Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Podman rootless containers and the Copy Fail exploit

garrido.io

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Podman rootless containers and the Copy Fail exploit

#11

Post by adamsb6 »

e12e wrote: post #7
seba_dos1 wrote: post #5

Anyone who sees Copy Fail and chooses to focus on the way the example exploit happens to gain root is just showing how unimaginative they are. In the pre-container hype era, the sysadmin where I used to work gave us write access to nginx.conf on work machines to facilitate development. I used it in pair with an XSLT template to gain root access, so I could install things without having to go through the sysadmin - al…

Wait nginx ran as root?

Long ago in Linux if you wanted to listen on a privileged port (< 1024) you had to do so as root.

Re: Podman rootless containers and the Copy Fail exploit

#12

Post by Apes »

adamsb6 wrote: post #11
e12e wrote: post #7

Earlier quoted context omitted.

Wait nginx ran as root?

Long ago in Linux if you wanted to listen on a privileged port (< 1024) you had to do so as root.

If you're connecting to a host on a port < 1024, then you know a SysAdmin must have set it up, and it must be trustworthy. It was a simpler time.

Re: Podman rootless containers and the Copy Fail exploit

#14

Post by Apes »

wolttam wrote: post #13

I just don't trust the Linux kernel to effectively isolate processes anymore. Don't care if you're using user namespaces, seccomp, etc. There will be a bug. Time for Micro VMs, they're a stronger security boundary (not perfect, stronger)

You can't really do anything useful with a VM either unless you start punching holes in those boundaries.

Re: Podman rootless containers and the Copy Fail exploit

#15

Post by wolttam »

Apes wrote: post #14
wolttam wrote: post #13

I just don't trust the Linux kernel to effectively isolate processes anymore. Don't care if you're using user namespaces, seccomp, etc. There will be a bug. Time for Micro VMs, they're a stronger security boundary (not perfect, stronger)

You can't really do anything useful with a VM either unless you start punching holes in those boundaries.

I didn't say run in an air-gapped VM... Just as a means to better isolate the workloads I have running (some less trusted than others). Network connectivity and the associated vulnerabilities obviously remain.

Re: Podman rootless containers and the Copy Fail exploit

#16

Post by Apes »

wolttam wrote: post #15
Apes wrote: post #14

Earlier quoted context omitted.

You can't really do anything useful with a VM either unless you start punching holes in those boundaries.

I didn't say run in an air-gapped VM... Just as a means to better isolate the workloads I have running (some less trusted than others). Network connectivity and the associated vulnerabilities obviously remain.

No argument against VMs - just that they have a different risk profile and a different set of trade-offs than containers. They're not a silver bullet, but if they're working for you, then go for it.

Re: Podman rootless containers and the Copy Fail exploit

#17

Post by zackmorris »

Has anyone made a sandbox site running every type of container and presenting a shell where users can try to break out of any uncompromised ones remaining?

It's self-evident that we should only run containers that haven't been pwned yet.

I suspect that with all of the CVE-20XX exploits, Heartbleed, Meltdown, Rowhammer, Spectre, etc, that we're all living in a fantasy and there simply are no secure containers.

Re: Podman rootless containers and the Copy Fail exploit

#18

Post by m463 »

wolttam wrote: post #13

I just don't trust the Linux kernel to effectively isolate processes anymore. Don't care if you're using user namespaces, seccomp, etc. There will be a bug. Time for Micro VMs, they're a stronger security boundary (not perfect, stronger)

what about selinux?

Re: Podman rootless containers and the Copy Fail exploit

#19

Post by esseph »

Apes wrote: post #14
wolttam wrote: post #13

I just don't trust the Linux kernel to effectively isolate processes anymore. Don't care if you're using user namespaces, seccomp, etc. There will be a bug. Time for Micro VMs, they're a stronger security boundary (not perfect, stronger)

You can't really do anything useful with a VM either unless you start punching holes in those boundaries.

Exactly.

If your VM can't do anything, it's probably not very useful.

Doing things meaning reading / writing files, communicating between VMs, services, etc.

Post reply on HN