From 02fddffd51da782f912e2709ea814c330269515b Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Tue, 11 Feb 2014 11:10:55 +0100 Subject: [PATCH] lxc: Drop NET_ADMIN capability in non-privileged containers With this capability set the container can e.g. change the ip address of his devices to that of another container on the docker0 bridge. In a quick test I was able to listen to a port on a different ip than the one docker assigned me, but was not able to hijack an open port redirection that another container had open. Maybe its possible with some more knowledge of networking though. Anyway, network setup is meant to be handled by docker, not the apps, so I believe denying this is generally in the spirit of docker, and it closes down potential security issues. Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson) --- execdriver/lxc/init.go | 1 + 1 file changed, 1 insertion(+) diff --git a/execdriver/lxc/init.go b/execdriver/lxc/init.go index 7c2b039c5..0a7746dd1 100644 --- a/execdriver/lxc/init.go +++ b/execdriver/lxc/init.go @@ -127,6 +127,7 @@ func setupCapabilities(args *execdriver.InitArgs) error { capability.CAP_AUDIT_CONTROL, capability.CAP_MAC_OVERRIDE, capability.CAP_MAC_ADMIN, + capability.CAP_NET_ADMIN, } c, err := capability.NewPid(os.Getpid())