[Lxc-users] How much LXC is secure?

[Daniel P. Berrange]

On Mon, Nov 11, 2013 at 01:49:11PM +0100, Adam Ryczkowski wrote:
> On 11.11.2013 13:43, Daniel P. Berrange wrote:
> > On Mon, Nov 11, 2013 at 01:19:25PM +0100, Adam Ryczkowski wrote:
> >> Last year I've read many times, that LXC have some outstanding
> >> security issues, and are the encapsulation is not tight enough to
> >> prevent hijacking the host, when the guest is compromised. But I
> >> never managed to find out, how exactly does one escape the LXC
> >> container.
> >>
> >> I'm using the LXC containers as a holders for virtual computers
> >> (just as advertized in
> >> https://help.ubuntu.com/12.04/serverguide/lxc.html) in hope, that
> >> this will make another line of defense against hackers anyway.
> >>
> >> Recently the host got hacked (Ubuntu 12.04 precise with kernel
> >> 3.8.2) , and I have renewed suspicions about the impenetrability of
> >> LXC.
> >>
> >> I wonder what is the state of affairs now. How does one implement
> >> virtual computers inside LXC containers, so root on a guest cannot
> >> get root rights on host?
> > If you have a process running as "root" inside the container, then
> > you should assume it is *insecure* unless the container is configured
> > with either a user namespace uid+gid mapping, or some mandatory
> > access control (MAC) system like SELinux / AppArmour.  Without the
> > uid/gid mapping or a MAC layer, root in the container has all sorts
> > of access to stuff in sysfs & procfs that it can use to cause havoc
> > in the host, and quite possibly other things besides.
>
> Do you know by chance, how does it apply to the long Ubuntu 12.04? It 
> uses AppArmour, but how sufficiently it is configured out-of-the-box?

Afraid you'll need one of the ubuntu devs to answer that question.

> How to check if the server uses uid+gid mapping?

It is a guest config property - 'lxc.id_map' - so unless you've
configured it, I doubt it will be used. I'm not even sure that
the Ubuntu 12.04 kernel supports this yet.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|