beginner networking question

[alpine...@gmail.com]

[ If this is the wrong place for a question like this, my apologies. Please direct me to the appropriate venue. ]

I'm having trouble running a golang web app in a container built with acbuild, running under rkt on CoreOS, listening to ports 80 and 443. It works fine when listening to high-numbered ports.

For details, please see this post on ServerFault.

Thanks.

[Alban Crequy]

Could you try as user root, without:

acbuild set-user 500
acbuild set-group 500

I wonder if there is a bug when a non-root user tries to use extra capabilities.

Cheers,
Alban

[alpine...@gmail.com]

Yes, it does work when I remove those two lines. But if I do that, then the app runs as root, which negates one of the main purposes of running in a container - reducing privilege for the sake of security.

[Alban Crequy]

Hi,

When running as non-root, the capability is set correctly in the
bounding set but not in the effective set, so it is too restrictive in
practice:

$ sudo rkt run --insecure-options=image --interactive docker://ubuntu
--caps-retain=CAP_NET_BIND_SERVICE --exec=/bin/sh -- -c 'capsh
--print'
Current: = cap_net_bind_service+ep
Bounding set =cap_net_bind_service

$ sudo rkt run --insecure-options=image --interactive docker://ubuntu
--user=1000 --group=1000 --caps-retain=CAP_NET_BIND_SERVICE
--exec=/bin/sh -- -c 'capsh --print'
Current: =
Bounding set =cap_net_bind_service

rkt uses the systemd's option "CapabilityBoundingSet" to set the capability:
https://www.freedesktop.org/software/systemd/man/systemd.exec.html#CapabilityBoundingSet=

It does not use the option "AmbientCapabilities" (the doc says it is
"useful if you want to execute a process as a non-privileged user but
still want to give it some capabilities"):
https://www.freedesktop.org/software/systemd/man/systemd.exec.html#AmbientCapabilities=

Maybe we should add the option "AmbientCapabilities". Could you file
an issue on github to discuss this?

Cheers,
Alban

[Luca BRUNO]

On Tuesday, May 9, 2017 10:43:02 AM UTC Alban Crequy wrote:
> Hi,
>
> When running as non-root, the capability is set correctly in the
> bounding set but not in the effective set, so it is too restrictive in

> practice.

We should document that our capabilities features are (currently) implementing
the bounding-set semantics.
But it shouldn't be a blocker in this case, as setting the correct
file-capabilities should work anyway.

@alpinecarver, can you check whether the application in your image has the
correct filecaps? If so, I think the other default security isolators are
triggering NoNewPrivileges thus preventing this to elevate its privileges.

Ciao, Luca

--
"If you build a wall, think of what you leave outside it" - Italo Calvino

[alpine...@gmail.com]

I'm not sure how to do that. I tried setting `cap_net_bind_service` on the executable before running acbuild, but that did not fix the problem.

[Alban Crequy]

I don't know if "acbuild copy" preserves the file capability
correctly, unfortunately. I filed the issue
https://github.com/rkt/rkt/issues/3672