ENH,SEC: Create additional sockets with limited permissions #38879

Activity

1. westurner commented on Mar 14, 2019

   

   westurner

   on Mar 14, 2019

   Last edited by westurner

   Author

   More actions

   https://docs.docker.com/glossary/?term=authorization

   "Access authorization plugin"
   https://docs.docker.com/engine/extend/plugins_authorization/

   • This requires managing certs, installing them into containers, and managing DNS/IPs.
2. thaJeztah

   added

   area/apiAPIAPI

   kind/featureFunctionality or other elements that the project doesn't currently have. Features are new and shinyFunctionality or other elements that the project doesn't currently have. Features are new and shiny

   area/daemonCore EngineCore Engine

   on Mar 14, 2019
3. thaJeztah commented on Mar 14, 2019

   

   thaJeztah

   on Mar 14, 2019

   Member

   More actions

   Thanks for opening; there's been quite some discussions around this (I'll link to some of them), and some attempts on possible implementations, but unfortunately, there was never a consensus on the right approach.

   I definitely agree that this is still a desirable feature though (my personal 0.02c).

   Some earlier discussions;

   • Better way to access the Engine API from a container #21622 Better way to access the Engine API from a container
   • Make it easier to access engine API #27261 Make it easier to access engine API
     • some suggestions in this comment: Make it easier to access engine API #27261 (comment)
   • Detect exposed ports from inside container #3778 Detect exposed ports from inside container (slightly different, but about containers being able to obtain information about itself from the API)
   • Proposal: container introspection #8427 Proposal: container introspection (also about introspection)
     • last attempt at implementing in [EXPERIMENTAL] new mount type: introspection #26331
   • Proposal: Entitlements in Moby #32801 Proposal: Entitlements in Moby (granular permissions for containers/images)

   👍React with 👍1Reacted by Bart clones it (or IT)
4. westurner commented on Mar 14, 2019

   

   westurner

   on Mar 14, 2019

   Author

   More actions

   Thank you for the references to earlier discussions.

   #27261 (comment) suggests three cap names: (DOCKER_CAP_FORK, DOCKER_CAP_INSPECT, DOCKER_CAP_ADMIN), which may be sufficiently granular.

   docker-socket-proxy [1] has:

   Access granted by default

   These API sections are mostly harmless and almost required for any service that
   uses the API, so they are granted by default.

   • EVENTS
   • PING
   • VERSION

   Access revoked by default

   Security-critical

   These API sections are considered security-critical, and thus access is revoked
   by default. Maximum caution when enabling these.

   • AUTH
   • SECRETS
   • POST: When disabled, only GET and HEAD operations are allowed, meaning
     any section of the API is read-only.

   Not always needed

   You will possibly need to grant access to some of these API sections, which are
   not so extremely critical but can expose some information that your service
   does not need.

   • BUILD
   • COMMIT
   • CONFIGS
   • CONTAINERS
   • DISTRIBUTION
   • EXEC
   • IMAGES
   • INFO
   • NETWORKS
   • NODES
   • PLUGINS
   • SERVICES
   • SESSION
   • SWARM
   • SYSTEM
   • TASKS
   • VOLUMES

   With the following from haproxy.cfg https://github.com/Tecnativa/docker-socket-proxy/blob/master/haproxy.cfg:

   frontend dockerfrontend
       bind :2375
       http-request deny unless METH_GET || { env(POST) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/commit } { env(COMMIT) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/configs } { env(CONFIGS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers } { env(CONTAINERS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/distribution } { env(DISTRIBUTION) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/events } { env(EVENTS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/exec } { env(EXEC) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/images } { env(IMAGES) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/info } { env(INFO) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/networks } { env(NETWORKS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/nodes } { env(NODES) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/_ping } { env(PING) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/plugins } { env(PLUGINS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/post } { env(POST) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/secrets } { env(SECRETS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/services } { env(SERVICES) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/session } { env(SESSION) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/swarm } { env(SWARM) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/system } { env(SYSTEM) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/tasks } { env(TASKS) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/version } { env(VERSION) -m bool }
       http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/volumes } { env(VOLUMES) -m bool }

   [1] https://github.com/Tecnativa/docker-socket-proxy
5. westurner commented on Mar 14, 2019

   

   westurner

   on Mar 14, 2019

   Author

   More actions

   It appears that #32801 has the longest list; but the only API permission listed is api.access in https://github.com/moby/libentitlement as well. moby/libentitlement#67 may also be relevant.