Open Stack

With permission, I am forwarding a message from Harshal Patil.
I believe he's asking an interesting question.

> Begin forwarded message:
> 
> From: Harshal Patil <harpatil at redhat.com>
> Subject: Kubernetes Pod Privilege Escalation using kata?
> Date: 21 January 2021 at 11:25:11 CET
> 
> It would be interesting to know how those attack scenarios turn out
> when kata runtime used,
> 
> https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
> 

We could list the various "doors" described in the article
in our thread assessment document, and document the impact
in the case of Kata, e.g. how Kata helps.

- Privileged: Not available in Kata

- HostPID: Not available in Kata. GuestPID would not be nearly as bad.

- HostPath: Additional opportunities for filtering through virtiofs
  (e.g. extended attributes, UID/GID mapping, etc)

- HostNetwork: That's the part I'm least at ease with. I think we need
to distinguish between virtio and SR-IOV, but also take into account
that in the SR-IOV case, you have dedicated hardware.

- HostIPC: Not available in Kata?


We probably should also have more info on container escapes in Kata.