Rootless docker and symlink to docker.sock security issues
from Guadin@k.fe.derate.me to selfhosted@lemmy.world on 26 Jun 19:12
https://k.fe.derate.me/m/selfhosted@lemmy.world/t/792785

I changed my docker installation to rootless. I now installed Patchmon on the host and I wanted to monitor and update my Docker images as well. But Patchmon requires docker.sock to be in /var/run. My current docker.sock is of course in /run/user/{userid}. Are there any security risks, and if so what are they, to making a symlink to have the docker.sock in /var/run as well? The /run/user/{userid}/docker.sock is owned by the user running Docker. The symlink is owned by root because of the privileges needed for /var/run.

I don't have enough knowledge to be doing these kind of things, but I just like to tinker and I want to know how insecure this setup could be.

#selfhosted

threaded - newest

dan@upvote.au on 26 Jun 19:38 next collapse

Does Patchmon not have a setting to look for the Docker socket in a different location?

I could be wrong but I don’t think there’s any security issues making a symlink to a socket, since permissions/ACLs on the socket would still apply.

Guadin@k.fe.derate.me on 26 Jun 19:55 collapse

No unfortunately they haven't implemented the option to point to a different docker.sock.

Pika@sh.itjust.works on 26 Jun 22:49 next collapse

I’m not fully understanding here, are you saying that the symlink is root because root is required to access /var/run or that its root because its required by patchmon.

If its root because the rest of the /var/run is root, is it not on the table to just chown the /var/run/docker.sock symlink to be the userid? since I would assume that patchmon would be running as the docker user anyway since you are running in a rootless environment? I might be misunderstanding.

As long as your permissions to the symlink are in line with the permissions on the original sock, I wouldn’t expect there would be too much risk there. Of course a malicious vector /could/ see that a /var/run/docker.sock exists and try to manipulate it, but, since docker itself isn’t root which means that user executing the symlink isn’t root, I don’t think it would allow for escalation.

Guadin@k.fe.derate.me on 27 Jun 18:12 collapse

I tried to chown the /var/run/docker.sock but that doesn't work. It remains root, without errors.
Patchmon runs as root, since the docker is on an other host an had the patchman agent. Patchmon needs to run as root since it uses apt to update.

groet@feddit.org on 27 Jun 07:56 collapse

  1. is there a reason you don’t use podman instead of rootless docker?
  2. can you run patchmon inside of docker and mount the socket to the original path inside of the container?
  3. the symlink has the file permissions of the file it points to. If the socket is owned by a user, so will the symlink, even if you used root/sudo to create the link. (technically the symlink will be owned by root, but the permissions on a symlink are ignored and the permission of the target are used)
  4. as long as you don’t change any permissions on /var/run or on the docker.sock to be more permissive than they are now, there is functionally no difference in security
  5. If you or someone else on the system tries to run docker with a different user/root, the symlink will likely cause issues
Guadin@k.fe.derate.me on 27 Jun 18:15 collapse

Thanks for the answer.

  1. Not really. I just never looked into podman and knew Docker already (as in, I can create container with docker compose).
  2. Running Patchmon in Docker does not work, it's the patchmon-agent to update the host running docker. So it needs access to apt on the host.
  3. Perfect, it shows as root but the user owns the original .sock.
  4. Will not do.
  5. Didn't think of that. Not a problem now but it could be in the feature.