Re: Security issue with Docker / namespaces?

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Eh3UVlvdmSF22FPs6iOf581j9nE9t02m5
Content-Type: multipart/mixed; boundary="N5GcYsSFzrlhKDLVutHoVvxYuaLWX46ve";
 protected-headers="v1"
From: Jean-Christophe Baptiste <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [opensuse-security] Security issue with Docker / namespaces?
References: <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>

--N5GcYsSFzrlhKDLVutHoVvxYuaLWX46ve
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Never mind, more testing confirmed that it was a local issue.

Somehow my /var/lib/docker was trashed. Remove all the directory and
restarting from scratch solved the issue.

Regards,
JC

Le 24/01/2018 =C3=A0 16:06, Jean-Christophe Baptiste a =C3=A9crit=C2=A0:
> Moreover, cat /etc/shadow shows host's users that should not be there
> (understand: my user)...
>=20
>=20
>=20
> Le 24/01/2018 =C3=A0 16:01, Jean-Christophe Baptiste a =C3=A9crit=C2=A0=
:
>> Hi guys,
>>
>> I am afraid of a security issue with Docker.
>> Sorry but I have no other machines to test for now, so it might be a
>> local issue only.
>>
>> I realized that today when running an Ubuntu container :
>>
>>     % docker run -ti --rm --hostname=3Dubuntu --net=3Dhost ubuntu /bin=
/bash
>>
>> It runs a bash shell inside the Ubuntu container.
>>
>> But, from within the container (screenshot attached):
>>
>>     % apt update
>>     # should fail, not finding the command
>>     % zypper refresh
>>     # unexpectedly, it would work and refresh the host repos!
>>
>> Of course, this is absolutely abnormal and I am still evaluating the
>> exact impact.
>>
>> I can tell that the issue was not here one week ago (I have been a qui=
te
>> intensive Docker user for around 2 years).
>>
>> So I am not sure what is causing this behavior.
>>
>>
>> Looking forward to reading some feedbacks.
>>
>>
>> Best regards,
>>
>=20
>=20


--=20
JCB


--N5GcYsSFzrlhKDLVutHoVvxYuaLWX46ve--

--Eh3UVlvdmSF22FPs6iOf581j9nE9t02m5
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQJDBAEBCAAtFiEEDRNrFp6C2rc+Nbe1Xr8wSadOPDEFAlpozMgPHGpjQHBob2Nl
YW4ubmV0AAoJEF6/MEmnTjwxCYoQAKLabQe77Yclq7LdekzlakmZs6JZfTU3YfMm
cKMktqvU0VNc1/ywVOxZ5GFYX01GhyswYnGg8n+quCGbH5ajZnELUTvlpaSIdTBv
DbOx/CPDchxuTrce2OIX39xLwhCNwEc2sXW1d22Mrl6OGlRoeNmhSczE2/tSYfIW
j4H53OTAbdwAj1vkL1vJ5zM+Gib9+st0tUOnTgEG1LVlWuJXtQIf6gnM7lzcj+Y+
4CaJyA2h9W4TEgYo1/Nlc6SmDfAC+9Dlm6kGnL3SaMVChfWJ09UQBlkwQD6AdgSF
vY119kzE3txF59ZVuU3xlKAnMIdx8m+itfOtH6fIg6TYvrfDqhDyo7UHl87MUmwZ
5Nrpos/BqoUe/1dRSOMqS7hfKh96qlQ7LJ4wF7LQX8yEddSt1ctQ3sry3OMJmCZv
kgx8VDSV5Ysuyq0BC/FpFsn+39kd2hcgtkMXRb6wyF7AJYtMFF8kPzt5o8dHxN3W
lp6Shix9McHjRPNquPq2anW63K8QmKri5m7p7f/gu1ynXelHxzUOZ3pMkHgUnzqq
ZUkxI5lQhEf/ShP1F+m7uYGGlCFuU63z2+2Db+x3NueMoB5idqkE3IN66kAOwIdo
WmdI/35kxO1k1oD1F9QCs+U/6X/myiJ48EaieNli3jawXD0p93YgsE2kUAo4sbbD
qY3z/obm
=HaI/
-----END PGP SIGNATURE-----

--Eh3UVlvdmSF22FPs6iOf581j9nE9t02m5--
-- 
To unsubscribe, e-mail: [email protected]
To contact the owner, e-mail: [email protected]