4

A docker monitoring tool needs read access to the docker socket in order to collect stats. The setup instructions asks me to provide "Read-only access to the Docker socket" by running the following

sudo usermod -a -G docker nobody

Is this a safe thing to do?

2
  • What a good idea! ... Hem no.... It's a not so good idea! User nobody could only be member of nogroup! Dec 15, 2017 at 9:09
  • This would be a supplemental group. The primary group is indeed nogroup.
    – forest
    Dec 16, 2017 at 3:20

1 Answer 1

2

The nobody user was originally used for NFS. However people started using it to run daemons that did not need to run as root. This was fine when used by just one daemon, but it is no longer recommended when multiple daemons are running as that user. Linux only provides inter-user isolation, not intra-user isolation, meaning user X and user Y cannot tamper with each other's processes, but one process running as user X can tamper with another process running as user X. If Docker is running as the this user, anything running as the same user will be able to compromise it, for example by attaching debuggers and modifying memory via ptrace() and similar syscalls, sending signals via kill() or fcntl(), or even changing resource limits via prlimit64().

The recommended solution is to run an unprivileged daemon under its own user or group.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .