From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 18D0D1396D0 for ; Fri, 8 Sep 2017 19:20:51 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D31471FC0C8; Fri, 8 Sep 2017 19:20:48 +0000 (UTC) Received: from powerman.name (powerman.name [109.86.197.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 449A11FC0AC for ; Fri, 8 Sep 2017 19:20:47 +0000 (UTC) Received: (qmail 3256 invoked by uid 1000); 8 Sep 2017 19:20:45 -0000 Date: Fri, 8 Sep 2017 22:20:45 +0300 From: Alex Efros To: gentoo-hardened@lists.gentoo.org Subject: [gentoo-hardened] GRKERNSEC_PROC_USERGROUP and docker exec Message-ID: <20170908192045.GC2677@home.power> Mail-Followup-To: gentoo-hardened@lists.gentoo.org Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Organization: http://powerman.name/ User-Agent: Mutt/1.8.3 (2017-05-23) X-Archives-Salt: 950ec462-e66c-4696-8ed4-eba5b54dd3c9 X-Archives-Hash: d2429c0bfc2deafb0515aac718042250 Hi! It looks like when connecting to existing docker container with `docker exec` CONFIG_GRKERNSEC_PROC_USERGROUP (and probably CONFIG_GRKERNSEC_PROC_USER too) hide processes started by `docker run` from processes started by `docker exec` (all processes are running as docker "root", docker daemon is started with default options, i.e. without --userns-remap). Why is this happens and is there any workaround? $ sudo zgrep GRKERNSEC_PROC_USER /proc/config.gz # CONFIG_GRKERNSEC_PROC_USER is not set CONFIG_GRKERNSEC_PROC_USERGROUP=y $ docker run -d -it --rm --init alpine sh -c 'ps ax; exec sleep 42' 49bec4451495563d702ad0edb9a7c80a9a7f5918fab4eb67e5a44b803f3ac656 $ docker logs 49bec4451495 PID USER TIME COMMAND 1 root 0:00 /dev/init -- sh -c ps ax; exec sleep 42 7 root 0:00 sh -c ps ax; exec sleep 42 8 root 0:00 ps ax $ docker exec -it 49bec4451495 ps ax PID USER TIME COMMAND 9 root 0:00 ps ax -- WBR, Alex.