[kata-dev] Fwd: [rh-kata-dev] Kubernetes Pod Privilege Escalation using kata?

Christophe de Dinechin dinechin at redhat.com
Thu Jan 21 19:11:27 UTC 2021

With permission, I am forwarding a message from Harshal Patil.
I believe he's asking an interesting question.

> Begin forwarded message:
> From: Harshal Patil <harpatil at redhat.com>
> Subject: Kubernetes Pod Privilege Escalation using kata?
> Date: 21 January 2021 at 11:25:11 CET
> It would be interesting to know how those attack scenarios turn out
> when kata runtime used,
> https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation

We could list the various "doors" described in the article
in our thread assessment document, and document the impact
in the case of Kata, e.g. how Kata helps.

- Privileged: Not available in Kata

- HostPID: Not available in Kata. GuestPID would not be nearly as bad.

- HostPath: Additional opportunities for filtering through virtiofs
  (e.g. extended attributes, UID/GID mapping, etc)

- HostNetwork: That's the part I'm least at ease with. I think we need
to distinguish between virtio and SR-IOV, but also take into account
that in the SR-IOV case, you have dedicated hardware.

- HostIPC: Not available in Kata?

We probably should also have more info on container escapes in Kata.

More information about the kata-dev mailing list