Evolving Container Security with Linux User Namespaces

Re:Evolving Container Security with Linux User Namespaces by jeffbee on Wednesday December 23, 2020 @04:17PM (#25522320)

"""For example, the PID namespace makes it so that a process can only see PIDs in its own namespace, and therefore cannot send kill signals to random processes on the host."""

Weird. You can't kill a process that's not running as your user, even if you can see it. That's not the point of PID namespacing, and I hate seeing non-existent security rationale backported to unrelated concepts.

[ Parent | on HN ]

Re:Evolving Container Security with Linux User Namespaces by chowyuncat on Wednesday December 23, 2020 @07:29PM (#25523929)

It’s an information leak. Who knows what attackers can learn about the host via this channel. Why leak it unless you have to?

[ Parent | on HN ]

Re:Evolving Container Security with Linux User Namespaces by jeffbee on Wednesday December 23, 2020 @08:13PM (#25524197)

OK, that's not a complexity trade I'd be willing to make, but I can see it. However, that's unrelated to the nonsensical reason given by the article.

[ Parent | on HN ]

Re:Evolving Container Security with Linux User Namespaces by cats4256 on Thursday December 24, 2020 @04:44AM (#25526211)

In traditional Docker installs, you (can) run as real UID 0 (and many containers do) with CAP_KILL [https://docs.docker.com/engine/reference/run/].

[ Parent | on HN ]