Escaping privileged containers for fun
pwning.systems
Escaping privileged containers for fun
1–10 of 42 posts
Re: Escaping privileged containers for fun
#2I use AppArmour and use Podman rootless for everything that needs to be containerized so it's all good for me anyway :)
Fun read! Maybe put an RSS button somewhere so it's easier to subscribe to?
Re: Escaping privileged containers for fun
#3I use AppArmour and use Podman rootless for everything that needs to be containerized so it's all good for me anyway :) Fun read! Maybe put an RSS button somewhere so it's easier to subscribe to?
Thanks very good suggestion! I'll take a look if Hugo has a feature for that otherwise I 'll edit the templates :D
Re: Escaping privileged containers for fun
#4Containers are not a security mechanism.
Containers are not a security mechanism.
Containers are not a security mechanism.
...
Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
Re: Escaping privileged containers for fun
#5Containers are not a security mechanism. Containers are not a security mechanism. Containers are not a security mechanism. ... Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
How about virtual machines?
Re: Escaping privileged containers for fun
#6Containers are not a security mechanism. Containers are not a security mechanism. Containers are not a security mechanism. ... Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
There are _some_ containers that are security mechanism.
Docker is definitely not one of them. But LXD for example uses unprivileged containers by default and can be hardened with additional software for syscall filtering
Re: Escaping privileged containers for fun
#7Containers are not a security mechanism. Containers are not a security mechanism. Containers are not a security mechanism. ... Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
There are _some_ containers that are security mechanism. Docker is definitely not one of them. But LXD for example uses unprivileged containers by default and can be hardened with additional software for syscall filtering
If LXD also uses cgroups and Linux namespaces it seems like the differences would be pretty small? Docker also allows custom syscall filtering, unprivileged containers, etc.
I think the reality is just that containers will always be imperfect, and you should understand that risk when building systems.
Re: Escaping privileged containers for fun
#8Containers are not a security mechanism. Containers are not a security mechanism. Containers are not a security mechanism. ... Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
There are _some_ containers that are security mechanism. Docker is definitely not one of them. But LXD for example uses unprivileged containers by default and can be hardened with additional software for syscall filtering
> uses unprivileged containers by default and can be hardened with additional software for syscall filtering
You also described docker.
I agree that docker's main focus isn't to be a security oriented sandbox, but perhaps you need to find a different wording of what exactly makes LXD (or others) so different.
Re: Escaping privileged containers for fun
#9Containers are not a security mechanism. Containers are not a security mechanism. Containers are not a security mechanism. ... Every engineer making a foray into Docker or any similar tech for the first time should be made to write this line x1000 before proceeding.
Containers are a security mechanism. We can say that now. For a long time they weren't, and then it wasn't really clear, but at this point they are. How good are they? Questionable - there are footguns (running privileged) and they rely on the Linux kernel (garbage), but they are a barrier.
If you put a process into a container, even a fairly default config'd container, it will require an additional vulnerability for an attacker to escape that container. That makes it a security boundary, period. There is no universal "ask to leave the container" by default.
This post is attacking a non-default configuration ie: you have to explicitly pass in "--privileged". Don't do that (the post says this repeatedly).
The fact that people are using docker and we're basically getting a half decent sandbox for free, everywhere, is an incredible security win.
I wouldn't rely on them for multi-tenant workloads, but as a nice way to restrict attackers given RCE, yeah, sure.
Re: Escaping privileged containers for fun
#10Earlier quoted context omitted.
There are _some_ containers that are security mechanism. Docker is definitely not one of them. But LXD for example uses unprivileged containers by default and can be hardened with additional software for syscall filtering
If LXD also uses cgroups and Linux namespaces it seems like the differences would be pretty small? Docker also allows custom syscall filtering, unprivileged containers, etc. I think the reality is just that containers will always be imperfect, and you should understand that risk when building systems.
I was under the understanding that docker didn't use user namespaces by default -- so "root" in the container is the same user as "root" outside the container -- but that LXD does. Has that changed?