Codex just found a "workaround" of not having sudo on my PC
1–10 of 330 posts
Re: Codex just found a "workaround" of not having sudo on my PC
#2This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Re: Codex just found a "workaround" of not having sudo on my PC
#3This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Right, why is their login user in the docker group? Mine sure isn’t.
Re: Codex just found a "workaround" of not having sudo on my PC
#4This is why you need either a rootless container setup or user namespaces to remap the container user to irrelevant host users. https://docs.docker.com/engine/security/userns-remap/
Weak that this isn't the default.
Re: Codex just found a "workaround" of not having sudo on my PC
#5This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Right, why is their login user in the docker group? Mine sure isn’t.
Convenience. Want to run `docker run ...` without password, want IDEs and agents to be able to run containers...
Re: Codex just found a "workaround" of not having sudo on my PC
#6This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Right, why is their login user in the docker group? Mine sure isn’t.
Rather, why do people still run agents as their own user. IMO, agent sessions should at least be containerised with just necessary code mounted.
Re: Codex just found a "workaround" of not having sudo on my PC
#7Every time I try to install Docker there's a warning that being in the "docker" group is equivalent to having root access.
You should probably know about this workaround by now.
Re: Codex just found a "workaround" of not having sudo on my PC
#8this is the new GTD
Re: Codex just found a "workaround" of not having sudo on my PC
#9This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Right, why is their login user in the docker group? Mine sure isn’t.
Becuase a lot of devs don't know this stuff. There's a reason security engineers (as in SWEs who specialize in securing specific attack surfaces) remain in hot demand.
Re: Codex just found a "workaround" of not having sudo on my PC
#10This has been a known Docker "feature" since the beginning, nothing new here. This pattern is used to configure host machines by some tools.