Escaping Docker container using waitid() – CVE-2017-5123

Re:Escaping Docker container using waitid() – CVE-2017-5123 by andbberger on Friday December 29, 2017 @03:52PM (#16031903)

Maybe because it breaks things?

I just enabled user namespaces after reading this post. Broke Jenkins and there doesn't appear to be an easy solution. I mount the docker socket in the Jenkins container, which is not an option with user namespaces as the user Jenkins now runs as does not have permission to access the socket.

It seems to be possible to provide this user access to the socket through a socket proxy, but since all containers use the same user this seems to defeat the purpose of using namespaces in the first place.

Cherry on top: although `docker run` supports running containers with custom userns settings, docker swarm, which I use to run Jenkins, does not.

So as far as I can tell my only options are:

1. Go back to not using user namespaces 2. Make the docker daemon on the host available over HTTP, which is really something I was trying to avoid...

Anyone have a more elegant solution?

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by zenlikethat on Friday December 29, 2017 @05:42PM (#16032530)

Mm, if you're bind mounting in the Docker socket, enabling user namespaces won't help much. You just have to deal with the fact that you have a privileged container (Docker API access == root, at least unless you're using authz). It'd be nice if we could see more RBAC around Docker API so you could do things like "grant only permission to run this one container".

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by andbberger on Friday December 29, 2017 @05:58PM (#16032597)

Totally. But the vast majority of containers I use do not get a bind mount to the Docker socket... for which user namespaces would be a very nice feature.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by zenlikethat on Friday December 29, 2017 @06:02PM (#16032616)

Yeah, definitely turn it on where possible, just important to realize that it's not a panacea (some people really hyped it up to be before the feature was released and criticized Docker for not having it at all). As always, gotta try and find the right sweet spot between convenience and attack surface.

[ Parent | on HN ]

Re:Escaping Docker container using waitid() – CVE-2017-5123 by nassyweazy on Saturday December 30, 2017 @09:53AM (#16035456)

disclaimer: I'm a member of Docker Security team

We're working on a solution that would please most people for docker containers and services called the Docker Entitlements: https://github.com/moby/libentitlement

These Entitlements are high-level privileges for containers and services that could be baked in images, same way as macOS/iOS apps. These permissions would allow to create custom {seccomp+capabilities+namespaces+apparmor+...} profiles (effectively security profiles) for a better granularity in app sandbox configuration by app developers and ops.

The current POC has `docker run`, `docker service create` and even build mechanism working. The integration is actively being worked on and PRs are being prepared.

The issue you mentioned is already opened here: https://github.com/moby/libentitlement/issues/44

Feel free to have a look at it and open issues/participate or reach out through Github as I'm the lead and would love to discuss use-cases :)

[ Parent | on HN ]