Docker Bug Allows Root Access To Host File System (duo.com) 76
Trailrunner7 shares a report: All of the current versions of Docker have a vulnerability that can allow an attacker to get read-write access to any path on the host server. The weakness is the result of a race condition in the Docker software and while there's a fix in the works, it has not yet been integrated. The bug is the result of the way that the Docker software handles some symbolic links, which are files that have paths to other directories or files. Researcher Aleksa Sarai discovered that in some situations, an attacker can insert his own symlink into a path during a short time window between the time that the path has been resolved and the time it is operated on. This is a variant of the time of check to time of use (TOCTOU) problem, specifically with the "docker cp" command, which copies files to and from containers.
"The basic premise of this attack is that FollowSymlinkInScope suffers from a fairly fundamental TOCTOU attack. The purpose of FollowSymlinkInScope is to take a given path and safely resolve it as though the process was inside the container. After the full path has been resolved, the resolved path is passed around a bit and then operated on a bit later (in the case of 'docker cp' it is opened when creating the archive that is streamed to the client)," Sarai said in his advisory on the problem. "If an attacker can add a symlink component to the path after the resolution but beforeit is operated on, then you could end up resolving the symlink path component on the host as root. In the case of 'docker cp' this gives you read and write access to any path on the host."
"The basic premise of this attack is that FollowSymlinkInScope suffers from a fairly fundamental TOCTOU attack. The purpose of FollowSymlinkInScope is to take a given path and safely resolve it as though the process was inside the container. After the full path has been resolved, the resolved path is passed around a bit and then operated on a bit later (in the case of 'docker cp' it is opened when creating the archive that is streamed to the client)," Sarai said in his advisory on the problem. "If an attacker can add a symlink component to the path after the resolution but beforeit is operated on, then you could end up resolving the symlink path component on the host as root. In the case of 'docker cp' this gives you read and write access to any path on the host."
Re: (Score:2)
Host files literally don't work with Docker.
You have to do something like "links" or some other inanity :-/
Re: (Score:2)
So they should go to full communism, to make sure free market inflationary effects are no longer in play?
Perhaps it is not the ideology, but the implementation.
Re: (Score:2)
You seem to miss the point. My post wasn't a pro-socialist post. Just a note that we get too tied up in the labels of the economic systems, we pick and choose which implementations seem to work well for society and some don't because they called it a particular name, with a drastically different implementation.
Soviet Communism is different than Chinese Communism, American Capitalism is different than Bahrain Capitalism.
Normally it is the implementation and the governance is the overriding factor than jus
Re: (Score:2)
So they should go to full communism, to make sure free market inflationary effects are no longer in play?
Perhaps it is not the ideology, but the implementation.
Previous implementations of communism killed 160 million people. Should we keep trying again until we get it right? How many more millions of dead would convince you that there is no good implementation, if 160 million dead is not enough?
What makes you think that, even if it were done "right", it wouldn't be co-opted by the next Stalin or Mao killing their way to the top?
Working as designed (Score:1)
We've seen a similar problem with docker before. And that's because by design docker containers can reach out and control the host.
Moral of the story? Don't let idiot webmonkeys design systems software. Or virtualisation solutions. Or much of anything at all.
Re: (Score:2)
Where do you draw the line between a Webmonkey and a Enterprise Level Developer?
Besides have you used "Enterprise Level Software" in the past 30 years it is all pure crap. Buggy, Insecure, and the corporation needs to higher more Higher Paying Certified Professionals, then what you would need for a modest Software Development Team, who can make something better fitting for your organization.
Re: (Score:2)
This is painfully true.
Having worked in startups, the enterprise and modest sized companies that have been around for ages it's the latter that's always the highest quality with the greatest people.
Re: (Score:2)
Naw, Docker doesn't try to solve that problem, so nobody serious with a technical hat to wear is going to even lean that direction.
Docker solves the problem of operating system level software prerequisite management in a way that is portable across linux distributions.
Security is desirable, and so bugs like this will be considered important. And yet, for the most part this is not a problem; if you could get a shell on the server, the person in charge of that server must presume that you can escalate and get
Re: (Score:2)
You have seriously whooshed there. It is Docker itself that creates the problem.
Re: (Score:2)
And yet, I missed nothing. If you're wooshing, go ahead and woosh, but don't blame others for your problem.
Maybe you simply missed my point? It seems more likely that you missed my point than that I missed my point.
Oh no! (Score:1)
After all this time I still don't know what Docker does or what problem it solves.
Re: (Score:2)
Re: (Score:2)
> but it's harder, so people use virtualization inside of virtualization instead.
"docker. For when FTPing your PHP files is too démodé"
Re: Oh no! (Score:2)
Re:Oh no! (Score:4, Informative)
After all this time I still don't know what Docker does or what problem it solves.
You know how package dependency issues can be hard with applications, especially given the need to update those dependencies for security fixes, sometimes having to tweak your application to work with those new versions?
Docker lets you avoid those updates, so you can just deploy your app in a chroot that has copies of the old libraries with vulnerabilities. This way you never have to deal with security updates or application tweaks.
Security admins everywhere never sleep anymore.
Re: (Score:2)
Except that is mostly horseshit since the majority of Dockers benefits is that it has the latest and most secure libraries and software versions *first*, long before distribution maintainers pull their finger out and declare an update fit for release.
Re:Oh no! (Score:4, Insightful)
Dockers benefits is that it has the latest and most secure libraries and software versions *first*, long before distribution maintainers pull their finger out and declare an update fit for release.
Well, actually it only provides logitstics. It is a container publisher's prerogative on how they give you updates if you pull from docker hub. They also happen to almost always base from.. a distribution maintainer!
So let me review a handful of docker containers I pulled as of today...
Ok, first I have an application that used debian 9. They have not, however pulled any updates from debian since January.
Ok, second one.. I can't tell what they started from, but let me just spot check their openssl.. 1.0.2o... not exactly a spring chicken there...
Third one.. Alpine Linux 3.9.3.. Ok so it's only one month behind the distro, not bad, but still, not as up to date as the host system...
Fourth one.. Missing months of openssl updates, a centos 7 from about mid 2018.
Now getting to what I see built by developers inside the company, the developers who, upon starting out decry how "ancient" the distros on the servers are and are so relieved to have docker to run cutting edge.. So the hosting environment has moved to RHEL8 and is nice and current, and when I look at their docker image.. It's based on Ubuntu 15.10... Back in early 2016, the redhat 7 environment was just "too old" and we were just not responsive enough and were "too scared" of newer distributions. Now they live in mortal terror of touching this image. This image that they don't have a dockerfile for (they just sporadically edit an image life and docker commit). For the "mere mortal" developer, this is what I generally see, they want cutting edge only for the first month of their product's lifecycle, then they never want to risk changes to it ever again.
Re: (Score:2)
That's true when you first create the Docker image. Not so much 5 years later.
Imagine if you will (but best to wait until the sun is up and you're wekk rested), someone spun up a docker image in 2001, tweaked it to the nth degree, somehow kept the dependencies from exploding and got it just right. Too bad it's 2019 and they're still passing that image around...
Re: (Score:2)
Think VMWare style virtualization... only, instead of each VM being a full virtualized computer, each VM shares the host OS's single kernel. Instead of virtualizing the entire computer, you're essentially just virtualizing the user space while sharing the kernel space. In other words, its just a few tools bolted onto chroot.
Re: (Score:2)
I would reply with a horrified rant about how bad this comparison is... but VMWare is such an ugly hack doing the "world switch" inside the kernel that... yeah, it is just like that. The modern world is candy floss all the way down.
Re: (Score:2)
After all this time I still don't know what Docker does or what problem it solves.
That's because you have no desire to expand your knowledge on a topic.
Re: (Score:2)
In a nutshell? Tarballs with execution instructions in a chroot environment.
Re: (Score:3)
Re: (Score:2)
Docker is not a form of virtualization (on linux). It partitions the kernel.
What docker cp command does (Score:2)
I had to look it up, I don't use Docker.
Docker cp allows you to copy files between the docker instance and the host system.
https://docs.docker.com/engine... [docker.com]
virtualization Theo DeRaadt (Score:2)
"You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes."
Re: (Score:2)
Theo can be a polarizing figure, but he's as smart as they come. I once overheard a casual conversation he was having about translation lookaside buffers, and despite having over 25 years of highly-technical computer experience, the majority of his conversation was quite over my head. I felt like a kid listening to adults speak :)
Re: (Score:2)
Nothing us perfect, but VM hypervisors have had far fewer security bugs than OSs or applications. Containers, OTOH, are inseceure by their very nature. They don't promise much isolation to begin with, so it's hardly a surprise when flaws like this are found.
Re: (Score:2)
Containers, OTOH, are inseceure by their very nature.
When we start the Linux userspace (systemd, sysvinit, whatever), that userspace is running in a series of namespaces.
"Containers" are merely a new userspace in an additional set of namespaces. The mechanism is identical to the one used to boot systems the initial userspace.
If you can't trust your OS kernel, you're frakked, and hypervisors aren't going to save you.
Re: (Score:2)
Re: (Score:2)
“Bolted on” isn’t really what happened; it was more of an organ transplant than tacking something over the top. And of course it was done a piece st a time — the LKML doesn’t respond well to patch bombs. Eric Biederman’s initial goal was to be able to checkpoint (and migrate, and restart) long-running compute jobs running on a supercomputing cluster. I know because he sat kiddie corner to me while he did it, and he showed me the first containers to ever run on Linux. Cont
Re: (Score:2)
Don't trust anything. Privilege escalation exploits are common, hypervisor exploits very rare. Neither form of sharing is allowed for a variety of audit compliance needs, though internal (same company) sharing of hardware via VMs is often permitted.
Re: (Score:2)
I agree with the “don’t trust anything” model.
Daemon as non-root? (Score:2)
Can the docker daemon be run as a non-root user and if so, are there any limitations?
Re: (Score:2)
Exactly what I was thinking, I run qemu with its own dedicated user so it shouldn't be able write to the host file system as root. In the case, of qemu, running it as non-root doesn't cause any issues.
Disclaimer: qemu uses the kvm module which is loaded in the kernel. Maybe this could be an exploitable weakness although...
Wonder if this affects podman (Score:3)
Re: (Score:2)
This is the very first time I've ever heard of Podman. Thanks. Their marketing *sucks* :o
Re: (Score:2)
Do you think Docker is worse than Vagrant?
That's racist (Score:2, Funny)
The weakness is the result of a race condition in the Docker software...
So docker will be banned from twitter?
Won't work on a properly secure system (Score:1)