KubeCon 2018 NA Subpath
2020-02-27 58浏览
- 1.How Symlinks Pwned K8s Michelle Au, Software Engineer, Google Jan Šafránek, Software Engineer, Red Hat
- 2.Agenda Discovery Development Disclosure Secure Practices Future
- 3.Vulnerability Reporting
- 4.Reporting Github issue created 2017-11-30 PodSecurityPolicy can be sidestepped with innocent emptyDir and subpath Here is a pod which would be allowed by fairly strict security policies, yet gives full control over node host by gaining access to dockersocket:…
- 5.Reporting Github issue created 2017-11-30 PodSecurityPolicy can be sidestepped with innocent emptyDir and subpath Here is a pod which would be allowed by fairly strict security policies, yet gives full control over node host by gaining access to dockersocket:…
- 6.Reporting That’s not how it’s done! Followhttps://kubernetes.io/docs/reference/issues-security/security/● Responsibly disclose to allow time to fix before public disclosure ● security@kubernetes.io (optionally GPG encrypted) ● Product Security Team handles the rest ○ Evaluate impact ○ Request CVE ○ Coordinate development of fix, release, disclosure
- 7.Vulnerability Details
- 8.Volumes Background Nodekind:Podspec:containers:-name:'>name:
