Re:CVE-2019-5736: runc container breakout
by peterwwillis on Monday February 11, 2019 @12:43PM
(#19136329)
For systems where you already enforce security policies, updating policy is faster than upgrading software, due to fewer build processes, quality control issues, and potential side-effects.
If you are using SELinux, verify your containers are running as container_t. If not, verify you are using user namespaces that don't map host root into the container user's namespace. These should mitigate the issue.
(as far as trust goes, just don't trust any local users. there's too many ways to privesc on Linux, and SELinux is the only thing that stops most of them)
Re:CVE-2019-5736: runc container breakout
by geofft on Monday February 11, 2019 @01:22PM
(#19136768)
I believe that if you're in an environment where users don't have (and can't gain) root inside the container, you're also fine, and if that's your theoretical policy, getting to the point where you 100% enforce that might also be easier than patching.
Re:CVE-2019-5736: runc container breakout
by justincormack on Monday February 11, 2019 @01:16PM
(#19136685)
We also released Docker 18.06.2 with the fix, as a lot of Kubernetes users are on this release.
Re:CVE-2019-5736: runc container breakout
by olemartinorg on Tuesday February 12, 2019 @08:31AM
(#19143267)
The new package in Ubuntu Trusty seems to be broken. Not that Trusty is supported for much longer. See https://github.com/docker/for-linux/issues/591
Please patch if you don't 100% trust all users on your host.