3

In a docker container I am reading the files /proc/stat and /proc/meminfo. As I understand they are the ones of the host. (Not local to the docker container)
In a meeting, a co-worker said that this is a security breach and must be vetted by internal security consultants.
The container does neither run privileged, nor as root. My program inside the container does neither.

Question 1: is he right in saying, that this is a security breach?
Question 2: What if I bind-mounted the host's /proc directory to some folder of the container. Would that then be a security breach?

  • What counts as "security breach" in your company? – domen Feb 5 at 10:31
  • I'm just the intern, I honestly don't know what he meant. I think it comes down to "diminishes security of the product" - whatever that means exactly.. – simmue Feb 5 at 13:36
  • Generally one should restrict access to resources even if it's not obvious how it could be abused. Info from /proc/ tells a lot about the kernel, drivers and processes running and could be useful to attacker. If I'm trying to escalate privileges it's the first place i'll look at (indirectly, through uname, ps and similar utilities). – domen Feb 5 at 14:54
  • That makes sense, thank you. But still remaining is question 1: /proc is automatically available to the docker container, even if I don't bind-mount it. So just reading it should not be a security issue, right? – simmue Feb 5 at 15:51
  • In theory you should not see other information related to other dockers, for example if you use the command netstat, that access to proc directly, you will see only the connections of your docker, not from others. If you discover that something is not related to your docker, this could be an issue or not depending on the case or the information. The proc filesystem is big and have a lot of files that may or may not contain sensitive information. – camp0 Feb 5 at 16:09
2

What you're able to see from the process running in the Docker container is a filtered view of the hosts /proc filesystem. It's somewhat less than what any process running on the host could see.

on Q1 Whether this is a security breach depends very much on the environment you're operating in. For most environments, this isn't likely to be an issue, you might want to ask your colleague what exactly he thinks the problem is (i.e. what information is being disclosed from those locations that compromises the security of the environment)

On Q2 bind mounting /proc is a somewhat different story as that will expose a lot of information into the container which may be sensitive. Again it may or may not be a problem depending on your environment, but it's a more risky prospect.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.