>> "Source: Security at Docker"
In case it is not obvious, the comment above is by Nathan McCauley, who is the Director of Security for Docker.
In case it is not obvious, the comment above is by Nathan McCauley, who is the Director of Security for Docker.
Please don't sign comments; they're already signed with your username. If other users want to learn more about you, they can click on it to see your profile.
Also, there is an assumption that the signature contains up to date information and/or does not change over time. The latter situation would else impact historical purpose. The signature has changed and does not refer to the position/information related to the moment of writing.
I agree with how both jwildeboer (Jan) and shykes (Solomon) approached this. Much appreciated in this case.
But yes, in a normal situation, this is irrelevant and the username signature is sufficient.
The comment was signed with his username, and his Docker affiliation was disclosed under said username. That was all that was needed to add validity to the claims in the comment.
All HN comments have that "generic signature". All HN users are free to disclose information about themselves on their profile, and all HN readers are free to click usernames to learn more about the the people who comment on HN.
It really is that simple.
I'm going to take a look at both arguments and decide for myself. No need to name drop.
Give it a rest. This is a semi-anonymous forum where people's identities aren't tied to their usernames. This isn't name dropping, it's providing helpful context.
Some of the comments from Red Hat previously implied that they thought the vulnerability could only be exploited via ptrace, which SELinux denied by default for Docker containers. That's definitely not true; ptrace was used in the PoC because it's easy and likely to win the race condition, but you can also grab file descriptors out of /proc/$pid/fd.
However, the blog post appears to show SELinux stopping attacks that don't involve ptrace, because SELinux forbids writing to an open file or an open network socket that has the wrong context. If Docker believes there are attack vectors that aren't covered by the default SELinux policies (such as writing to something that's not a regular file or network socket), they might be unwilling to disclose that too loudly until Red Hat gets around to saying "Uh, actually please patch".
Edit: Don't downvote people trying to help me improve my english. :(
Just kidding.
It's relevant and vital to know the background of people who are making statements like this.
And sorry but not everyone is a kernel engineer who can navigate the truth between RedHat and Docker.