CVE-2019-5736: runc container breakout

Re:CVE-2019-5736: runc container breakout by peterwwillis on Monday February 11, 2019 @12:43PM (#19136329)

For systems where you already enforce security policies, updating policy is faster than upgrading software, due to fewer build processes, quality control issues, and potential side-effects.

If you are using SELinux, verify your containers are running as container_t. If not, verify you are using user namespaces that don't map host root into the container user's namespace. These should mitigate the issue.

(as far as trust goes, just don't trust any local users. there's too many ways to privesc on Linux, and SELinux is the only thing that stops most of them)

[ Parent | on HN ]

Re:CVE-2019-5736: runc container breakout by geofft on Monday February 11, 2019 @01:22PM (#19136768)

I believe that if you're in an environment where users don't have (and can't gain) root inside the container, you're also fine, and if that's your theoretical policy, getting to the point where you 100% enforce that might also be easier than patching.

[ Parent | on HN ]