https://bugzilla.redhat.com/show_bug.cgi?id=1094188
Bug ID: 1094188
Summary: Docker access to /sys
Product: Fedora
Version: 19
Component: docker-io
Severity: urgent
Assignee: lsm5(a)redhat.com
Reporter: ldoktor(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, golang(a)lists.fedoraproject.org,
lsm5(a)redhat.com, mattdm(a)redhat.com,
mgoldman(a)redhat.com, s(a)shk.io, vbatts(a)redhat.com
Description of problem:
Docker gives access to host /sys. This is expected as some apps requires /sys
and one would expect it's protected (in --privileged=False). Well, is it?
After first round directly on HW (resulting in crashed X and lost of all work)
I switched to qemu vm:
My first game was echo disk > /sys/power/state. It fails with:
sh: write error: Operation not permitted
Than I tried the same in while loop:
...
PM: Cannot find swap device, try swapon -a
PM: Cannot get swap writer
PM: Cannot find swap device, try swapon -a
PM: Cannot get swap writer
PM: Cannot find swap device, try swapon -a
PM: Cannot get swap writer
...
Which significantly slowed the VM response. When I tried the same and connect
using ssh, it was almost unusable and after couple of seconds hanged the whole
VM (ctrl+alt+delete not working)
Version-Release number of selected component (if applicable):
qemu machine running F19:
docker-io-0.9.1-1.fc19.x86_64
kernel-3.12.8-200
How reproducible:
Always
Steps to Reproduce:
1. Just play with /sys
Actual results:
Most stuff works even in non-privileged mode
Expected results:
Docker should prevent hazardous interaction with the machine (suspend, cpu
settings, ...)
Additional info:
The docker-io-0.10 behaves even weirder, I'll fill separate bugzilla for it.
--
You are receiving this mail because:
You are on the CC list for the bug.