81 lines
2.2 KiB
Plaintext
81 lines
2.2 KiB
Plaintext
Disabling builder sandboxes can lead to unauthorized access of the host system
|
|
by malicious programs.
|
|
|
|
By default, programs executed by a `RUN` statement use only a subset of
|
|
https://man7.org/linux/man-pages/man7/capabilities.7.html[capabilities] which
|
|
are considered safe: this is called `sandbox` mode.
|
|
|
|
If you disable the sandbox with the `--security=insecure` option, the executed command
|
|
can use the full set of Linux capabilities. +
|
|
This can lead to a container escape. For example, an attacker with the
|
|
`SYS_ADMIN` capability is able to mount devices from the host system.
|
|
|
|
This vulnerability allows an attacker who controls the behavior of the ran command to access
|
|
the host system, break out of the container and penetrate the infrastructure.
|
|
|
|
After a successful intrusion, the underlying systems are exposed to:
|
|
|
|
* theft of intellectual property and/or personal data
|
|
* extortion
|
|
* denial of service
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The program is controlled by an external entity.
|
|
* The program is part of a supply chain that could be a victim of a supply chain attack.
|
|
|
|
There is a risk if you answered yes to either of these questions.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
* Whenever possible, the sandbox should stay enabled to reduce unnecessary risk.
|
|
* If elevated capabilities are absolutely necessary, make sure to verify the integrity of the program before executing it.
|
|
|
|
|
|
== Sensitive Code Example
|
|
|
|
[source,docker]
|
|
----
|
|
# syntax=docker/dockerfile:1-labs
|
|
FROM ubuntu:22.04
|
|
# Sensitive
|
|
RUN --security=insecure ./example.sh
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,docker]
|
|
----
|
|
# syntax=docker/dockerfile:1-labs
|
|
FROM ubuntu:22.04
|
|
RUN ./example.sh
|
|
RUN --security=sandbox ./example.sh
|
|
----
|
|
|
|
== See
|
|
|
|
* CWE - https://cwe.mitre.org/data/definitions/250[CWE-250 - Execution with Unnecessary Privileges]
|
|
* CWE - https://cwe.mitre.org/data/definitions/284[CWE-284 - Improper Access Control]
|
|
* https://docs.docker.com/engine/reference/builder/#run---security[Dockerfile reference] - RUN
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* Make sure that disabling the builder sandbox is safe here.
|
|
|
|
=== Highlighting
|
|
|
|
Highlight the `security` parameter, i.e. `--security=insecure`.
|
|
|
|
'''
|
|
|
|
endif::env-github,rspecator-view[]
|
|
|