Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker container breakout?

stealth.openwall.net

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Docker container breakout?

#41

Post by mje__ »

gtjay wrote: post #24
valarauca1 wrote: post #8

I believe it was Theo de Raadt who once said, "Why does everything think that when it comes to writing VM/container software suddenly people gain super human programming powers and no longer make the same mistakes they make writing operating systems?" (Slightly paraphrasing). While the issue is currently fixed in the .12 and 1.0 versions. I doubt Docker is still completely bullet proof.

This phrasing unfairly conflates VM/hypervisor technology and containers. Containers being a pure software technology do require near superhuman ability to secure but VM/hypervisors can lean on chip-level separation. People forget that in-chip memory protection didn't come about for security reasons, memory errors were a particularly dangerous and particularly common kind of bug and the hardware was extended to help…

Agreed. It's also a question of complexity. Xen (for example) has a significantly smaller attack surface than the linux kernel because it just has less stuff to do

Re: Docker container breakout?

#42

Post by mschulkind »

valarauca1 wrote: post #28
logicallee wrote: post #26

Earlier quoted context omitted.

Except the software running a tank.

I write software that runs on tanks, its not bullet proof. Most the communication protocols just use security though obscurity. If you tell a gear box to shift form 1st to snip it'll do it, and break everything. But when you considered air gap, and physical security surrounding it (12 inches of plate steal, 5 man team with guns, massive main gun), its pretty secure.

I'm thinking the joke is that, since the software runs inside the tank, which itself is bulletproof, the software is literally bulletproof since you can't shoot it with a bullet.

Re: Docker container breakout?

#43

Post by rwmj »

fleitz wrote: post #32
rwmj wrote: post #25

Earlier quoted context omitted.

Or real virtualization + SELinux + sVirt ... libvirt on RHEL/Fedora/CentOS puts the qemu process into a container too.

For security yes, however, for performance / resource requirements docker is going to beat libvirt/qemu.

Or for running anything other than Linux on the exact same kernel. Running Windows, for example, or older copies of Linux.

Re: Docker container breakout?

#44

Post by valarauca1 »

clhodapp wrote: post #38
valarauca1 wrote: post #28

Earlier quoted context omitted.

I write software that runs on tanks, its not bullet proof. Most the communication protocols just use security though obscurity. If you tell a gear box to shift form 1st to snip it'll do it, and break everything. But when you considered air gap, and physical security surrounding it (12 inches of plate steal, 5 man team with guns, massive main gun), its pretty secure.

I think it was a joke... You can fire bullets at the tank and the stuff inside is fine.

It is, but vehicles including tanks and other armored things use horribly insecure serial protocols for communication. Which is no joke :\

Re: Docker container breakout?

#45

Post by SwellJoe »

saosebastiao wrote: post #31
hapless wrote: post #21

Here is your annual reminder: Use SELinux. Nothing with a shared kernel is going to be very secure. That's just the nature of the beast. It's why Docker supports SELinux. It's why RHEL and CentOS ship with pre-written SELinux policy for common daemons. If you intend to have more than zero services on the system, you want SELinux.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

While I'm as suspicious of the NSA and their intentions as anyone (I am very actively involved in my local Restore the 4th and Cryptoparty chapters), the fact is that the code is Open Source, and has been vetted by some of the best, and most trustworthy, developers in the world (it has been in the mainline Linux kernel for over a decade).

I trust SELinux. I don't necessarily trust my understanding of SELinux...it is a complicated beast. But, I believe that when configured correctly, it is a very powerful tool.

As I understand it, SELinux covers more ground than AppArmor. I have low familiarity with AppArmor, however, so don't know enough to argue why one might choose one over the other. But, I don't have any suspicion of SELinux containing exploitable code inserted by the NSA.

Re: Docker container breakout?

#46

Post by zobzu »

saosebastiao wrote: post #31
hapless wrote: post #21

Here is your annual reminder: Use SELinux. Nothing with a shared kernel is going to be very secure. That's just the nature of the beast. It's why Docker supports SELinux. It's why RHEL and CentOS ship with pre-written SELinux policy for common daemons. If you intend to have more than zero services on the system, you want SELinux.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

For all its sins, SELinux code is actually pretty clear/simple. Its also nicer than AppArmor if you ask me, and it records inodes, not path, for labelling.

Re: Docker container breakout?

#47

Post by bcoates »

valarauca1 wrote: post #8

I believe it was Theo de Raadt who once said, "Why does everything think that when it comes to writing VM/container software suddenly people gain super human programming powers and no longer make the same mistakes they make writing operating systems?" (Slightly paraphrasing). While the issue is currently fixed in the .12 and 1.0 versions. I doubt Docker is still completely bullet proof.

All user mode code has been in OS-enforced, security-bounded, per-process VMs that access each other and hardware through virtualized interfaces since forever (well, since the 90s for mainstream microcomputer OSes).

"Containers" are just user-accessible support tooling to get creative with how those interfaces work. It really should be much easier to make container software than the entire virtualization infrastructure from scratch, in the same way that it's easier to write tar than a filesystem driver.

Re: Docker container breakout?

#49

Post by zobzu »

SwellJoe wrote: post #45
saosebastiao wrote: post #31

Earlier quoted context omitted.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

While I'm as suspicious of the NSA and their intentions as anyone (I am very actively involved in my local Restore the 4th and Cryptoparty chapters), the fact is that the code is Open Source, and has been vetted by some of the best, and most trustworthy, developers in the world (it has been in the mainline Linux kernel for over a decade). I trust SELinux. I don't necessarily trust my understanding of SELinux...it is…

the principles are really not that complicated really. I like this diagram of a similar implementation:

http://www.rsbac.org/_media/documentation/rsbac_handbook/arc...

Re: Docker container breakout?

#50

Post by zobzu »

zorked wrote: post #14
jhardcastle wrote: post #5

With a technology used in production in a lot of places, does responsible disclosure apply here? Did the author (OP?) notify Docker and/or the Linux kernel team before distributing this for public consumption?

While the author called the exploit "shocker" I don't think anybody is shocked by it. There are likely many other ways to break out of Docker. And while I assume the Docker (and kernel!) people are closing them as they come along, I don't think anyone is claiming Docker is unescapable so it's not a surprise if it is.

I think he might have been sarcastic
Post reply on HN