Escaping Docker container using waitid() – CVE-2017-5123

Re:Escaping Docker container using waitid() – CVE-2017-5123 by cpuguy83 on Friday December 29, 2017 @03:13PM (#16031689)

There are trade-offs to using userns and many ppl don't like the current set of trade-offs. In addition changing a default like this is a breaking change. Admins can enable userns by default in a daemon, but making it a hard-coded default is much more difficult.

It's not just a matter of enabling user ns. There is no support at the vfs layer for uid/gid mapping. This means in order to use it, images must be chowned with the remapped ID's. Per-container mappings are not supported for this reason (it would require copying and chowning the entire image for each container mapping).

Do you care to qualify your statement about CRI-O?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by ecnahc515 on Friday December 29, 2017 @05:47PM (#16032552)

I recall seeing some patches submitted to make it possible to pass an uid/gid offset to the mount syscall at one point when people were implementing usernamespaces for container runtimes like docker. So is this fixable without having to make every file system implement this feature, or is there something else holding back better support for doing uid shifting for use with user namespaces?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by cpuguy83 on Friday December 29, 2017 @05:52PM (#16032566)

That has not been accepted into the kernel. It's called "shiftfs", which basically let's you perform the uid/gid shift on mount.

[ Parent | on HN ]