Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker container breakout?

stealth.openwall.net

Post reply on HN
Print view View original

61–70 of 91 posts

Re: Docker container breakout?

#61

Post by mrweasel »

mje__ wrote: post #41
gtjay wrote: post #24

Earlier quoted context omitted.

This phrasing unfairly conflates VM/hypervisor technology and containers. Containers being a pure software technology do require near superhuman ability to secure but VM/hypervisors can lean on chip-level separation. People forget that in-chip memory protection didn't come about for security reasons, memory errors were a particularly dangerous and particularly common kind of bug and the hardware was extended to help…

Agreed. It's also a question of complexity. Xen (for example) has a significantly smaller attack surface than the linux kernel because it just has less stuff to do

That hasn't stopped Xen from having bugs that have allow an attacker to escape the domU and gain access to dom0 and the hardware.

The key really is: "Don't rely on visualization for security".

Re: Docker container breakout?

#62

Post by contingencies »

eugeneionesco wrote: post #20
jrockway wrote: post #19

> "The tea from the 90's kicks your sekurity again. If you have pending sec consulting, I'll happily forward to my friends who drink secury-tea too!" Uh, what?

stealth is a legend of the '90s http://en.wikipedia.org/wiki/TESO

Never really got talking but they sent me some friendly warez when I released an ARP-based remote OS detection script in like 1999. As I recall they were all Germanic. Doubt there's any 'reach out' from groups today, too much profit/loss going on...

Re: Docker container breakout?

#63

Post by contingencies »

peterwwillis wrote: post #27

Linux capabilities are not a good security model in general. They're more suitable for sysadmins who want to do the very basic locking down of system resources to prevent users from fucking things up, or preventing programs from doing basic accidental mistakes. A MAC or RBAC implementation is a lot more robust and actually fulfills the qualifications for things like secret/top secret computing systems.

grsec + containers is nicer.

Re: Docker container breakout?

#64

Post by hapless »

saosebastiao wrote: post #31
hapless wrote: post #21

Here is your annual reminder: Use SELinux. Nothing with a shared kernel is going to be very secure. That's just the nature of the beast. It's why Docker supports SELinux. It's why RHEL and CentOS ship with pre-written SELinux policy for common daemons. If you intend to have more than zero services on the system, you want SELinux.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

SELinux is supported by the principal Linux vendor, Red Hat. As a result, on RHEL/CentOS systems, there's tons of high-quality policy pre-written for any daemon you could want to install.

Instead of writing thousands of lines of policy from scratch, even a very complex system configuration might require a one-liner tweak to the Red Hat-provided policy.

Re: Docker container breakout?

#65

Post by al2o3cr »

clhodapp wrote: post #38
valarauca1 wrote: post #28

Earlier quoted context omitted.

I write software that runs on tanks, its not bullet proof. Most the communication protocols just use security though obscurity. If you tell a gear box to shift form 1st to snip it'll do it, and break everything. But when you considered air gap, and physical security surrounding it (12 inches of plate steal, 5 man team with guns, massive main gun), its pretty secure.

I think it was a joke... You can fire bullets at the tank and the stuff inside is fine.

Only for suitably small values of "bullet". :)

Re: Docker container breakout?

#66

Post by fabiokung »

shykes wrote: post #12

Hi all, I'm a maintainer of Docker. As others already indicated this doesn't work on 1.0. But it could have . Please remember that at this time, we don't claim Docker out-of-the-box is suitable for containing untrusted programs with root privileges. So if you're thinking "pfew, good thing we upgraded to 1.0 or we were toast", you need to change your underlying configuration now. Add apparmor or selinux containment, m…

Great response.

"..., or ideally don't grant root access to the application."

+1

Re: Docker container breakout?

#67

Post by peterwwillis »

contingencies wrote: post #63
peterwwillis wrote: post #27

Linux capabilities are not a good security model in general. They're more suitable for sysadmins who want to do the very basic locking down of system resources to prevent users from fucking things up, or preventing programs from doing basic accidental mistakes. A MAC or RBAC implementation is a lot more robust and actually fulfills the qualifications for things like secret/top secret computing systems.

grsec + containers is nicer.

From what I recall, grsec's rbac doesn't give you the same flexibility as selinux's mac. You have to pick and choose whether you want advanced heuristics to prevent different kinds of attack, or just get really fine-grained with your system control. I prefer grsec personally, but only because i'm lazy, and it's more than likely not certified for top secret systems.

Re: Docker container breakout?

#68

Post by mpyne »

nickstinemates wrote: post #35
saosebastiao wrote: post #31

Earlier quoted context omitted.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

Isn't it for the NSA, but by Red Hat? May have my history mixed up.

NSA developed it and open-sourced it (much like their development of the crypto hash used for git), but Red Hat and the Linux kernel devs have pushed it the most since.

Re: Docker container breakout?

#69

Post by mpyne »

valarauca1 wrote: post #28
logicallee wrote: post #26

Earlier quoted context omitted.

Except the software running a tank.

I write software that runs on tanks, its not bullet proof. Most the communication protocols just use security though obscurity. If you tell a gear box to shift form 1st to snip it'll do it, and break everything. But when you considered air gap, and physical security surrounding it (12 inches of plate steal, 5 man team with guns, massive main gun), its pretty secure.

I've used important software for submarines. OPSEC limits what I can say, but let's just say I wasn't very impressed.

Re: Docker container breakout?

#70

Post by bostik »

saosebastiao wrote: post #31
hapless wrote: post #21

Here is your annual reminder: Use SELinux. Nothing with a shared kernel is going to be very secure. That's just the nature of the beast. It's why Docker supports SELinux. It's why RHEL and CentOS ship with pre-written SELinux policy for common daemons. If you intend to have more than zero services on the system, you want SELinux.

I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

NSA creation or not, SELinux is at its core really little more than a strict state/transition machine. It has also been vetted pretty well over the years.

The syntax for the transition rules on the other hand looks like someone disgorged C-struct assignments on paper and left them there. So while SELinux (the system) is quite easily understood, the rules used to build SELinux systems are frightening, large, and from first appearance, very, very complex.

(disclosure: I had the privilege of going through SELinux a few years ago when Nokia considered using it as part of their Maemo platform security. The engineering effort was eventually deemed too large and the benefit too little, so it was skipped as infeasible. Less than two years later, Google announced that they would be taking on the task with their SE-Android project.)

Post reply on HN