Re: Security issue with Docker / namespaces?

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--spC7lmEQjC8cmjkZTPMNWomwAZ7KO83e5
Content-Type: multipart/mixed; boundary="yZWzrAWWvJRaUqW2WjxfIaf0cTKzB4PS2";
 protected-headers="v1"
From: Jean-Christophe Baptiste <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [opensuse-security] Security issue with Docker / namespaces?
References: <[email protected]>
In-Reply-To: <[email protected]>

--yZWzrAWWvJRaUqW2WjxfIaf0cTKzB4PS2
Content-Type: text/plain; charset=utf-8
Content-Language: fr
Content-Transfer-Encoding: quoted-printable

Moreover, cat /etc/shadow shows host's users that should not be there
(understand: my user)...



Le 24/01/2018 =C3=A0 16:01, Jean-Christophe Baptiste a =C3=A9crit=C2=A0:
> Hi guys,
>=20
> I am afraid of a security issue with Docker.
> Sorry but I have no other machines to test for now, so it might be a
> local issue only.
>=20
> I realized that today when running an Ubuntu container :
>=20
>     % docker run -ti --rm --hostname=3Dubuntu --net=3Dhost ubuntu /bin/=
bash
>=20
> It runs a bash shell inside the Ubuntu container.
>=20
> But, from within the container (screenshot attached):
>=20
>     % apt update
>     # should fail, not finding the command
>     % zypper refresh
>     # unexpectedly, it would work and refresh the host repos!
>=20
> Of course, this is absolutely abnormal and I am still evaluating the
> exact impact.
>=20
> I can tell that the issue was not here one week ago (I have been a quit=
e
> intensive Docker user for around 2 years).
>=20
> So I am not sure what is causing this behavior.
>=20
>=20
> Looking forward to reading some feedbacks.
>=20
>=20
> Best regards,
>=20


--=20
JCB


--yZWzrAWWvJRaUqW2WjxfIaf0cTKzB4PS2--

--spC7lmEQjC8cmjkZTPMNWomwAZ7KO83e5
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJDBAEBCAAtFiEEDRNrFp6C2rc+Nbe1Xr8wSadOPDEFAlpooOsPHGpjQHBob2Nl
YW4ubmV0AAoJEF6/MEmnTjwxidcP/iGe8C2ZH7BckeSyUn9ELBcN5Ca/ASgEx+qK
z2zttDiP2YyV/fWBiLCTpytUdAux0BmpGBC9mv3EiCsyfdi2SIzxkp5WyTuTD3iU
MRGAKi6t22dL/N4pNgdcwOFtDsEp9IfwA34W9AB1nDWpEexlWL4puOMyft1A0Csw
l6Twbs9hSs+ekAl4leVFoUO6BdhgNACKcWeYVSaAlMj6TDhBXuJEqoMwDcTMYGn+
Lp7PP2L7JwEjfK7O9igSgQgbJjkE2vdU3jq1xWNnaRVNjpfFxESLhwXbNs7mJpKL
rtDJ1lZ8/vPOAv4u4zLGKr0bG5CURaL90AIYLKIlSFSx8pBwqFr6ipsUMs6cRwlk
1XUU0/9JFnBT4GO8JQWHDP/WFwUzMMZtleoLB1ZUH8RkiNRzgqbsg9AFT6hNgL4W
+ZpqeuAIf1Qk+k1DMK7qm3SY4WmRK4IgBWtINvcQ04ewN4IZ+YtK5y7h5+cSmLZb
3g/XFG+6cjeuxlPxDKm7OZ4cfNXHVf3fD7zM+lB7JrmD42jHKouoEZYg33dcP3Tu
lKhlC0o9ySSyuxxgm3DPprDL6WsYsb+TFcqZBRPAl+d4kYBvYnpK6Iwk/dbENFr2
eeeEuJv7nxh9pEP8JwZuIGFNnkB3ETyAes1F54J0AQnJM0xQ5ccFslUYC/OaaJcQ
mkZIDT1E
=EB/i
-----END PGP SIGNATURE-----

--spC7lmEQjC8cmjkZTPMNWomwAZ7KO83e5--
-- 
To unsubscribe, e-mail: [email protected]
To contact the owner, e-mail: [email protected]