If you're supplying a container, and it needs privileged access to
function, then it should be able to bring everything that it needs along
with it.
What's the point of 'bundled stuff' otherwise?
It's easy to punt to the OS/Admin but we're trying to make it easier for
them instead of having them give up on the whole thing due to complexity.
On Mon, May 4, 2020 at 11:41 AM Shawn Wells <shawn(a)redhat.com> wrote:
On 5/4/20 11:35 AM, Matej Tyc wrote:
On 01. 05. 20 4:11, Shawn Wells wrote:
On 4/30/20 12:05 PM, Matej Tyc wrote:
I second to Jan - what I have heard from both of you, Gabe and Trevor, is
that we can expect legitimate use cases of containers with elevated
privileges that would e.g. influence the kernel by directly setting
modules, kernel parameters, time and so on.
From what I see, there is no automated way of how to tell whether a
scanned container is meant to be privileged (ntp container will need
privileges), or whether it is an omission or an attack attempt. Therefore,
I don't see how removing this machine platform could be an improvement. I
would expect specialized container profiles that Trevor has just mentioned
to come first. Disable of the machine platform denomination makes a
positive change only when those profiles are ready.
Fair enough. Is there interest to join the SCAP committees to create new
probes that can handle these scenarios?
Let's use the NTP example and let's do a thought experiment to see whether
extending SCAP can help:
Consider a system that runs containers, and those containers are supposed
not to be privileged except one, which is privileged, because of the NTP
service it's supposed to run. You don't want two containers that are
privileged and that run NTP, and let's say that in that particular case,
you don't want a container that inserts kernel modules.
No machine can read the admin's mind, and it's the admin who knows that
only container X is supposed to be privileged, and that only because of
NTP, otherwise all remaining containers should run without any privileges.
On another system, admin may need two containers for kernel modules, but
none for NTP, and so on.
Is there any other way how to satisfy everybody than to have a profile for
unprivileged containers, and specialized profiles for privileged
containers?
Is that actually a use case people care about?
If NTP is installed, then make sure it's configured. Not sure thinking
needs to go deeper than that.
Let the platform figure out who can run privileged containers. That's a
problem of Pivotal/Docker/OpenShift etc. Not a problem of the SCAP content
that makes sure the OS is configured.
_______________________________________________
scap-security-guide mailing list --
scap-security-guide(a)lists.fedorahosted.org
To unsubscribe send an email to
scap-security-guide-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --