Linux: is the machine running fedora or just the user

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Linux: is the machine running fedora or just the user

«‹›1108 »

BlankSystemDaemon: Mar 13, 2009

my homie dhall posted:

are you .,.. actually sshing to the container? as in it is running ssh?

if you live in a normal world you exec into the container either from the host it�s running on or preferably remotely using kubectl

This is exactly what you want to avoid if you're using jails or containers for isolating, since attaching a process inside a jail or container means that an attacher could modify the binary you're attaching to.
Interestingly enough, this has been a theoratical attack for decades (which is why jexec is discouraged on FreeBSD, in favour of ssh), but this is no longer the case.

# ? Apr 11, 2022 10:36

Adbot: ADBOT LOVES YOU

# ? May 28, 2024 13:47

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

well yes, doing so requires root privileges

# ? Apr 11, 2022 14:00

BlankSystemDaemon: Mar 13, 2009

my homie dhall posted:

well yes, doing so requires root privileges

containers are closer to chroot, which freebsd can do unprivileged as well, in so far as not being intended for isolation - but even if you suid jexec(8) or someone makes unprivileged jails work, that doesn't prevent the jail escape which is what i was talking about

# ? Apr 11, 2022 14:06

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

I'm not sure I'm completely following you, but in 2022 Linux containers can be run by unprivileged users and thus "container escape" could only ever give you unprivileged access

but it also seems kind of beside the point, because if you are able to escape a container you're already exploiting the kernel

# ? Apr 11, 2022 14:23

Cybernetic Vermin: Apr 18, 2005

my homie dhall posted:

I'm not sure I'm completely following you, but in 2022 Linux containers can be run by unprivileged users and thus "container escape" could only ever give you unprivileged access

in what way exactly is the container a container at the point where things casually stroll out of it? given how much you seem care about the security of the setup i do now imagine that the "unprivileged" level after container escape will be able to mess with everything of actual relevance on the machine, being precluded perhaps from changing the system clock.

# ? Apr 11, 2022 14:52

BlankSystemDaemon: Mar 13, 2009

my homie dhall posted:

I'm not sure I'm completely following you, but in 2022 Linux containers can be run by unprivileged users and thus "container escape" could only ever give you unprivileged access

but it also seems kind of beside the point, because if you are able to escape a container you're already exploiting the kernel

In the year 2022 you don't ever see a box rooted with a single exploit, though.
Attackers are going to use remote code execution, privilege escalation, container escapes and any or all of their individual tools may also use ROP gadgets, JIT spraying, rely on use-after-free, or any number of fun things.

The prime reason containers exist on Linux is to orchestrate things, and that's been the selling point since day one.
It's not about isolation, and even if you can retrofit isolation on top of all the various containers, it's interesting to look at how many escape exploits there's been in either docker or kubernetes, and try to at least consider how many people are going to go out of their way to activate the isolation mechanisms, which aren't default and take a not-inconsiderable amount of work to set up correctly.

# ? Apr 11, 2022 20:58

Progressive JPEG: Feb 19, 2003

what do you mean by "retrofit"? cgroups containers have had filesystem/network/process isolation for example since the beginning, where docker and kubernetes* both rely on kernel cgroups apis to actually apply the isolation. each container is a plain linux process that has rules enforced at the kernel

at the "raw" cgroups api you can pick which resource classes to enforce. filesystem isolation for example is optional at that level, but the option has always been there and it's unusual to not use it. like if you're doing containers via systemd (also cgroups underneath) then maybe you just limit cpu/mem while leaving the others using host resources

anyway to answer the security thing, the worst case risk of breaking out of a container in kubernetes is that you then have access to the kubelet process, in the worst case allowing:
- access to all containers running via the local kubelet
- access to certificates that allow mimicing the kubelet to e.g. access all secrets in the cluster default secret store (but not in alternate stores like vault)

but to do that you first need to find a vulnerability in kernel process management that can also be applied to the configuration of the container that you have access to

* kubernetes may even be using dockerd as its container engine, but it's quite bad and these days normally you'd be using containerd outside of specific holdouts like eks. but it's all using cgroups underneath

# ? Apr 11, 2022 22:04

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

Cybernetic Vermin posted:

in what way exactly is the container a container at the point where things casually stroll out of it? given how much you seem care about the security of the setup i do now imagine that the "unprivileged" level after container escape will be able to mess with everything of actual relevance on the machine, being precluded perhaps from changing the system clock.

yeah, but what you�re describing is not the case if you�re holding it correctly

admittedly people are mostly not doing that, but don�t blame Linux!

BlankSystemDaemon posted:

In the year 2022 you don't ever see a box rooted with a single exploit, though.
Attackers are going to use remote code execution, privilege escalation, container escapes and any or all of their individual tools may also use ROP gadgets, JIT spraying, rely on use-after-free, or any number of fun things.

The prime reason containers exist on Linux is to orchestrate things, and that's been the selling point since day one.
It's not about isolation, and even if you can retrofit isolation on top of all the various containers, it's interesting to look at how many escape exploits there's been in either docker or kubernetes, and try to at least consider how many people are going to go out of their way to activate the isolation mechanisms, which aren't default and take a not-inconsiderable amount of work to set up correctly.

look, I think a problem here is that containers is an imprecise term. largely you�re talking about some nice api on top of cgroups and namespaces, but there are also Linux container runtimes available that intercept and emulate system calls or use the in-kernel kvm machinery to run the process in what is essentially its own individual vm

to your point, I agree that the primary container runtime that initially got traction on Linux, which was docker, traded usability for security in its initial implementation where required. they knew operators were going to run all their containers as root even though they explicitly said �do not do this!� and predictably users do exactly that and run root containers all day long.

but! the major primitives docker relies on, namespaces and cgroups, are very much designed for strong isolation guarantees. as I mentioned, since 3.8, root is not required at all to use these tools, not even suid. and they�re pretty powerful, you can start a container within which a process is running as �root� with full capabilities, but that root will actually just map to the unprivileged user that started the container.

as for why so many of these exploits pop up on Linux as opposed to FreeBSD, I�d imagine it�s because Linux has users

# ? Apr 12, 2022 01:44

Progressive JPEG: Feb 19, 2003

big gnomes big problems

# ? Apr 12, 2022 02:40

Sapozhnik: Jan 2, 2005; Nap Ghost

Rootless containers are so bad from a security standpoint that enterprise distros disable them outright. Unless something changed recently.

A user can create a namespace containing a confined fake root user but all too often there is a flaw in Linux's security checks that allow it to act as an unconfined real root. Because these checks were not designed for a namespaced fake root originally and retrofitting this concept after the fact is dangerous.

# ? Apr 12, 2022 03:14

mycophobia: May 7, 2008

found an ugly but quite functional dual pane file manager called double commander. wanted something comparable to altap salamander in windows and i think this just about fits the bill

# ? Apr 12, 2022 03:40

Mr. Crow: May 22, 2008; Snap City mayor for life

Sapozhnik posted:

Rootless containers are so bad from a security standpoint that enterprise distros disable them outright. Unless something changed recently.

A user can create a namespace containing a confined fake root user but all too often there is a flaw in Linux's security checks that allow it to act as an unconfined real root. Because these checks were not designed for a namespaced fake root originally and retrofitting this concept after the fact is dangerous.

Gonna need some citations

# ? Apr 12, 2022 03:58

mystes: May 31, 2006

mycophobia posted:

found an ugly but quite functional dual pane file manager called double commander. wanted something comparable to altap salamander in windows and i think this just about fits the bill

If you don't already know that these are all norton commander clones this might give you the appropriate term to google for

# ? Apr 12, 2022 04:11

mycophobia: May 7, 2008

mystes posted:

If you don't already know that these are all norton commander clones this might give you the appropriate term to google for

yeah ive briefly looked around for some before but i havent found anything this full featured until now. i dont actually have a pressing need for a file manager like this outside of work where i use windows anyway lol but its cool to have

# ? Apr 12, 2022 04:15

sb hermit: Dec 13, 2016

Fedora 36 Beta is shaping up to be pretty good. I can actually use the tpm with cryptenroll now, so I can have an encrypted root disk without the need to type anything to decrypt it.

It's not really high security by any means, but it strikes the balance between reducing user friction and addressing the use case where someone replaces a hard drive or repurposes it but forgets to wipe it. It should work well as a fileserver I can leave with my parents.

# ? Apr 12, 2022 05:13

Rufus Ping: Dec 27, 2006; I'm a Friend of Rodney Nano

Mr. Crow posted:

Gonna need some citations

https://twitter.com/search?q=from%3A%40grsecurity%20%22unpriv%20userns%22&src=typed_query&f=live

# ? Apr 12, 2022 05:53

git apologist: Jun 4, 2003

BlankSystemDaemon posted:

why yes, let me make my prompt absofuckinglutely unreadable by anyone and filling it with things i don't need when i'm working, so that i can be constantly distracted and not get any work done

yeah it owns. with powerlevel10k it�s :discourse:

# ? Apr 16, 2022 04:38

git apologist: Jun 4, 2003

putting in a new low power server in my house as a generic shell environment for dicking about, and to run all my nerd dockers (plex, transmission, pihole, et al). should i use fedora server or red hat, i kinda wanna try red hat so i can know a little about it for work

# ? Apr 16, 2022 04:40

sb hermit: Dec 13, 2016

Gentle Autist posted:

putting in a new low power server in my house as a generic shell environment for dicking about, and to run all my nerd dockers (plex, transmission, pihole, et al). should i use fedora server or red hat, i kinda wanna try red hat so i can know a little about it for work

unless you have a specific version of rhel in mind, you should just stick with fedora so that you can plan for the futute instead of being shackled to tools that might get OBE'd anyway.

# ? Apr 16, 2022 04:43

BlankSystemDaemon: Mar 13, 2009

Gentle Autist posted:

yeah it owns. with powerlevel10k it�s

that... whatever it is is the definition of :barf:

# ? Apr 16, 2022 10:40

yummycheese: Mar 28, 2004

yea careful with RHEL. stuff like curl, openssl, imagemagick will get pinned to a version and stay at that version with only minor security backports for a decade.

great for work where you dont want random surprises. but frustrating for home where you might want to play with the newest stuff

# ? Apr 16, 2022 19:23

git apologist: Jun 4, 2003

fedora it is, thanks friends

# ? Apr 16, 2022 19:55

carry on then: Jul 10, 2010; by VideoGames
(and can't post for 10 years!)

yah i got a little thinkcentre tiny for that and fedora server is perfect for that use case

# ? Apr 17, 2022 00:43

Soricidus: Oct 21, 2010; freedom-hating statist shill

yummycheese posted:

yea careful with RHEL. stuff like curl, openssl, imagemagick will get pinned to a version and stay at that version with only minor security backports for a decade.

great for work where you dont want random surprises. but frustrating for home where you might want to play with the newest stuff

can�t wait to get home and boot up the latest curl to see what new cli options they�ve thought of

# ? Apr 17, 2022 10:29

Tankakern: Jul 25, 2007

lol

# ? Apr 17, 2022 11:41

Shaggar: Apr 26, 2006

Soricidus posted:

can�t wait to get home and boot up the latest curl to see what new cli options they�ve thought of

# ? Apr 17, 2022 16:39

git apologist: Jun 4, 2003

carry on then posted:

yah i got a little thinkcentre tiny for that and fedora server is perfect for that use case

the thing i have coming is an hp usff with a t-series (low power laptop) i5. I�m digging the concept and might find some more excuses to buy more, like setting up a nice retro emulator appliance for my 8 year old nephew using a launchbox frontend

# ? Apr 18, 2022 08:51