virtualized environments.
Alternative idea: throw away docker and katacontainers and move to freebsd, where jails were introduced on 14 Mar 2000 (no, seriously, superior technology exists for 19 years - stable, time proven, working). Some more info: https://www.freebsd.org/doc/handbook/jails.html And for quick start: https://github.com/iocage/iocage
If I have misunderstood jails and it's immune to kernel exploits please do correct me.
Yikes that's a big patch! Just on a meta-level, security vulnerabilities fixed with big patches are usually the least fun. Also, I would bet that freshly written C code has about 1 RCE bug every 100 LoC. This patch has 236 LoCs so probably about 2.36 RCE's.
By your guess each new Linux release would have about 5000 new RCEs. So that's 25000-30000 new RCEs over the last year alone.
https://events.linuxfoundation.org/wp-content/uploads/2017/1...
Edit: I missed the “RCE” context. Most of these are just privescs or memory disclosures.