Accuracy w/r/t https://github.com/docker/labs/tree/master/security/capabilities

[jleadford]

The noted page states:

"Docker images cannot have files with capability bits set. This reduces the risk of Docker containers using capabilities to escalate privileges. However, it is possible to mount volumes that contain files with capability bits set into containers. Therefore you should use caution if doing this."

I wanted to try this out. I spun-up an Ubuntu container on the newest version of Docker Desktop CE for macOS, which packages Docker 19.03.1, i.e. docker run -it --rm ubuntu /bin/bash

Docker retains the SETFCAP capability by default, and to use it I installed libcap2, libcap2-bin.

I was able to use setcap on a file inside my container's rootfs, but do note that the container's bounding set restricted me from using e.g. CAP_SYS_ADMIN upon executing the file with execve:

In this case, execve returns EPERM (PoC behaves the same way in default Docker container, strace is just for illustration), which seems related to the following at http://man7.org/linux/man-pages/man7/capabilities.7.html, noting that a file's capabilities are masked off by the process's bounding set:

And also note the following at https://www.kernel.org/doc/ols/2008/ols2008v1-pages-163-172.pdf

Docker's inheritable set matches its bounding set (that is, the Docker default capabilities), so even if the file holds a capability in its inheritable set, it's not brought up into the permitted set for the resulting process:

So, I am not certain file capabilities are an issue for Docker, in any case.

[jleadford]

Also, as moby/moby#5650 (comment) and my examples note, looks file file caps /are/ supported by at least some images (e.g. Ubuntu), so I don't think "Docker images cannot have files with capability bits set." is accurate either.

[loot-king]

🙏

[amouat]

Files inside docker images can have capabilities set, so the page is wrong as it stands.

As proof, you can clone this repository https://github.com/ContainerSolutions/capabilities-blog/ and run:

$ docker build -t capblog .
...
$ docker run capblog getcap /set_ambient
/set_ambient = cap_net_bind_service+p

This may only work with some storage drivers however.