[
https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16408602#comment-16408602
]
Eric Yang commented on YARN-7221:
---------------------------------
Summary of possible combination of sudo vs privileged image vs multi users:
| |Single User Privileged Image|Multi User (ENTRY_POINT) Privileged
Image|Single User Unprivileged Image|Multi User (ENTRY_POINT) Unprivileged
Image|
|Sudo Available Privileged Flag Set|ROOT|ROOT|Jailed Self|Jailed Root|
|Sudo Available Privileged Flag unset|Self|Self|Jailed Self|Jailed Self|
|Sudo Not Available Privileged Flag Set|Fail|Fail|Fail|Fail|
|Sudo Not Available Privileged Flag Unset|Self|Self|Jailed Self|Jailed Self|
When sudo not available, and someone would like to run a multi-user image.
i.e. QA asking for a mutli-users container to run systemd.
We have a choice to run as jailed root or fail the image. The consensus is to
fail the privileged container request. We will enable the QA multi-users usage
through usage of profile to prevent overloading of privileged:true flag. I
will update the patch to fail the container launch.
> Add security check for privileged docker container
> --------------------------------------------------
>
> Key: YARN-7221
> URL: https://issues.apache.org/jira/browse/YARN-7221
> Project: Hadoop YARN
> Issue Type: Sub-task
> Components: security
> Affects Versions: 3.0.0, 3.1.0
> Reporter: Eric Yang
> Assignee: Eric Yang
> Priority: Major
> Attachments: YARN-7221.001.patch, YARN-7221.002.patch,
> YARN-7221.003.patch, YARN-7221.004.patch, YARN-7221.005.patch,
> YARN-7221.006.patch, YARN-7221.007.patch, YARN-7221.008.patch
>
>
> When a docker is running with privileges, majority of the use case is to have
> some program running with root then drop privileges to another user. i.e.
> httpd to start with privileged and bind to port 80, then drop privileges to
> www user.
> # We should add security check for submitting users, to verify they have
> "sudo" access to run privileged container.
> # We should remove --user=uid:gid for privileged containers.
>
> Docker can be launched with --privileged=true, and --user=uid:gid flag. With
> this parameter combinations, user will not have access to become root user.
> All docker exec command will be drop to uid:gid user to run instead of
> granting privileges. User can gain root privileges if container file system
> contains files that give user extra power, but this type of image is
> considered as dangerous. Non-privileged user can launch container with
> special bits to acquire same level of root power. Hence, we lose control of
> which image should be run with --privileges, and who have sudo rights to use
> privileged container images. As the result, we should check for sudo access
> then decide to parameterize --privileged=true OR --user=uid:gid. This will
> avoid leading developer down the wrong path.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
