http://bugzilla.opensuse.org/show_bug.cgi?id=979533
Bug ID: 979533
Summary: when running trinity in docker, some network
interfaces are created (on host)
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Security
Assignee: security-team@suse.de
Reporter: mpluskal@suse.com
QA Contact: qa-bugs@suse.de
Found By: ---
Blocker: ---
Created attachment 676580
--> http://bugzilla.opensuse.org/attachment.cgi?id=676580&action=edit
trinity logs
What:
After executing trinity (see https://github.com/kernelslacker/trinity/) inside
docker, several new, undesired network interfaces appeared on guest:
# ip a
...
6: veth498404a@if5: mtu 1500 qdisc noqueue
master docker0 state UP group default
link/ether 0a:60:f3:26:7f:c2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::860:f3ff:fe26:7fc2/64 scope link
valid_lft forever preferred_lft forever
7: rose0: <NOARP> mtu 249 qdisc noop state DOWN group default qlen 1
link/rose 00:00:00:00:00 brd 00:00:00:00:00
8: rose1: <NOARP> mtu 249 qdisc noop state DOWN group default qlen 1
link/rose 00:00:00:00:00 brd 00:00:00:00:00
And several unwanted modules were loaded (i.e. can which is servers canbus
support).
My understanding is that such behavior is undesirable and can be considered
security issue.
Steps to reproduce:
Steps to reproduce:
In test machine:
# systemctl start docker
# docker pull opensuse
# docker run -t -i --memory 512M opensuse:latest /bin/bash
(now we are inside docker container):
# zypper in wget sudo
# mkdir docker
# chown nobody docker
# cd docker
# wget
http://download.opensuse.org/repositories/devel:/tools/openSUSE_Leap_42.1/x8...
# zypper in ./trinity-1.6+git.20160426-50.1.x86_64.rpm
# sudo -u nobody trinity
....
(see attached trinity logs, dmesg and output of ip a before and after trinity
was executed in container).
I have also noticed https://github.com/docker/libcontainer/pull/237 - which if
I understand correctly means that this could be prevented by using libseccomp,
which is however not enabled in openSUSE (and in SLE as well)
--
You are receiving this mail because:
You are on the CC list for the bug.
