DKER-EE-001240 - The Docker Enterprise hosts process namespace must not be shared.

Details

Process ID (PID) namespaces isolate the PID number space, meaning that processes in different PID namespaces can have the same PID. This is process level isolation between containers and the host.



PID namespace provides separation of processes. The PID Namespace removes the view of the system processes, and allows process IDs to be reused including PID 1. If the host's PID namespace is shared with the container, it would allow processes within the container to see all of the processes on the host system. This breaks the benefit of process level isolation between the host and the containers. Someone having access to the container can eventually know all the processes running on the host system and can even kill the host system processes from within the container. Hence, do not share the host's process namespace with the containers.



Container processes cannot see the processes on the host system. In certain cases, the container should share the host's process namespace. For example, the user could build a container with debugging tools like strace or gdb, but want to use these tools when debugging processes within the container. If this is desired, then share only one (or needed) host process by using the -p switch.



Example:


docker run --pid=host rhel7 strace -p 1234



By default, all containers have the PID namespace enabled and the host's process namespace is not shared with the containers.


Solution

This fix only applies to the use of Docker Engine - Enterprise on a Linux host operating system.

Do not start a container with --pid=host argument.

For example, do not start a container as below:

docker run --interactive --tty --pid=host centos /bin/bash


Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.


References


Source