2

Context

In my "quest" to get LXC to run on Raspbian I may be forced to disable loading the seccomp configuration at container startup, by commenting it out in /usr/share/lxc/config/debian.common.conf:

# Blacklist some syscalls which are not safe in privileged
# containers
#  lxc.seccomp = /usr/share/lxc/config/common.seccomp

As (a.t.m.) only than the container starts (otherwise an error is raised)..

Turning off such a basic security setting that is so heavily tied to containerization/sandboxing is, to some extend, defeating the purpose of LXC. From a security/stability point of view I would very much like to keep blacklisting most of the system calls when running the LXC containers (as configured by LXC defaults in /usr/share/lxc/config/common.seccomp):

2
blacklist
[all]
kexec_load errno 1
open_by_handle_at errno 1
init_module errno 1
finit_module errno 1
delete_module errno 1

Questions

Does not 'loading seccomp rules for LXC containers' yield:

  1. significant * security issues?
  2. any other technical (application or stability) issues?

*Assuming I am the only one using the "mother" system and its LXC containers (otherwise it would be evident..)

1 Answer 1

4

Well, the seccomp rules prevent a container from modifying the host kernel. Without them, UID 0 in a container can use kexec(if that even works on Raspbian, I'm not sure) to load a new kernel(apparently not to start it) and insmod/rmmod to load/unload modules among other things as these syscalls don't take user namespaces into account correctly.

Whether this is a significant security issue is up to you - you just need to keep in mind that now UID 0 in the container can effectively become UID 0 outside of the container, i.e. it's possible for root to escape the container by loading a crafted module for example.

3
  • Thanks for your insights @maxf ! Is a "jail escape" by UID0 indeed the only thing to keep in mind? In that case, acknowledging (assuming?) I will be the only one having access to the system, this would not pose an issue for me. Any other (security / technical stability) risks I should think about?
    – woosting
    Commented Aug 25, 2016 at 9:07
  • Well, you could also crash the host by rmmod --force something important. But generally, as far as I know how LXC works, that's about it. If you're the only user and you don't use LXC to provide isolation, then you're probably fine (tm).
    – maxf
    Commented Aug 25, 2016 at 9:10
  • @woosting Generally, a jail escape is the worst thing that can happen with a container. So if that doesn't worry you then go ahead! Commented Sep 17, 2020 at 16:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .