<story><title>Docker: insecure opening of file-descriptor allows privilege escalation</title><url>https://bugzilla.redhat.com/show_bug.cgi?id=1409531</url></story><parent_chain></parent_chain><comment><author>cyphar</author><text>I discovered the vulnerability, and I&amp;#x27;m not entirely sure that Trevor Jay fully understands the issue (though to be fair, the easiest way of exploiting it is using ptrace(2) which is blocked by most default security policies). You don&amp;#x27;t need to use ptrace(2) or CAP_SYS_PTRACE to exploit the vulnerability.&lt;p&gt;You just need to have proc_fd_access_allowed(). I&amp;#x27;ve not checked if ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS) calls into SELinux hooks (it probably does, and if it doesn&amp;#x27;t then resolving further files probably does too) but neither seccomp profiles (unless you&amp;#x27;re blocking open(2)) nor blocking CAP_SYS_PTRACE can help you here.&lt;p&gt;Now, the LXC exploit used ptrace in order to stop the process from closing its file descriptors. I&amp;#x27;m not sure how you would reliably hit the race in this issue (something with SIGSTOP presumably?).&lt;p&gt;In any case, SUSE&amp;#x27;s update has additional fixes which also fix the issue even when you give a container CAP_SYS_PTRACE (the released patch does _not_ protect containers that have CAP_SYS_PTRACE enabled). The patches will be merged upstream ASAP, but Docker didn&amp;#x27;t want them in the patchset sent to its customers (preferring instead to update their vendored runC once they are merged upstream).</text></comment>
<story><title>Docker: insecure opening of file-descriptor allows privilege escalation</title><url>https://bugzilla.redhat.com/show_bug.cgi?id=1409531</url></story><parent_chain></parent_chain><comment><author>geofft</author><text>Oh good, yet another vulnerability from the model of retroactively changing the execution environment of a process after it&amp;#x27;s been created. We had a thread about setuid binaries a week ago, which is the most common case of this design: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=13312722&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=13312722&lt;/a&gt;&lt;p&gt;We would all be better off if we designed systems such that some helper process, already running with the right environment &amp;#x2F; config &amp;#x2F; privileges, spawns the process for you and proxies input&amp;#x2F;output to your terminal.&lt;p&gt;And (as I mentioned in the other thread) this helper process could be literally sshd. Instead of having sudo, ssh root@localhost. No weird process trees with confusing things like effective UIDs. Instead of having runc exec, ssh root@container. No file descriptors get passed that aren&amp;#x27;t explicitly forwarded over the SSH connection.&lt;p&gt;Patching sshd to run over UNIX sockets without encryption and to use getpeername() for authentication is left as an exercise to the reader.</text></comment>