A few weeks ago, I wrote a blog on removing capabilities from a container. But what if you want to add capabilities?
While I recommend that people remove capabilities, in certain situations users need to add capabilities in order to get their container to run.
One example is when you have a app that needs a single capability, like an Network Time Protocol (NTP) daemon container that resets the system time on a machine. So if you wanted to run a container for an ntp daemon, you would need to do a --cap-add SYS_TIME
. Sadly, many users don't think this through, or understand what it means to add a capability.
The most dangerous capability: SYS_ADMIN
Whenever I present on container security I explain that the power of root was originally broken into 32 separate capabilities. These capabilities were originally fairly fine grained. But two things conspired to make some of them become very powerful.
- As number of available capability slots were used up, the cost of using up a new capability versus just assigning a permission check to an existing capability increased.
- Kernel developers being lazy and not wanting to go through the hassle of allocating a new capability began to say stuff like: "This permission check is an admin function, I have a capability called SYS_ADMIN, I will just use that."
This led the SYS_ADMIN
capability to need two pages of the capability man page just to list the features given to a process with the SYS_ADMIN
check.
The main feature that containers take advantage of when removing the ability for processes inside of the container to mount new file systems.
Recently I received an email from a co-worker showing me what they could do with the SYS_ADMIN
capability.
Talking about selinuxfs, there is also an quick exploit that allows disabling the host selinux from a container, although so far it needs CAP_SYS_ADMIN (to mount selinuxfs) and without --selinux-enabled (like in previous overlayfs) in docker.
# docker run -it --rm --cap-add SYS_ADMIN rhel7 bash [root@d2b1fb6bd57c /] mount -t selinuxfs none /mnt [root@d2b1fb6bd57c /] getenforce Enforcing [root@d2b1fb6bd57c /] setenforce 0 [root@d2b1fb6bd57c /] getenforce Permissive [root@d2b1fb6bd57c /] exit # getenforce Permissive
(And we all know that disabling SELinux this makes me cry.)
Use Sparingly!
Bottom line: giving a process SYS_ADMIN capability is pretty close to removing all isolation. As a rule, you shouldn't do this, but it's helpful to know that you can if you need to for some reason.
À propos de l'auteur
Joe Brockmeier is the editorial director of the Red Hat Blog. He also acts as Vice President of Marketing & Publicity for the Apache Software Foundation.
Brockmeier joined Red Hat in 2013 as part of the Open Source and Standards (OSAS) group, now the Open Source Program Office (OSPO). Prior to Red Hat, Brockmeier worked for Citrix on the Apache OpenStack project, and was the first OpenSUSE community manager for Novell between 2008-2010.
He also has an extensive history in the tech press and publishing, having been editor-in-chief of Linux Magazine, editorial director of Linux.com, and a contributor to LWN.net, ZDNet, UnixReview.com, and many others.
Contenu similaire
Parcourir par canal
Automatisation
Les dernières nouveautés en matière d'automatisation informatique pour les technologies, les équipes et les environnements
Intelligence artificielle
Actualité sur les plateformes qui permettent aux clients d'exécuter des charges de travail d'IA sur tout type d'environnement
Cloud hybride ouvert
Découvrez comment créer un avenir flexible grâce au cloud hybride
Sécurité
Les dernières actualités sur la façon dont nous réduisons les risques dans tous les environnements et technologies
Edge computing
Actualité sur les plateformes qui simplifient les opérations en périphérie
Infrastructure
Les dernières nouveautés sur la plateforme Linux d'entreprise leader au monde
Applications
À l’intérieur de nos solutions aux défis d’application les plus difficiles
Programmes originaux
Histoires passionnantes de créateurs et de leaders de technologies d'entreprise
Produits
- Red Hat Enterprise Linux
- Red Hat OpenShift
- Red Hat Ansible Automation Platform
- Services cloud
- Voir tous les produits
Outils
- Formation et certification
- Mon compte
- Assistance client
- Ressources développeurs
- Rechercher un partenaire
- Red Hat Ecosystem Catalog
- Calculateur de valeur Red Hat
- Documentation
Essayer, acheter et vendre
Communication
- Contacter le service commercial
- Contactez notre service clientèle
- Contacter le service de formation
- Réseaux sociaux
À propos de Red Hat
Premier éditeur mondial de solutions Open Source pour les entreprises, nous fournissons des technologies Linux, cloud, de conteneurs et Kubernetes. Nous proposons des solutions stables qui aident les entreprises à jongler avec les divers environnements et plateformes, du cœur du datacenter à la périphérie du réseau.
Sélectionner une langue
Red Hat legal and privacy links
- À propos de Red Hat
- Carrières
- Événements
- Bureaux
- Contacter Red Hat
- Lire le blog Red Hat
- Diversité, équité et inclusion
- Cool Stuff Store
- Red Hat Summit