I intend to use LXC containers to isolate most of the network facing services.
As per my understanding, I have mainly two ways to do this:
Create unprivileged containers owned by root. In this case, root will have a single large set of sub-UIDs and sub-GIDs and different subsets of this range will be affected to each container (no container will share any sub-UID or sub-GID with one another),
Create unprivileged containers owned by unprivileged system accounts. In this case, each account will own a single container and the subordinate UIDs and GIDs required for this single container.
From a usability point-of-view, the former is far better: easier to setup and maintain.
However, from a security perspective, is there any difference between the two?
For instance:
Is there any link or horizontal relationship of some sort between IDs belonging to the same pool (same line) as defined in
/etc/subuid
and/etc/subgid
, compared to IDs belonging to different users and therefore belonging to different pools (different lines)?Is there any link or vertical relationship of some sort between a subordinate ID and its owner account? May a subordinate ID owned by root manage to get higher privilege than a subordinate ID owned by an unprivileged user? Can a subordinate ID escalate to its owner ID in an easier way than escalating to any other arbitrary ID?
Owned by root means that all commands to administrate the container will be launched with host's root privilege. Does this constitute a weakness, or for instance are all privileges dropped early?
Etc.
In other words: may root owned unprivileged containers be "less unprivileged" than ones owned by standard accounts?