vvzvlad/portainer
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(containers): prevent non-admin users from running containers using the host namespace pid (#3970)

Browse Source 
* feat(containers): Prevent non-admin users from running containers using the host namespace pid

* feat(containers): add rbac check for swarm stack too

* feat(containers): remove forgotten conflict

* feat(containers): init EnableHostNamespaceUse to true and return 403 on forbidden action

* feat(containers): change enableHostNamespaceUse to restrictHostNamespaceUse in html

* feat(settings): rename EnableHostNamespaceUse to AllowHostNamespaceForRegularUsers
This commit is contained in:
Maxime Bajeux
2020-07-07 23:48:34 +02:00
committed by GitHub
parent b0ad212858
commit 0f58ece899
13 changed files with 95 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/http/proxy/factory/docker/containers.go
+12 -3
View File
@@ -156,10 +156,15 @@ func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelB
func (transport *Transport) decorateContainerCreationOperation(request *http.Request, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType) (*http.Response, error) {
type PartialContainer struct {
HostConfig struct {
Privileged bool `json:"Privileged"`
Privileged bool `json:"Privileged"`
PidMode string `json:"PidMode"`
} `json:"HostConfig"`
}
forbiddenResponse := &http.Response{
StatusCode: http.StatusForbidden,
}
tokenData, err := security.RetrieveTokenData(request)
if err != nil {
return nil, err
@@ -188,7 +193,7 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
return nil, err
}
if !settings.AllowPrivilegedModeForRegularUsers {
if !settings.AllowPrivilegedModeForRegularUsers || !settings.AllowHostNamespaceForRegularUsers {
body, err := ioutil.ReadAll(request.Body)
if err != nil {
return nil, err
@@ -201,7 +206,11 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
}
if partialContainer.HostConfig.Privileged {
return nil, errors.New("forbidden to use privileged mode")
return forbiddenResponse, errors.New("forbidden to use privileged mode")
}
if partialContainer.HostConfig.PidMode == "host" {
return forbiddenResponse, errors.New("forbidden to use pid host namespace")
}
request.Body = ioutil.NopCloser(bytes.NewBuffer(body))