This project provides a simple Docker authorization plugin that prevents the running of containers with userns-mode set to host (--userns=host) when Docker user namespace remapping is enabled.
- "Privilege escalation" when starting the Docker daemon with user namespaces enabled
- Docker user namespaces
- Docker daemon attack surface
The use of "Docker user namespaces" is not a solution to the widely known "anyone with access to the Docker daemon effectively has root permissions on the host" problem.
This is because users can disable Docker user namespaces for any container by adding the --userns=host flag to the docker container create, docker container run, or docker container exec commands. See the Docker documentation
$ id
uid=1001(testuser) gid=1001(testuser) groups=1001(testuser),974(docker)
$ grep testuser /etc/sub?id
/etc/subgid:testuser:165536:65536
/etc/subuid:testuser:165536:65536
$ cat /etc/docker/daemon.json
{
"userns-remap": "testuser"
}
...
# Daemon-configured (default) user namespace:
$ docker run -it --rm --volume="/:/mnt/hostfs" fedora /bin/bash
[root@1d135f34d711 /]# cd /mnt/hostfs/root/
bash: cd: /mnt/hostfs/root/: Permission denied
...
# User-specified user namespace:
$ docker run -it --rm --volume="/:/mnt/hostfs" --userns=host fedora /bin/bash
[root@b6441243f429 /]# cd /mnt/hostfs/root/
[root@b6441243f429 root]#
...
# Solution provided by this plugin:
$ docker run -it --rm --volume="/:/mnt/hostfs" --userns=host fedora /bin/bash
docker: Error response from daemon: authorization denied by plugin deny-userns-mode-host: userns=host is not allowed.
See 'docker run --help'.- Download and compile the plugin source code:
$ go get github.com/nicdesousa/docker-userns-enforcement-plugin- Copy the
docker-userns-enforcement-pluginbinary to a suitable directory:
$ sudo cp $GOPATH/bin/docker-userns-enforcement-plugin /usr/local/bin- Create a systemd service and socket file for the plugin:
/etc/systemd/system/docker-userns-enforcement-plugin.service
[Unit]
Description=Docker User Namespaces Enforcement Plugin
Before=docker.service
After=network.target docker-userns-enforcement-plugin.socket
Requires=docker-userns-enforcement-plugin.socket docker.service
[Service]
ExecStart=/usr/local/bin/docker-userns-enforcement-plugin
[Install]
WantedBy=multi-user.target/lib/systemd/system/docker-userns-enforcement-plugin.socket
[Unit]
Description=Docker User Namespaces Enforcement Plugin
[Socket]
ListenStream=/run/docker/plugins/deny-userns-mode-host.sock
[Install]
WantedBy=sockets.targetEnable the plugin:
# systemctl daemon-reload
# systemctl enable --now docker-userns-enforcement-plugin- Configure the Docker daemon to use the plugin:
/etc/docker/daemon.json
{
"authorization-plugins": ["deny-userns-mode-host"],
"userns-remap": "testuser"
}Restart the docker service:
# systemctl restart docker- Test with the examples provided in the Background section.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent