With permission, I am forwarding a message from Harshal Patil. I believe he's asking an interesting question.

Begin forwarded message:

From: Harshal Patil <harpatil@redhat.com> Subject: Kubernetes Pod Privilege Escalation using kata? Date: 21 January 2021 at 11:25:11 CET

It would be interesting to know how those attack scenarios turn out when kata runtime used,

https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escal...

We could list the various "doors" described in the article in our thread assessment document, and document the impact in the case of Kata, e.g. how Kata helps. - Privileged: Not available in Kata - HostPID: Not available in Kata. GuestPID would not be nearly as bad. - HostPath: Additional opportunities for filtering through virtiofs (e.g. extended attributes, UID/GID mapping, etc) - HostNetwork: That's the part I'm least at ease with. I think we need to distinguish between virtio and SR-IOV, but also take into account that in the SR-IOV case, you have dedicated hardware. - HostIPC: Not available in Kata? We probably should also have more info on container escapes in Kata.