I spend a lot of time working on crun and on how containers are kept separated from the host. Capabilities are one of the tools we use for that: instead of giving a container the full power of root, we hand out only the small pieces it needs. CAP_SYS_ADMIN gets most of the attention, since it is so powerful that people call it the new root, and dropping it is often treated as enough to make a container safe. I want to look at another capability that doesn’t sound so dangerous: CAP_SYS_PTRACE.

I have been working on a new functionality for the prctl syscall that addresses a common security concern with container runtimes. The /proc/self/exe symlink, which points to the executable of the running process, was the key ingredient in CVE-2019-5736, a vulnerability that allowed a malicious container to overwrite the container runtime binary on the host. The workaround deployed at the time — re-execing from a copy or using a read-only bind mount — treats the symptom rather than the cause.

Additional IDs that are allocated to a user through /etc/subuid and /etc/subgid must be considered as permanently allocated and never reused for any other user. The reason is that a setuid binary created inside a user namespace can retain access to any UID that was mapped in that namespace, even after the namespace is destroyed. If the same UID range is later assigned to a different user, that new user would inherit access to files owned by the old user’s containers.