Hello Matthew,
Here's an example in on of my containers:
root@nasty:~# ps ax
PID TTY STAT TIME COMMAND
1 ? Ss 0:13 init [3]
44 ? Ss 0:02 /usr/sbin/syslogd
141 ? Ss 0:00 /usr/sbin/sshd
144 ? S 0:01 /usr/sbin/crond -l6
149 ? Ss 0:25 /usr/sbin/httpd -k start
2215 ? S 0:14 /usr/sbin/httpd -k start
7820 ? S 0:36 /usr/sbin/httpd -k start
8663 ? S 0:00 /usr/sbin/httpd -k start
10159 ? Ss 0:00 sshd: root@pts/18
10161 pts/18 Ss 0:00 -bash
10175 pts/18 R+ 0:00 ps ax
26928 ? S 0:05 /usr/sbin/httpd -k start
26936 ? S 0:05 /usr/sbin/httpd -k start
26937 ? S 0:05 /usr/sbin/httpd -k start
26938 ? S 0:05 /usr/sbin/httpd -k start
26939 ? S 0:05 /usr/sbin/httpd -k start
28054 ? S 1:41 /usr/sbin/httpd -k start
29670 ? S 0:15 /usr/sbin/httpd -k start
root@nasty:~# whoami
root
root@nasty:~# mount -t sysfs sysfs /sys
mount: block device sysfs is write-protected, mounting read-only
mount: cannot mount block device sysfs read-only
root@nasty:~# touch /test
root@nasty:~# rm /test
root@nasty:~# cat /sys/kernel/uevent_helper
root@nasty:~# echo "test" > /sys/kernel/uevent_helper
-bash: /sys/kernel/uevent_helper: Permission denied
Here's capabilities dropped on the container:
lxc.cap.drop = sys_module mknod
lxc.cap.drop = mac_override kill sys_time
lxc.cap.drop = setfcap setpcap sys_boot
Furthermore system has SMACK enabled - Simplified Mandatory Access Control -
a label based MAC.
Each LXC container has its files and processes labeled differently - Labels
which can't write the host system default label, so basically a root in a
container can't make anything harmfull on the host system.
Same can be achieved _less easily_ with Selinux - Look at IBM papers.
Hope this helps,
Olivier
On Sun, Jul 31, 2011 at 3:10 AM, Matthew Franz <mdfr...@gmail.com> wrote:
> Had seen some previous discussions before, but are there any ways to
> mitigate this design vulnerability?
>
> http://blog.bofh.it/debian/id_413
>
> Are there any workarounds?
>
> Thanks,
>
> - mdf
>
> --
> --
> Matthew Franz
> mdfr...@gmail.com
>
>
> ------------------------------------------------------------------------------
> Got Input? Slashdot Needs You.
> Take our quick survey online. Come on, we don't ask for help often.
> Plus, you'll get a chance to win $100 to spend on ThinkGeek.
> http://p.sf.net/sfu/slashdot-survey
> _______________________________________________
> Lxc-users mailing list
> Lxc-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/lxc-users
>
------------------------------------------------------------------------------
Got Input? Slashdot Needs You.
Take our quick survey online. Come on, we don't ask for help often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek.
http://p.sf.net/sfu/slashdot-survey
_______________________________________________
Lxc-users mailing list
Lxc-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users
