[kata-dev] Fwd: [rh-kata-dev] Kubernetes Pod Privilege Escalation using kata?
Christophe de Dinechin
dinechin at redhat.com
Thu Jan 21 19:11:27 UTC 2021
With permission, I am forwarding a message from Harshal Patil.
I believe he's asking an interesting question.
> Begin forwarded message:
> From: Harshal Patil <harpatil at redhat.com>
> Subject: Kubernetes Pod Privilege Escalation using kata?
> Date: 21 January 2021 at 11:25:11 CET
> It would be interesting to know how those attack scenarios turn out
> when kata runtime used,
We could list the various "doors" described in the article
in our thread assessment document, and document the impact
in the case of Kata, e.g. how Kata helps.
- Privileged: Not available in Kata
- HostPID: Not available in Kata. GuestPID would not be nearly as bad.
- HostPath: Additional opportunities for filtering through virtiofs
(e.g. extended attributes, UID/GID mapping, etc)
- HostNetwork: That's the part I'm least at ease with. I think we need
to distinguish between virtio and SR-IOV, but also take into account
that in the SR-IOV case, you have dedicated hardware.
- HostIPC: Not available in Kata?
We probably should also have more info on container escapes in Kata.
More information about the kata-dev